Questions tagged [pci-dss]

An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

Filter by
Sorted by
Tagged with
0
votes
2answers
47 views

PCI DSS Protectecting Card Data Elements when Transmitting PAN

I'm currently working on a mobile application that will need to transmit a customers full card data to an internal API that will then transmit the information to an external API owned by a payment ...
0
votes
1answer
52 views

File Integrity Monitoring via Syslog-ng or agentless - is it possible?

I am involved in a project which deals with PCI-DSS compliance. Particularly, there is a requirement to implement FIM (File Integrity Monitoring) for critical devices. Within these devices, there are ...
1
vote
1answer
52 views

PCI Compliance for developers accessing a production database for support

As a developer, when an Incident comes in and reaches Tier 3 support (The development team), how can the developers get access to query the Production Database, while remaining PCI Compliant? I'm ...
1
vote
0answers
63 views

Grace period for users after re-enabling account disabled by PCI-DSS 8.1.4?

We have an automated system to disable user accounts that have seen no logins for 90 days. We also have a process of re-enabling such accounts (at the behest of the affected users), and this process ...
1
vote
0answers
37 views

PCI-DSS Level 1 requirement for Intrusion Detection and Prevention on AWS API Gateway and AWS Lambda

Our architecture is based on the best practices for PCI-DSS on AWS Amazon WAF -> API Gateway -> AWS Lambda The lambda's are running within a VPC and the SG / Firewall and segmentation have been ...
1
vote
2answers
55 views

Can biometric vectors (i.e. fingerprint vector) be considered as Sensitive Authentication Data (SAD) in PCI?

I am designing a system that uses a certain biometric vector as a secondary user identification step before authorizing a payment. My system does not handle payment card details, rather the payment ...
0
votes
2answers
118 views

Security camera NVR is making my network not PCI compliant. What can I do?

So family operates a small bar/lounge in Florida and I work for them part time as a bar back / IT technician. For the past couple months we have been trying to become pci compliant. However, we keep ...
0
votes
1answer
63 views

Monitoring User (developer) interaction

I'm looking for a "tamper proof" way, if there is such a thing, to monitor what a developer/engineer does on a given system. To expand a bit more about this, we have several systems that run ...
2
votes
2answers
109 views

Storing credit card information - encrypted at rest

A client is asking for a way so his app can receive credit card information and store them. He needs this to process scheduled payments from his clients. I told him that I can build a asymmetrical (...
0
votes
1answer
67 views

Which Authentication mechanism to choose for PCI-DSS system

I want to create Angular 9 + Spring Boot application with strong security complaint to PCI-DSS security standard. Which security protocol is preferred for user sessions in order to have high security ...
1
vote
2answers
92 views

Call center recording my credit card info

I just made a new contract over the phone with my mobile phone provider and I needed to pay the activation fee. The lady told me that they could accept only credit cards and asked me for the full ...
1
vote
1answer
76 views

Would using an input field for billing data but not storing or posting any of that data be legal?

We're building a web application embedded in a desktop application (via CefSharp) so that we can use client-side C# methods based on front-end JS on the website. For example, there is a billing data ...
1
vote
1answer
62 views

PCI scope for credit card forms that talk to Stripe, Braintree, etc

I client of mine is using a custom credit card form, which talks to Stripe, Braintree, etc To make this acceptable for a PCI audit, currently they do the following: They host the files in a ...
0
votes
1answer
71 views

PCI Compliance - Service Provider vs Merchant

We will be providing a service to a client, where the end user logged on to our system can submit their payment information to Authorize .Net. I need help figuring out if we as a service provider ...
0
votes
1answer
56 views

PCI DSS: Is there a way to pass encrypted billing data through a server without compliance?

Hope all is well. I am developing a primarily cloud-based tool that allows the end-user to enter in billing data and task data via a desktop application, and the billing data is stored locally (their ...
0
votes
1answer
44 views

Is it legal to post card data from an ecommerce checkout to a PCI compliant 'store'

Let's say I want to charge a user's credit card with their permission after a sale takes place. But, I don't want to have to ask them their credit card a second time. Is it legal to store the credit ...
1
vote
1answer
87 views

What is the difference between a server and an appliance for PCI purposes?

I administer a few hundred servers and am going through a yearly PCI audit. This time around we need to prove that we've got anti-virus protection on our "systems commonly affected by malicious ...
1
vote
2answers
129 views

Does Apache Tomcat 9 meet PCI compliance?

Does Apache Tomcat 9 meet PCI compliance? From where I should start reading and gather some information about that topic?
0
votes
1answer
42 views

Should merchant be SAQ-A compliant if full payment processing is outsourced and NO paper (reports or receipts) with cardholder data is retained

Given: e-commerce merchant, which fully outsourced payment processing to third-party PCI DSS compliant service NO paper with cardholder data is ever retained Question: should such merchant still be ...
2
votes
0answers
74 views

PCI Idle Session Timeout general question

Can someone help me understand how the PCI Timeout rules change for an application like the Starbucks App? A user is able to keep their card open ready for scan for longer the 15 minutes if needed, ...
1
vote
1answer
79 views

Cardholder info transmission between issuing and acquiring banks

Which data is actually transmitted between issuing and acquiring banks during various phases of a card payment transaction? Specifically, does the Issuer tell the Acquirer any info (and which if any?)...
0
votes
2answers
191 views

Is it allowed to store 8-digit BINs outside of CDE

Can I separately store 8-digit BINs and truncated (6/4) PANs outside of my CDE? Truncated PANs are no more than the first 6 and last 4 digits of PAN, compliant to the standard's section 3.4, but it ...
3
votes
0answers
125 views

Can AWS Time Sync be argued PCI compliant?

We're setting up a card processing service on Amazon AWS, and were wondering whether the AWS Time Sync service could be incorporated without running afoul of the PCI time sync requirements? ...
0
votes
1answer
68 views

PCI DSS 1.2.1 Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment

A strict interpretation of that rule would seem to prohibit any non-payment related web browsing by PCs that are used to transmit card details to a payment processor, and perhaps also prohibit web ...
0
votes
0answers
37 views

PCI DSS Requirement 6 Clarification

I’m hoping to clarify this: If there is a segmented network and card data is only in one section, do the Section 6 requirements for development apply to the network segment that allows card data? Do ...
0
votes
0answers
34 views

PCI compliance and VM server administrator

I have a situation where an application has to encrypt/decrypt some credit card data, each encryption key (it could be symmetric or private asymmetric) has to be in two separate places, managed by ...
1
vote
1answer
88 views

Business located in USA does it need to be PCI and SCA compliant?

The business is located in the US. But: Has European customers who put a transaction via a custom-built shopping cart Sells via tradeshow in Europe or Asia in person Could Customers send credit cards ...
1
vote
2answers
130 views

PCI Compliance & Third Parties

Let's say that company X is PCI certified and compliant as a merchant. In terms of PCI compliance, what does company X have to consider while working with third parties? E.g. for business reasons ...
1
vote
1answer
98 views

What PCI self assessment questionnaire to choose?

We need to fill out a PCI self assessment questionnaire, and I am wondering If we need to fill out SAQ A-EP or SAQ D. We are an e-commerce merchant that doesnt operate trough a website, but we ...
0
votes
1answer
45 views

HMAC output of CVV

Would storing the output of a HMAC function with the PAN and CVV as input be considered PCI-DSS compliant ? This is post authorisation. I suspect probably not as PCI-DSS explicitly forbids ...
0
votes
0answers
31 views

I need to store the first 6 digits and last 4 digits of a credit card. (not derived from a PAN) [duplicate]

Note: it is not really a masked PAN as nothing is masked so to speak. For testing purposes, I need users to only submit their first 6 and 4 last digits of their CC. At no point at all will they ...
1
vote
2answers
115 views

PCI DSS compliance on storing email body in database which contains plain text password

I work in a PCI DSS certified environment, which (as many secure environments) require 'Strong Cryptography' when storing user passwords, as per requirement 8.2.1. We simply hash them using BCrpyt. ...
0
votes
1answer
67 views

Platform Change

So we converted our website from an internally created site to a Magento Cloud environment. In the process, we had to change how we handle credit cards. We used to redirect the user to the payment ...
1
vote
1answer
425 views

PCI Compliance 8.2.1, 8.2.3, 8.2.4 - Which user passwords is this talking about?

Say you have an e-commerce site that falls under the SAQ A-EP standard, due to extra content on the same page as the iframe that takes the credit card info. This used to fall under the SAQ A ...
1
vote
1answer
85 views

Is encryption required to store non-PAN data under PCI DSS?

We do not store PAN card data, but we do store other non-PAN data such as expiration date, billing zip, and cardholder name. We store this info for use with card-on-file tokens provided by our ...
1
vote
1answer
103 views

Is it reasonable to provide admin access for a PCI vulnerability scan?

My organization is going through a PCI-DSS compliance process. As part of that, we're contracting out our external and internal vulnerability scans. The contractor is asking for admin access to our ...
0
votes
2answers
91 views

Telling donors we will no longer accept card information in writing [closed]

What is positive wording for telling donors we no longer accept card information in writing, for their security?
3
votes
2answers
134 views

Final-Mile Shipping Company Wants Customer Email Address - PCI Compliance Issue? (United States)

My company ships very large, very heavy products to the homes of everyday consumers (think big home renovation materials). Currently, we provide the customer's name, shipping address, and phone number ...
1
vote
1answer
126 views

PCI DSS SAQ A compliance with WooCommerce and 3rd party payment gateways - possible? [closed]

I am considering using Wordpress, WooCommerce, third party payment processor and different plugins for an ecommerce store. I have trouble figuring out if it is possible to do all that and to be PCI ...
0
votes
1answer
224 views

How to communicate Credit Card details to customers when instantly approved in PCI-DSS compliant way?

Would displaying the full Credit Card details (PAN, Expiry date and CVV/CVC) in Online Banking and / Mobile Banking be considered both PCI-DSS and secure? Or what would be Best practice to display the ...
1
vote
4answers
279 views

Collecting banking, credit-card statements from users

I want to build a service that collects user spending history with their permission. Users would send over (banking, credit card) account statements and I would extract, store the following ...
105
votes
5answers
13k views

Being told my “network” isn't PCI compliant. I don't even have a server! Do I have to comply?

We are a brick and mortar company... literally. We are brick masons. At our office we connect to the internet through our cable modem provided to us by Spectrum Business. Our Treasurer uses a ...
1
vote
1answer
82 views

Is there a PCI Requirement for shuffling digits while accepting PIN?

The following image shows a PIN entry device which shuffles the digits. . via twitter I've seen this question, but it doesn't cover why companies are still doing this. I looked at the POS PIN Entry ...
2
votes
1answer
84 views

Using browser XMLHttpRequest to initiate credit card transaction with processor?

I have a website where people can make purchases. The entire website is served with https. On the first page, I accept user profile data and generate a random ID for my client and store that in my ...
0
votes
0answers
38 views

Does PCI-DSS requirement 10 (“track and monitor all access to … card holder data”) apply if I am not storing card holder data?

Requirement 10 states: Track and monitor all access to network resources and card holder data I find this a little vague and I have two questions. If I don't store card holder data - do I just need ...
0
votes
0answers
96 views

Are AWS security groups enough to segment network and reduce PCI scope?

I was reading this paper https://d1.awsstatic.com/whitepapers/pci-dss-scoping-on-aws.pdf It shows this image Am I correct in saying that - as long as instances have proper security groups that ...
7
votes
1answer
125 views

Which self assessment questionairre should I use for PCI DSS compliance

My system is passed card data securely over HTTPS from an upstream system. The upstream system captures information via telephone input. This telephone input is sent to us, to invoke payments via ...
0
votes
1answer
423 views

Can AWS KMS be used for both KEK and DEK for PCI DSS?

Right now we're using our own built-in solution based on SSS, and we want to switch to KMS. How far can we go? Can we use AWS' KMS for both the KEK and the DEK?
0
votes
0answers
39 views

are there PCI DSS (or equivalent) requirements for user-interface security for cardholders?

The PCI DSS requirements around account security (password strength, password changes, etc.) all seem to apply to system users who have access to cardholder data. Are there any industry standards ...
1
vote
4answers
2k views

Are PCI DSS standard requirements regarding TLS applicable only to customer facing webs or to whole even internal networks?

I have found Are You Ready for 30 June 2018? Saying Goodbye to SSL/early TLS article that says TLS 1.0 should be disabled: 30 June 2018 is the deadline for disabling SSL/early TLS and implementing ...

1
2 3 4 5
13