Tag Info

New answers tagged

2

@thomas-pornin and @PwdRsch have explained what an HSM can do, but you've clarified that you want to know what they're used for in payment processing. The short version is - they are used to strengthen the encryption protections that processors use. Let's assume you mean credit card processors. The PCI HSM Security Requirements suggests a number of places ...


1

A HSM is like a big smart card. It will store cryptographic keys and perform cryptographic operations on behalf of some external system; however, it is designed to never allow extraction of the private keys that it contains, even if the attacker has physical access to the machine. The actual security gain of a HSM is not as big as is usually assumed. An ...


1

A hardware security module (HSM) is essentially a trusted computer that manages encryption keys (or signing keys) outside of the normal server operating system. It doesn't provide the key to the server, rather the server hands an encrypted blob to the HSM and the HSM provides back the plaintext results, and vice versa. The main reason HSMs are used in this ...


2

In my opinion, given the information you provided, the SAQ A-EP fits your scenario. You are not self hosted and Digital Ocean is your third party provider. Hosting is more than the software you host but also the physical security of the hardware. Digital Ocean likely have access to your data stored on the server, and could alter files on the box that cause ...


0

The use of unprotected images on pages that demand cardholder data might or (more usually) might not endanger cardholder data, but you should expect an objection from the Guidance for requirement 4.1: Generally, the web page URL should begin with "HTTPS" and/or the web browser display a padlock icon somewhere in the window of the browser. Whether ...


1

(IANAQSA) The PCI DSS only requires encryption to protect cardholder data: Use strong cryptography and security protocols (for example, SSL/TLS, IPSEC, SSH, etc.) to safeguard sensitive cardholder data during transmission over open, public networks. Incidental page content which does not involve cardholder data does not require that level of ...


3

Without checking, I'm going to assume that your CentOS RPMs contain backported fixes which address the CVE's listed in their report. (That's how RedHat does it and CentOS is RedHat in this regard). Because of this, your packages are probably immune to issues that their banner would otherwise indicate they're vulnerable to. What you need to provide ...


3

First, let me say I agree with your assessment that the SAQ A-EP is what you should be using (assuming your volume qualifies you for Level 3 or 4, less than 1 million annual transactions). This is a huge change to PCI and I imagine it is going to cause some serious ripples in the payments space. My understanding of the phrase "shared hosting" in terms of ...


1

The only fields required to charge a credit card are the number (also called a PAN or personal account number), the expiration date, and an amount. Without the CVV it is still very possible to charge the card. Many merchants will require the CVV and/or postal code as basic anti-fraud mechanisms. There is also an incentive for many merchants as providing ...


0

John Downey has given the best answer but just to expand on the biggest problem with this part of the workflow: Make the merchant generate a private and a public key Store the private key inside his browser using localstorage So, lets say you have a dozen merchants with public and private keys stored in their browsers. You don't store their ...


1

If you're storing the card data on your own servers, even if it's encrypted and you don't have the key to decrypt it, then you need to comply with the most elaborate version of the PCI standards and use SAQ-D. I would suggest that you don't store the card data at all, but get the merchant to store it for you. Then you should only need to use SAQ-C.


1

There are many 3rd party payment processors that allow you to transparently use their forms and processing - including paypal, google, worldpay, and many others. This can be pretty much transparent to the user if configured correctly. This is the best way of side-stepping the PCI requirements - never process any of the card information... There are some ...


4

(Disclosure, I work at Braintree) If a server is providing a form that customers will enter credit card numbers into then that server falls within PCI scope. This is regardless of if you encrypt the data in the browser. The reasoning here is that an attacker can modify the page that is sent to the browser to siphon credit card data out of the page DOM ...


2

PCI compliance covers a lot of ground - anything that "stores", "processes" or "transmits" cardholder data. Different systems need to have different parts of the standard applied to them to maintain a cohesive whole. Your system would fall into the "processes" category. Your needs would be different for storage, etc. In the case you have outlined you can ...


0

The Windows Encrypting File System (EFS) would meet your usability requirements and probably the majority, if not all, of the PCI DSS requirements. However, I have not evaluated it against the DSS so I can't say for sure. You could turn on EFS for a directory structure and then point all your applications to write to subdirectories within that tree. ...


1

(Disclosure, I work for Braintree, a competitor to Stripe) At Braintree we also allow the CVV code to be passed in our API. You are correct that the PCI-DSS explicitly forbids non-issuers from storing the CVV. You are allowed to hold the code temporarily while waiting for the charge to be authorized. This is stated in PCI-DSS Requirement 3.2 (additional ...


2

Yes, it's a violation of PCI-DSS Requirements, specifically requirement 3.4: Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using any of the following approaches: One-way hashes based on strong cryptography (hash must be of the entire PAN) Truncation (hashing cannot be used to ...


0

Yes, you can't write out unencrypted PAN. If someone could force a crash while that file is being worked on, it would leave it sitting around on the server for anyone to access and the file could potentially be read by other processes. There is no such thing as a "temporary" file. There are only permanent files you intend to get rid of soon. Also, ...



Top 50 recent answers are included