network profile
| bio | website | aerissecure.com |
|---|---|---|
| location | Phoenix, AZ | |
| age | ||
| visits | member for | 2 years, 4 months |
| seen | Mar 28 at 0:12 | |
| stats | profile views | 34 |
Doin' Work!
|
Nov 8 |
awarded | Nice Answer |
|
Sep 7 |
comment |
Minimum requrements for storing last 4 digits of credit card number? @rox0r In what business are you going process/store/transmit legitimate cardholder data without a contract or a merchant account? No, you will not be prosecuted by state or federal gov'ts, but if you are the source of a data breach, you will be held liable and sued by any that suffer a loss as a result. |
|
Sep 7 |
comment |
Minimum requrements for storing last 4 digits of credit card number? @AndreyBotalov The PAN is only considered sensitive when it is stored/transmitted in its entirety. If it is masked or redacted following 3.3 then it is no longer sensitive, and the DSS does not apply. See this additional PCI Council document, second page under "Truncation": pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf |
|
Sep 7 |
comment |
Minimum requrements for storing last 4 digits of credit card number? @rox0r - Completely wrong. You are subject to the PCI-DSS if you process, store or transmit cardholder data. Just because you are not being hounded to comply, you still are processing cards and by default are liable. You have a merchant number and will be help accountable in the event of a breach if you are not compliant. On another note, in order to get your merchant number I will GUARANTEE you that you will have to sign a contract that includes a provision for becoming and staying compliant. |
|
Sep 7 |
awarded | Critic |
|
Sep 7 |
comment |
Minimum requrements for storing last 4 digits of credit card number? @kaushal - I believe the OP was referring to storing only the last four digits of the primary account number (credit card number). The rules for transmitting still apply if the card is inputted into his specific site as opposed to being redirected to say Authorize's or PayPal's site. There are sections of the DSS that are specific to storage and sections specific to transmission, so it does matter. |
|
Sep 7 |
comment |
Minimum requrements for storing last 4 digits of credit card number? The PCI-DSS only requires you to protect the PAN if you are storing MORE THAN the first six and last four digits. E.g. 4111 11** **** 1234 can be stored without being considered sensitive data. |
|
Apr 21 |
awarded | Nice Answer |
|
Jan 22 |
awarded | Yearling |
|
Aug 22 |
answered | What would one need to do in order to hijack a satellite? |
|
Jul 26 |
comment |
Whistleblowing, business ethics and credit card data 20 minutes on a full internal security policy, no. But a document that simply states how to handle cardholder data in printed form could be achieved. It may take longer to create a mechanism for distribution and for employee accountability, but a lot of the time just making people aware how to handle sensitive data is a big step in the right direction. |
|
Jul 25 |
answered | Whistleblowing, business ethics and credit card data |
|
Mar 30 |
awarded | Scholar |
|
Mar 29 |
comment |
What tools are available to assess the security of a web application? Heh, yeah, that works. |
|
Mar 29 |
awarded | Student |
|
Jan 25 |
answered | Good (preferably free) resource for CISSP practice questions |
|
Jan 25 |
awarded | Supporter |
|
Jan 22 |
awarded | Teacher |
|
Jan 22 |
answered | Most informative DEF CON talk? |
