Tag Info

New answers tagged

0

The Windows Encrypting File System (EFS) would meet your usability requirements and probably the majority, if not all, of the PCI DSS requirements. However, I have not evaluated it against the DSS so I can't say for sure. You could turn on EFS for a directory structure and then point all your applications to write to subdirectories within that tree. ...


1

(Disclosure, I work for Braintree, a competitor to Stripe) At Braintree we also allow the CVV code to be passed in our API. You are correct that the PCI-DSS explicitly forbids non-issuers from storing the CVV. You are allowed to hold the code temporarily while waiting for the charge to be authorized. This is stated in PCI-DSS Requirement 3.2 (additional ...


2

Yes, it's a violation of PCI-DSS Requirements, specifically requirement 3.4: Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using any of the following approaches: One-way hashes based on strong cryptography (hash must be of the entire PAN) Truncation (hashing cannot be used to ...


0

Yes, you can't write out unencrypted PAN. If someone could force a crash while that file is being worked on, it would leave it sitting around on the server for anyone to access and the file could potentially be read by other processes. There is no such thing as a "temporary" file. There are only permanent files you intend to get rid of soon. Also, ...


2

There isn't anything inherently wrong with using a free antivirus product for PCI, but you really need to consider your centralized logging. You can't keep the logs for your antivirus strictly on the local workstation and meet the retention requirements.


0

PCI-DSS provides guidance, not product recommendations. It is up to you to decide how to protect yourself under the guidance of PCI-DSS. As such, free versions of AV can be adequate. But you have to determine it's best fit for your environment, and the risks and threats you have identified. Please do not use AV as a 'check the box' solution. v3 section ...


2

Technically, according to PCI SSC you can hold onto CVV and other sensitive authentication data until authorization has occurred. In other words the restriction on storing sensitive authentication data applies to post authentication/processing storage. Here is a document from the PCI SSC about data storage requirments. See the "Technical Guidelines for PCI ...


0

You need to speak to a QSA. You may not store the CVV. However, incidental storage may occur as part of an approved transactional flow, and that is acceptable if the QSA finds it so. Otherwise, it would be impossible to use CVV in batch transactions.


0

There are certainly (naturally) a lot of details missing here. I am in agreement with DKNUCKLES, and believe you have a process problem. Are you able to sanitize the rationale for the delay through authorization of your cardholder data? You definitely cannot store full track data or the CVV2 number at all.


1

You're not going to be able to do that - you'll need to find another way. If memory serves the PCI DSS framework also states that you can't store a credit card number (or other PAN) in plaintext in it's entirety. You'll need to obfuscate the middle numbers as is show on receipts, so you need to ensure your script will allow you to do that as well.


2

That is correct. if you are using the Stripe or similar processors that utilize a redirect method to post payment data to the processor you will use the SAQ A-EP. if you use an iframe or payment is 100% hosted by a compliant service provider then you can fill out SAQ A. Here is a FAQ from the PCI council that explains things in a little more detail: PCI SSC ...



Top 50 recent answers are included