Questions tagged [pci-dss]

An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

Filter by
Sorted by
Tagged with
0
votes
0answers
8 views

PCI compliance and VM server administrator

I have a situation where an application has to encrypt/decrypt some credit card data, each encryption key (it could be symmetric or private asymmetric) has to be in two separate places, managed by ...
1
vote
1answer
73 views

Business located in USA does it need to be PCI and SCA compliant?

The business is located in the US. But: Has European customers who put a transaction via a custom-built shopping cart Sells via tradeshow in Europe or Asia in person Could Customers send credit cards ...
1
vote
2answers
108 views

PCI Compliance & Third Parties

Let's say that company X is PCI certified and compliant as a merchant. In terms of PCI compliance, what does company X have to consider while working with third parties? E.g. for business reasons ...
1
vote
1answer
88 views

What PCI self assessment questionnaire to choose?

We need to fill out a PCI self assessment questionnaire, and I am wondering If we need to fill out SAQ A-EP or SAQ D. We are an e-commerce merchant that doesnt operate trough a website, but we ...
0
votes
1answer
36 views

HMAC output of CVV

Would storing the output of a HMAC function with the PAN and CVV as input be considered PCI-DSS compliant ? This is post authorisation. I suspect probably not as PCI-DSS explicitly forbids ...
0
votes
0answers
25 views

I need to store the first 6 digits and last 4 digits of a credit card. (not derived from a PAN) [duplicate]

Note: it is not really a masked PAN as nothing is masked so to speak. For testing purposes, I need users to only submit their first 6 and 4 last digits of their CC. At no point at all will they ...
1
vote
2answers
89 views

PCI DSS compliance on storing email body in database which contains plain text password

I work in a PCI DSS certified environment, which (as many secure environments) require 'Strong Cryptography' when storing user passwords, as per requirement 8.2.1. We simply hash them using BCrpyt. ...
0
votes
1answer
67 views

Platform Change

So we converted our website from an internally created site to a Magento Cloud environment. In the process, we had to change how we handle credit cards. We used to redirect the user to the payment ...
1
vote
1answer
115 views

PCI Compliance 8.2.1, 8.2.3, 8.2.4 - Which user passwords is this talking about?

Say you have an e-commerce site that falls under the SAQ A-EP standard, due to extra content on the same page as the iframe that takes the credit card info. This used to fall under the SAQ A ...
1
vote
1answer
38 views

Is encryption required to store non-PAN data under PCI DSS?

We do not store PAN card data, but we do store other non-PAN data such as expiration date, billing zip, and cardholder name. We store this info for use with card-on-file tokens provided by our ...
1
vote
1answer
97 views

Is it reasonable to provide admin access for a PCI vulnerability scan?

My organization is going through a PCI-DSS compliance process. As part of that, we're contracting out our external and internal vulnerability scans. The contractor is asking for admin access to our ...
0
votes
2answers
89 views

Telling donors we will no longer accept card information in writing [closed]

What is positive wording for telling donors we no longer accept card information in writing, for their security?
3
votes
2answers
131 views

Final-Mile Shipping Company Wants Customer Email Address - PCI Compliance Issue? (United States)

My company ships very large, very heavy products to the homes of everyday consumers (think big home renovation materials). Currently, we provide the customer's name, shipping address, and phone number ...
1
vote
1answer
68 views

PCI DSS SAQ A compliance with WooCommerce and 3rd party payment gateways - possible? [closed]

I am considering using Wordpress, WooCommerce, third party payment processor and different plugins for an ecommerce store. I have trouble figuring out if it is possible to do all that and to be PCI ...
0
votes
1answer
210 views

How to communicate Credit Card details to customers when instantly approved in PCI-DSS compliant way?

Would displaying the full Credit Card details (PAN, Expiry date and CVV/CVC) in Online Banking and / Mobile Banking be considered both PCI-DSS and secure? Or what would be Best practice to display the ...
1
vote
4answers
183 views

Collecting banking, credit-card statements from users

I want to build a service that collects user spending history with their permission. Users would send over (banking, credit card) account statements and I would extract, store the following ...
105
votes
5answers
12k views

Being told my “network” isn't PCI compliant. I don't even have a server! Do I have to comply?

We are a brick and mortar company... literally. We are brick masons. At our office we connect to the internet through our cable modem provided to us by Spectrum Business. Our Treasurer uses a ...
1
vote
0answers
58 views

Is there a PCI Requirement for shuffling digits while accepting PIN?

The following image shows a PIN entry device which shuffles the digits. . via twitter I've seen this question, but it doesn't cover why companies are still doing this. I looked at the POS PIN Entry ...
2
votes
1answer
71 views

Using browser XMLHttpRequest to initiate credit card transaction with processor?

I have a website where people can make purchases. The entire website is served with https. On the first page, I accept user profile data and generate a random ID for my client and store that in my ...
0
votes
0answers
44 views

PCI Compliance Self Assessment Verification - Third Parties

I am currently working for an Org which provide access to third parties to issue Credit Cards to their customer. We act as a supplier to these third parties for credit card services. My Question ...
0
votes
0answers
37 views

Does PCI-DSS requirement 10 (“track and monitor all access to … card holder data”) apply if I am not storing card holder data?

Requirement 10 states: Track and monitor all access to network resources and card holder data I find this a little vague and I have two questions. If I don't store card holder data - do I just need ...
0
votes
0answers
67 views

Are AWS security groups enough to segment network and reduce PCI scope?

I was reading this paper https://d1.awsstatic.com/whitepapers/pci-dss-scoping-on-aws.pdf It shows this image Am I correct in saying that - as long as instances have proper security groups that ...
7
votes
1answer
120 views

Which self assessment questionairre should I use for PCI DSS compliance

My system is passed card data securely over HTTPS from an upstream system. The upstream system captures information via telephone input. This telephone input is sent to us, to invoke payments via ...
0
votes
1answer
192 views

Can AWS KMS be used for both KEK and DEK for PCI DSS?

Right now we're using our own built-in solution based on SSS, and we want to switch to KMS. How far can we go? Can we use AWS' KMS for both the KEK and the DEK?
0
votes
0answers
37 views

are there PCI DSS (or equivalent) requirements for user-interface security for cardholders?

The PCI DSS requirements around account security (password strength, password changes, etc.) all seem to apply to system users who have access to cardholder data. Are there any industry standards ...
0
votes
4answers
323 views

Are PCI DSS standard requirements regarding TLS applicable only to customer facing webs or to whole even internal networks?

I have found Are You Ready for 30 June 2018? Saying Goodbye to SSL/early TLS article that says TLS 1.0 should be disabled: 30 June 2018 is the deadline for disabling SSL/early TLS and implementing ...
1
vote
1answer
140 views

Paypal and PCI Compliance

I currently manage a few of my client's websites on a couple shared hosting providers "A2Hosting" and "Interserver". My client wants to make a simple webstore and accept payments from said webstore. I ...
2
votes
0answers
102 views

PCI 8.6.1 - Minimum attempted login window?

PCI 8.6.1 says: Limit repeated access attempts by locking out the user ID after not more than six attempts. But says nothing about a minimum duration between the first failed login attempt and the ...
1
vote
1answer
55 views

PCI P2PE running as independent software on POS?

I have failed to find a good diagram or explanation of how a P2PE solution manifests itself within a point-of-sale (POS) device. Is it software running in a process on an embedded OS that knows how ...
1
vote
1answer
212 views

Can we write both encrypted text and plain text to the same file?

We have a requirement from customer to write payment transaction information to a text file. Of many lines of data per transaction, only one line contains cardholder information, which needs ...
1
vote
2answers
78 views

PCI Definition of “user”

PCI version 3 section 5.3 states Ensure that anti-virus mechanisms are actively running and cannot be disabled or altered by users, unless specifically authorized by management on a case-by-...
1
vote
1answer
72 views

XSS vulnerability in a module that doesn't exist

We did a vulnerability scan on our systems and received a vulnerability: Basit Submit Module Cross Site Scripting Vulnerability. We are not even aware of this application on our system. We filed a ...
-2
votes
3answers
92 views

Does PCI Apply to PAN only?

I am trying to find out if a credit card application would be in-scope for PCI DSS. As part of the application process, customers can submit their credit card number (PAN) from another institution. No ...
0
votes
3answers
253 views

I have recovered my credit card PAN (6 chars masked) and expiration date on a merchant site, acceptable or not?

I have a credit card saved in X merchant. I only see the last 4 digits in the UI. I have launched a 3D secure payment transaction by using my saved card. Then I have noticed that even in the failed ...
0
votes
0answers
76 views

Usage of a self-signed certificate between Akamai and Azure

First of all, some background of what is proposed: The client's browser initialises request The request is resolved by public DNS (CNAME) to Akamai Edge The request is processed by Akamai accordingly ...
0
votes
1answer
30 views

Payment device compliance of PCI v2 AND PCIv3

Is there any known case of a pin pad device being compliant PCI v2 but by changing just a software component it becomes PCI v3 compliant?
0
votes
1answer
88 views

Outsourcing PCI data: Is this ok?

The organization I work for hold PCI-DSS compliance as merchants (we fill in SAQ-D). At the same time, due to document/payment verification processes, we request from our customers pictures of their ...
2
votes
2answers
103 views

For PCI compliance, is a central Auth required for domain and non-domain security principles?

We have a Saas offering that is hosted within our own data centers. Our software offering utilizes OpenLDAP as it backing for token auth security. Our operations team has asserted that for PCI ...
0
votes
1answer
81 views

Displaying complete credit card information to end user

I am using an ecommerce website that accepts and stores CC information. In the webpage, they show only the last 4 digits (which is perfectly fine). But when I intercept the request/response, I could ...
1
vote
1answer
158 views

PCI scan shows unknown vulnerabilities

Basit Submit Module Cross Site Scripting Vulnerability DCP-Portal Cross Site Scripting Bugs, CVE-2004-2511 CVE- 2003-1536 CVE-2004-2512 These two vulnerabilities have been identified in the scan ...
0
votes
0answers
26 views

anti-spoofing measures for SAQ C business with iPads/NCR silver

So I'm just wondering what types of anti-spoofing measures a SAQ-C business would need: https://www.pcisecuritystandards.org/documents/PCI-DSS-v3_2_1-SAQ-D_Merchant.pdf There's a lot of built in ...
0
votes
2answers
183 views

What are eligible service providers for SAQ-D in PCI DSS?

PCI SSC specifies that Self-Assessment Questionnaire D can be used by "eligible" service providers (source): Questionnaire D. For Service Providers: All service providers defined by a payment card ...
-1
votes
1answer
120 views

Solution to pci-dss 4.2?

PCI-DSS 4.2 Never send unprotected PANs by end-user messaging technologies (for example, e-mail, instant messaging, chat, etc.). Is there any way to send payment card data securely through some ...
0
votes
1answer
865 views

Dealing with OpenSSH CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6

How are you dealing with the OpenSSH vulnerabilities CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6 in a PCI server? OpenSSH doesn't seem to have a fix for this yet, but it fails ...
3
votes
1answer
276 views

PCI DSS minimum password strength equivalent in passphrase

The PCI DSS requirement 8.2.3 says: Passwords/passphrases must meet the following: Require a minimum length of at least seven characters. Contain both numeric and alphabetic characters. ...
2
votes
2answers
220 views

Can multiple SAQs be used for PCI compliance?

If we have a SAQ A compliant website for online signups, can we also use SAQ C-VT for phone orders? I'm thinking yes since they're separate payment channels but this aspect is new to me.
1
vote
1answer
301 views

Does End of Life Hardware comply with PCI DSS 3.2 if still under support from a Third-Party, Not the actual vendor?

Can some one help me to confirm that End of Life hardware complies with PCI DSS 3.2 or not? I only see requirements for software but no mention of hardware? Any guidance would be greatly appreciated. ...
1
vote
0answers
149 views

Does my eCommerce SaaS vendor need to be PCI DSS compliant?

I'm feeling super confused by the whole PCI DSS business. I'm working with a local, HK-based eCommerce SaaS vendor for my eCommerce website - they provide everything from web development to hosting, ...
0
votes
1answer
98 views

PCI-DSS scope: Using P2PE Compliant devices

We use EMV card readers to automate the payments at the entry and exit to our services. These card readers and the unattended payment terminals are fully PTS complaint and use P2PE encryption. Also, ...
5
votes
2answers
705 views

Are the sha1 hashes used by common ssh configurations insecure?

I got an automated PCI security test result that checked various server configurations. The automated test determined the server to be unsafe due to the use of sha1 algorithm in some elements of the ...