Tag Info

New answers tagged

1

If, by installing the anti-virus solution on the host system, you can achieve the same level of protection to the VMs as you would if they had anti-virus installed individually, then the end result is that all systems are protected from malicious software. This would satisfy compliance. There are very few products in the market that can be installed at the ...


1

I can speak about booking.com as I have previous experience. They used to fax full card details of a booking direct to the hotel. This would include card number, expiry and CVV2. This would then be used by the actual hotel receiving the booking, so yes it could be stored for a year, but not necessarily by booking.com, obviously in breach of PCI. It seems ...


5

Storing CVV is not allowed: There are a few things to consider: You assume booking.com is storing CVV You're assuming a CVV is needed to process a transaction. On 1) - there can be no way to confirm whether booking.com, Expedia are storing unless you work there. They would have to answer to a QSA. Now, as far as the CVV that is stored, that is CVV2 ...


0

Yes, if you receive, transmit, or store cardholder data in any form, you are required to comply with PCI-DSS. In fact, one of the things that you're required to do under PCI-DSS is encrypt that data using strong encryption. Though I am not a PCI auditor, I would suspect that RC2 would not, if fact, be considered strong encryption, so not only are you ...


0

Risky Behavior A survey of businesses in the U.S. and Europe reveals activities that may put cardholder data at risk. 81% store payment card numbers 73% store payment card expiration dates 71% store payment card verification codes 57% store customer data from the payment card magnetic stripe 16% store other personal data Source: Forrester Consulting: ...


1

You could isolate the user network and production network completely from the CDE, such as so a total compromise of the non-CDE enviroment cannot in any way compromise, reduce the security, or in some other way, affect the CDE enviroment. If you do that, then the user network and production network would be considered out of scope of PCI. However, its good ...


0

PCI DSS PAN Data (Personal Account Number) should following these principals when storing: Encrypt PAN number upon creation in database (typically with HSM device) Only decrypt PAN number when billing action occurs (reoccurring billing, use stored number to buy an item, etc.) Store, in separate column (or preferably separate dB) only last 4-digits of PAN, ...


0

I think you have a good approach. I find it interesting that users would complain about not being able to immediately identify card numbers when they can view the first six AND last four in your results table--it is unlikely that there would be two results with the same masked number. The way you currently have it implemented is good because it has very ...


3

First of all, checkout methods number 1 and 3 require you to become PCI compliant, it doesn't matter how long you store that information, the moment you store card holder data you need to be PCI compliant. Well the easy part is doing the actual SAQ and being audited, the hard part is actually having your environment set up so you actually pass the audit. ...


0

The DB URL (other than username and password) and Pepper aren't sensitive values. You may not want to advertise them, but you should assume they are known anyway. If your security is dependent on them being secure, then you are almost certainly not PCI compliant. Any "security" that that secrecy provides is just security by obscurity. The DB should be ...


1

Firewall auditing requires knowledge and interpretation, so there are no tools that will go 'ding!' and tell you you're compliant. However, various tools can be used to make the review and audit process easier. Two that I've used are: Tufin SecureTrack Nipper Studio And many tools will do, e.g. see Firewall rule base documentation and migration tools.


0

You can you use CIS benchmarks to evaluate your Firewall rules and configurations. It is very comprehensive and easy to understand and FREE. CIS benchmarks


3

An external vulnerability scan must scan all machines that are in scope for PCI-DSS that have public ips from outside the firewall (eg the internet). This must be done by a qualified party called an ASV. The PCI Council maintains a list of ASVs on their website. The internal vulnerability scan must scan all machines that are in scope for PCI-DSS from ...


4

The Guidance column of PCI DSS 1.3.3 (v3) states: Examination of all inbound and outbound connections allows for inspection and restriction of traffic based on the source and/or destination address, as well as inspection and blocking of unwanted content, thus preventing unfiltered access between untrusted and trusted environments. This ...


0

As of today (Oct 2014), AWS provides the perfect solution for this - AWS VPC. It uses EC2 instances, but clusters them in such a way that some of them are on a private subnet, and some are in public subnet (DMZ). The private instances can only be accessed through the public ones. In this setup, your webserver would be in the public subnet (DMZ zone), and ...


5

Basically any protocol that does not provide authenticity, integrity and confidentiality. In practice this means FTP should be FTPS or SFTP, telnet should be SSH, POP3 should be POP3S and IMAP should be IMAPS. It's important to disable all the other protocols and not just provide a secure alternative. The encrypted protocol should provide strong ...


1

This is referencing things such as FTP and telnet, which do not have any encryption at any point but ask for credentials. They basically are saying that you should not use protocols which transmit credentials in cleartext. As per the documentation here: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pdf "Examples of insecure services, protocols, ...


1

Here is the issue with this particular item. When evaluated on wording alone it seems clear, that different people are required for different environments. However a great deal of companies and QSAs even believe that this is a one way road. If you have access to development and do development, then you shouldn't have access to production. The issue with ...


2

The communication link between the application and the DB is the issue. If the application is what you consider your CDE then the database will be in scope because it is connected to the application. Depending on your access controls and other security controls for segmentation you might be able to remove the management portal from scope (assuming it sits on ...


0

IANAQSA No, I don't believe you can achieve the separation you're looking for. The PCI v3 quote you've provided describes using adequate network segmentation to isolate systems. What you're really asking, though, is can you isolate Shared DB (card details) from Shared DB (configuration)? And the answer is no, you can't, because they're... ah... Shared. ...


1

I dont know if this is PCI compliant, but you could sign the code inside the PCI compliant enviroment before uploading code to the cloud deployment system. Since the code is signed, it should in PCI sense be unmodifiable (e.g. if the repo is compromised, CDE wouln't accept data from it), thus you should be able to show that the cloud system CANNOT compromise ...


3

It doesn't require you to eliminate them, but if PCI-scoped user systems with PAN data on them can freely save files to them, then the file servers are in PCI scope and have to be subjected to full DSS compliance. ...and if your newly PCI-scoped file servers are also accessible to non-PCI-scoped user systems, then those non-PCI-scoped user systems are in ...



Top 50 recent answers are included