8

The password requirements of PCI DSS, among everything else, state that you must enforce a very specific password policy:

You need to force the users to change their passwords every 90 days, their passwords cannot be shorter than 7 characters, etc.

As far as I know, large companies such as Google, Facebook, PayPal and many more don't enforce that policy. For example, none of them freeze your account after a period of non-activity as PCI DSS requires and services such as Facebook allows your password to be 6 chars long (which is less than the 7 chars min stated in the PCI DSS requirements).

Those companies are PCI DSS Level 1 Service Providers and are listed in the PCI DSS Service Providers index.

How can those companies be PCI DSS compliant even though they don't enforce the PCI DSS password policy?

On whom does the policy apply? Does it apply on the simple user / customer or is it talking about the staff / moderators?

2 Answers 2

11

The password requirements of PCI DSS, among everything else, state that you must enforce a very specific password policy:

You need to force the users to change their passwords every 90 days, their passwords cannot be shorter than 7 characters, etc.

...

On who does the policy apply? Does it apply on the simple user / customer or is it talking about the staff / moderators?

To quote the DSS 3.2, intro text to Requirement 8 ("Identify and authenticate access to system components"):

Note: These requirements are applicable for all accounts, including
point-of-sale accounts, with administrative capabilities and all 
accounts used to view or access cardholder data or to access systems
with cardholder data. This includes accounts used by vendors and
other third parties (for example, for support or maintenance). These
requirements do not apply to accounts used by consumers (e.g., cardholders).

As far as I know, large companies such as Google, Facebook, PayPal and many more don't enforce that policy. For example, none of them freeze your account after a period of non-activity as PCI DSS requires and services such as Facebook allows your password to be 6 chars long (which is less than the 7 chars min stated in the PCI DSS requirements).

Those companies are PCI DSS Level 1 Service Providers and are listed in the PCI DSS Service Providers index.

Google and PayPal are; I don't see Facebook on the Visa SP Listing. But as above, it's not your account - consumer account - that is governed by PCI DSS. And, especially with a company like Google, it's easy to have an account that never goes near touching a credit card or credit processing function. So it's not that surprising.

3
  • So, if I am planning to provide my users with an credit card processing API (but they won't have access to the card information), I guess they are counted as vendors and accounts that have access to systems with cardholder data and I'll have to enforce the policy on them?
    – Theodore
    Feb 15, 2017 at 14:18
  • 4
    @Theodore it's a little hard to diagnose your PCI scope issues given tidbits. Are you tokenizing cards and providing tokens to your merchants ("users") so that they may charge customers? They are then involved in credit card processing, and yes, subject to the DSS. They're probably only SAQ A. Your scope is clearly wider, and you probably need to treat those accounts (your "users", acting as "merchants") as subject to DSS Requirement 8... but only a QSA can tell you for sure.
    – gowenfawr
    Feb 15, 2017 at 14:25
  • 2
    Note that another requirement of PCI DSS is that you don't allow customers to view their own credit card number in full. This means an attacker that cracks a customer account's password does not learn the credit card number. Feb 15, 2017 at 21:06
3

It applies to passwords of users who have access to networks where card data is stored, who will normally be employees or contractors of the company. It doesn't apply to customer passwords, unless for some reason those passwords allow access to card data (not including the first six and last four digits of the card number, which don't have to be protected).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .