New answers tagged

0

The PCI SSC has an FAQ about the scope of encrypted cardholder data: It is possible that encrypted data may potentially be out of scope for a particular entity if, and only if, it is validated (for example, by a QSA or ISA) that the entity in possession of the encrypted data does not have access to the cleartext cardholder data or the encryption process, ...


2

Yes, the machines store, process, or transmit cardholder information (CHD) and/or sensitive authentication data (SAD), therefore they are in scope.


3

The requirement is to protect the data appropriately. Pre-auth, you are unlikely to have the CVV on disk (it should just be in RAM) but if you do, then yes you should encrypt, and then delete afterwards, so your assumption that "the restriction on storing sensitive authentication data applies to post authentication/processing storage" is incorrect.


0

To be PCI Compliant with Shopkeep POS system, one should follow the below steps. Every retailer should have pos security which doesn't store any cardholder data and stay away from the point of sale malware. Next is choosing a PCI compliant web host which would provide virtual private or dedicated server which protects customer data being stolen. Using ...


0

Yes, your company needs to be PCI compliant. It doesn't matter if your customer's credit cards are stored in that format or the other (PDF\in DB \ paper ...) as you wrote as long as you store transmit or process you are required to be PCI compliant. regarding your question in the comment regarding "I don't even know if storing such document requires me to ...


0

I don't think the PCI DSS prohibits the Telnet client, but I can see how an ASV might interpret 2.3.b as saying so: 2.3.b Review services and parameter files on systems to determine that Telnet and other insecure remote-login commands are not available for non-console access. On the one hand, it says "...insecure remote-login commands are not ...


1

I fail to see why you would want an insecure program/protocol like telnet when its easy to employ a secure alternative in the form of an open-SSH server. Telnet has often been used to compromise a system even when the normal network operators did not use it. There simply is no way to secure a telnet session. Since the telnet client of windows can be used ...


2

From your question it seems the employee was emailing their own card data to someone? That should not be a PCI problem, because the company didn't mishandle card data controlled by the company. I'd say that they should be given a stern talking to because it might show poor judgment, and maybe have a record of that talk, but I don't think it will be an issue ...


22

Typically, it's just the last 4 that are shown to the customer, sometimes the first 6. From the PCI DSS 3.4 Standards Never store the personal identification number (PIN) or PIN Block. Be sure to mask PAN whenever it is displayed. The first six and last four digits are the maximum number of digits that may be displayed. This requirement does not ...



Top 50 recent answers are included