2

We use myvirtualmerchant.com (previously Converge, owned by Elavon) to process payments in our doctor's office.

Recently, they emailed us that we have to fulfill their partner company's (Trustwave TrustKeeper) list of PCI requisites, or else suffer hefty fees. This is what a first scan shows of our Office IP:

Image of Compliance Violations http://tonsofbugs.com/zss/2015-06-04T1419.jpg

We have a new modem supplied by Comcast.

The confusion that I'm having is in trying to understand why any of this falls on us?

Improve this question
4
  • It looks to me like they are afraid that your network/computers may be breached and that this could lead to a breach of their systems or some other leak of sensitive data. The problems listed cannot be fixed by them as they are on you network and computers. You'll need to consult your contract (and possibly get legal advice) to determine if you are required to fix these problems or not. – Neil Smithline Jun 4 '15 at 18:37
  • We need more information: is this a scan of your office from the Internet or internally? All the failures in the screenshot are from MS RDP, do you need RDP to be running? Are all of your computers fully patched? – schroeder♦ Jun 4 '15 at 19:31
  • @schroeder : This is a scan of our office IP from the internet, which appears to be the only way to do it via TrustKeeper. – Zmart Jun 4 '15 at 23:37
  • 2
    What the scan shows is that RDP is exposed to the Internet. If you turn that one thing off, all your failures go away (according to that screenshot). I would turn RDP off and scan again. – schroeder♦ Jun 5 '15 at 0:11
2

Do people come into your office and pay you using credit cards? If so, that's why it's falling on you:

PCI DSS applies to all entities involved in payment card processing—including merchants, processors, financial institutions, and service providers, as well as all other entities that store, process, or transmit cardholder data and/or sensitive authentication data.

The question then is not "why is this falling on you" but "why is this falling on you now?" Most likely they've been scanning your IP address space all along, and when you spun up your "new modem supplied by Comcast" it lit up your scan results with discouraged TLS versions and weak encryption ciphers. And those things need to be addressed for DSS compliance.

Improve this answer
2
  • +1, didn't know this applied to merchants as well (although it makes sense). Is there a set of simplified guidelines that merchants should follow, or just take the PCI-DSS guidelines and apply everything applicable? – cutrightjm Jun 4 '15 at 19:27
  • 1
    Your processor should be able to help you determine which SAQ applies to you. If you're a "doctor's office", brick and mortar, then it's probably B, but could be B-IP or conceivably C-VT depending on what's actually set up. To some extent you're required to know but it's expected that your processor will help you figure it out - processors exist to enable people who don't really want to be in the credit card business. – gowenfawr Jun 4 '15 at 19:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.