Questions tagged [pci-dss]
An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.
671
questions
0
votes
1
answer
41
views
PCI-DSS Compliance
Recently I had to implement a website that had to be PCI-DSS compliant.
I am only transferring card details over SSL (encrypted with a random RSA 2048 key generated each time, as well.) The data is ...
0
votes
0
answers
19
views
Which documents may be used to demonstrate compliance with requirement 12.8.2 of PCI DSS 3.2.1?
Does an PCI AoC substitute the written agreement that the PCI DSS requirement 12.8.2 request?
If not, how is the best way to comply? Thanks in advance.
1
vote
1
answer
58
views
Is LINKT non-PCI compliance and if so how do I report it
I have received an email from LINKT (part of LendLease) stating I need to update my credit card details. In this email it says "...details such as expiry date or CVV might be saved incorrectly or ...
- 223
-1
votes
1
answer
40
views
Does PCI DSS allows/restrict bulk sending of cards?
Does PCI DSS allows/restrict bulk sending of cards? eg: Im buying gift cards for my 200 employees, can I have them delivered to my HR?
Are there addendums or restrictions on this?
- 119
13
votes
2
answers
3k
views
Validating and storing credit card data for retrieval later
I need to validate and store credit card information (name, card number, expiration date, CVC) for retrieval at a later date. Once retrieved, the data will be used for manual processing on a separate ...
- 231
2
votes
3
answers
290
views
How do companies like Uber and Paypal store card details? Is it possible to offer PCI compliance whilst saving credit card details locally?
I know there's a question that's been already asked but it's a decade old so wanted to get an up to date answer...
It's mentioned quite often that the CVV number should never be stored, but this must ...
- 123
0
votes
3
answers
89
views
PCI Card Number Definition [closed]
We are using a truncation strategy to eliminate card numbers. In order to develop, I need the original pre-truncated data files. The test environment is not allowed to have live card numbers. ...
- 101
0
votes
3
answers
302
views
How to check validity of a PCI DSS Attestation of Compliance certificate?
I've been sent a certificate of compliance with PCI DSS (v. 3.2.1) in the form of a PDF. In it company A (issuer) claims that company B passed a formal assessment and is a level 2 merchant.
What ...
- 145
0
votes
1
answer
57
views
DCP-Portal Vulnerability
This vulnerability is from a third party reviewer for PCI scans. I am stuck for months and can't figure this out. I already used sanitation to my page and it still fail the PCI scanning. I am starting ...
- 1
3
votes
1
answer
250
views
Does "row-level security" actually serve a security purpose?
Row-level security is often an industry requirement in secure environments, such as those dealing with payment cards.
It's supported by most major relational databases, including PostgreSQL, Microsoft ...
- 5,338
-1
votes
1
answer
141
views
Encrypting card data at application layer over TLS (MasterCard)
I found an article from MasterCard's blog stating:
The transport between client applications and Mastercard is secured
using TLS/SSL, which means data are encrypted by default when
transmitted across ...
- 101
1
vote
1
answer
53
views
VM Hosting requirement for a Virtual Terminal application in SAQ-C-VT
We are a merchant that do exclusively MOTO transactions over the phone. To capture credit card information, our sales agent (on their PCs) uses a browser to access an internally developed ASP.NET ...
- 11
0
votes
2
answers
100
views
PCI : scope debate : API consumers
The Problem
I have two systems.
System A - E-commerce application that handles (does not store cc) customer credit data during purchase.
System B - Invoicing system for these transactions (does store ...
- 103
0
votes
2
answers
119
views
PCI DSS -- eWallet Not storing just displaying Virtual PAN
I have an eWallet application that lets the user (owner of the Virtual Visa) see his virtual card information if he wants to make an online purchase.
We are not storing the credit card data in our ...
- 1
1
vote
2
answers
281
views
What exactly are the characteristics of TLS required by PCI DSS and which reference describes these?
I am quite familiar with the ROC but am not a QSA.
PCI definition of strong cryptography make references to choosing your own standard and follow that, for example; if I followed NIST i.e. TLS as ...
- 181
1
vote
1
answer
2k
views
Are virtual credit cards in scope for PCI Compliance?
My company is using virtual credit cards and since we are PCI compliant (and want to be in the future) I was wondering about the requirements of storing/processing and transmitting PAN numbers of ...
- 329
0
votes
2
answers
202
views
can HSTS be considered as a remediation for not using secure flag for a pci dss auditor [duplicate]
can HSTS be considered asa remediation for the vulneraberabity "cookies are not protected by secure flag" for a PCI DSS auditor?
0
votes
1
answer
119
views
PCI scope "Encrypted cardholder data that is accessible to an entity that also has access to the decryption key"
I have a question related to this FAQ:
https://pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/How-does-encrypted-cardholder-data-impact-PCI-DSS-scope?q=how+does+encrypted+data+impact+...
- 113
0
votes
2
answers
244
views
How does a card issuer comply with PCI if they have to print PANs in clear text?
I read PCI DSS, and it's not very clear in which contexts you can have the PAN in cleartext. One could think in no context, but that is impossible. You need it in clear text of course to print it ...
- 113
0
votes
2
answers
156
views
PCI DSS Compliance and Firewalling Dynamic Hosts with MITM Certificates
Question
Would using a firewall MITM capability to inspect all HTTPS web requests be against PCI compliance/rules?
Further Info
We have an issue where we need to allow access to some HTTPS sites on ...
- 101
2
votes
1
answer
160
views
PCI & e-banking sensitive information tokenization/encryption/obfuscation - Which fields require to be secured?
According to PCI standard all businesses that store, process or transmit payment cardholder data must be PCI Compliant.
Taking into account that we are talking about a bank, fields like card number ...
- 21
1
vote
1
answer
122
views
Do I need to keep production Docker/container images?
Context
My company is developing a SaaS solution that needs to conform to PCI-DSS L1 for sure, and possibly FedRAMP and other frameworks later.
We can do continuous deployment with feature flagged/...
- 13
12
votes
4
answers
3k
views
How does collecting sensitive data using iframes increase security?
So this approach seems to be rather popular, particularly among payment processors that provide javascript integrations.
The added layer of security that "fields in iframe" brings also ...
- 222
0
votes
1
answer
172
views
SSH and PCI on Insecure, Dirty Side
Does current PCI code require SSH connections be restricted to enumerated (specific) client IP addresses on the unsecure, dirty side? Isn't that outside the scope of the PCI code?
- 23
2
votes
1
answer
165
views
is there a two developer minimum for companies seeking PCI compliance?
I'm doing a questionnaire for PCI compliance and one of the questions (Yes / No / Not Applicable) is as follows:
All custom application code changes are reviewed (either using manual
or automated ...
- 1,676
0
votes
1
answer
379
views
PCI Compliance and multi tenancy?
I am developing a Multi-tenant application to allow tenants to open an e-commerce shop (similar to Shopify). We are hosted on AWS.
At this point there will be under 20,000 transactions in the first ...
- 1
1
vote
1
answer
235
views
file-integrity monitoring tools for PCI compliance
A former employer of mine has reached out to me to assist them with PCI certification (I guess I'll be getting a 1099-NEC from them next year as a result). Here's the point I'm at in the questionnaire:...
- 1,676
1
vote
0
answers
107
views
Possibility of EMVCO 3DS Authentication Decoding [closed]
I bumped across a request via Traffic analysis through Burp Suite Proxy & it looked like a 3DS Authentication.
Sample below:
My question was if this authentication could be intercepted, decoded ...
- 1,602
5
votes
1
answer
708
views
PCI Compliance Password time to die change requirement
In the PCI DSS3 requirements it states that the user must change their password every 90 days, how are banks in the UK getting around this requirement? Is it because of 2FA?
As a new business we are ...
- 153
0
votes
0
answers
23
views
What types of businesses are allowed to store SAD and in particular CVV data? [duplicate]
There must be some kind of business that requires the use of sensitive authentication data (SAD) data. Could someone point me in the right direction on the requirement for the storage of that data?
- 11
1
vote
2
answers
340
views
SAQ-A vs SAQ-D Scope
I've received notice from our risk management group that they believe our website falls in scope for SAQ-D.
We utilize third party vendors for all of our payment processing - and on the website ...
- 11
0
votes
2
answers
187
views
PCI DSS Protectecting Card Data Elements when Transmitting PAN
I'm currently working on a mobile application that will need to transmit a customers full card data to an internal API that will then transmit the information to an external API owned by a payment ...
- 103
0
votes
1
answer
299
views
File Integrity Monitoring via Syslog-ng or agentless - is it possible?
I am involved in a project which deals with PCI-DSS compliance. Particularly, there is a requirement to implement FIM (File Integrity Monitoring) for critical devices.
Within these devices, there are ...
- 69
2
votes
1
answer
827
views
PCI Compliance for developers accessing a production database for support
As a developer, when an Incident comes in and reaches Tier 3 support (The development team), how can the developers get access to query the Production Database, while remaining PCI Compliant? I'm ...
- 21
2
votes
0
answers
274
views
Grace period for users after re-enabling account disabled by PCI-DSS 8.1.4?
We have an automated system to disable user accounts that have seen no logins for 90 days. We also have a process of re-enabling such accounts (at the behest of the affected users), and this process ...
- 343
3
votes
1
answer
253
views
PCI-DSS Level 1 requirement for Intrusion Detection and Prevention on AWS API Gateway and AWS Lambda
Our architecture is based on the best practices for PCI-DSS on AWS
Amazon WAF -> API Gateway -> AWS Lambda
The lambda's are running within a VPC and the SG / Firewall and segmentation have been ...
- 153
1
vote
2
answers
126
views
Can biometric vectors (i.e. fingerprint vector) be considered as Sensitive Authentication Data (SAD) in PCI?
I am designing a system that uses a certain biometric vector as a secondary user identification step before authorizing a payment. My system does not handle payment card details, rather the payment ...
- 125
0
votes
2
answers
564
views
Security camera NVR is making my network not PCI compliant. What can I do?
So family operates a small bar/lounge in Florida and I work for them part time as a bar back / IT technician. For the past couple months we have been trying to become pci compliant. However, we keep ...
0
votes
1
answer
107
views
Monitoring User (developer) interaction
I'm looking for a "tamper proof" way, if there is such a thing, to monitor what a developer/engineer does on a given system.
To expand a bit more about this, we have several systems that run ...
- 101
2
votes
2
answers
325
views
Storing credit card information - encrypted at rest
A client is asking for a way so his app can receive credit card information and store them. He needs this to process scheduled payments from his clients.
I told him that I can build a asymmetrical (...
- 73
0
votes
2
answers
470
views
Which Authentication mechanism to choose for PCI-DSS system
I want to create Angular 9 + Spring Boot application with strong security complaint to PCI-DSS security standard.
Which security protocol is preferred for user sessions in order to have high security ...
- 141
1
vote
2
answers
175
views
Call center recording my credit card info
I just made a new contract over the phone with my mobile phone provider and I needed to pay the activation fee. The lady told me that they could accept only credit cards and asked me for the full ...
- 13
1
vote
1
answer
137
views
Would using an input field for billing data but not storing or posting any of that data be legal?
We're building a web application embedded in a desktop application (via CefSharp) so that we can use client-side C# methods based on front-end JS on the website. For example, there is a billing data ...
- 11
1
vote
1
answer
161
views
PCI scope for credit card forms that talk to Stripe, Braintree, etc
I client of mine is using a custom credit card form, which talks to Stripe, Braintree, etc
To make this acceptable for a PCI audit, currently they do the following:
They host the files in a ...
0
votes
1
answer
271
views
PCI Compliance - Service Provider vs Merchant
We will be providing a service to a client, where the end user logged on to our system can submit their payment information to Authorize .Net.
I need help figuring out if we as a service provider ...
- 103
0
votes
1
answer
106
views
PCI DSS: Is there a way to pass encrypted billing data through a server without compliance?
Hope all is well.
I am developing a primarily cloud-based tool that allows the end-user to enter in billing data and task data via a desktop application, and the billing data is stored locally (their ...
0
votes
1
answer
93
views
Is it legal to post card data from an ecommerce checkout to a PCI compliant 'store'
Let's say I want to charge a user's credit card with their permission after a sale takes place. But, I don't want to have to ask them their credit card a second time.
Is it legal to store the credit ...
- 105
2
votes
1
answer
4k
views
What is the difference between a server and an appliance for PCI purposes?
I administer a few hundred servers and am going through a yearly PCI audit. This time around we need to prove that we've got anti-virus protection on our "systems commonly affected by malicious ...
- 141
1
vote
2
answers
340
views
Does Apache Tomcat 9 meet PCI compliance?
Does Apache Tomcat 9 meet PCI compliance?
From where I should start reading and gather some information about that topic?
- 11
0
votes
1
answer
128
views
Should merchant be SAQ-A compliant if full payment processing is outsourced and NO paper (reports or receipts) with cardholder data is retained
Given:
e-commerce merchant, which fully outsourced payment processing to third-party PCI DSS compliant service
NO paper with cardholder data is ever retained
Question: should such merchant still be ...
- 3