Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pci-dss]

An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

0
votes
2answers
31 views

AWS serverless architecture compliance with PCI DSS 11.3 penetration testing segmentation

I am wondering how to comply with PCI DSS requirements (11.3) to test segmentation controls using penetration testing in AWS serverless architecture. We are using components such as AWS Lambda, AWS ...
0
votes
0answers
41 views

Is Credit Score considered regulatory PII? [on hold]

I Operate an EComm company and we're investigating allowing for financing on our products. A part of that is that we may need to receive credit scores at least in transit from Equifax, Experian, etc. ...
0
votes
1answer
32 views

Angular application for PCI-DSS certification

I want to design Angular 6 application for PCI-DSS compliance. Is it a good idea to use it having in mind that this is a client-side application with a server back-end? Do you know if there any ...
0
votes
1answer
33 views

Is PCI - DSS required to store only card number

We need to save the credit card number in our database , but not the cvv. Should we be PCI - DSS compliant for this or some security measures is enough. After the save we will use that to call stripe ...
1
vote
2answers
90 views

Is taking CC info in plain HTML elements, but using a library like Stripe to tokenize PCI compliant?

I am building a site which will accept payments. I will be processing payments with either Stripe or Square. Stripe now has Stripe Elements, and Square has Square Payment Form. I have tried Square ...
1
vote
0answers
49 views

TLS1.2, weak cypher suites and PCI DSS V3.2.1 compliance

Are below cypher suites, which are part of TLSv1.2: TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA ...
0
votes
3answers
69 views

What is two full-length key components PCI DSS requirement 3.5.3

PCI DSS requirement 3.5.3 3.5.3 Store secret and private keys used to encrypt/decrypt cardholder data in one (or more) of the following forms at all times: ............ As at least two full-length ...
0
votes
1answer
34 views

Only using TLS 1.1 or 1.2 is enough for PCI DSS compliance on transmission of cardholder data (point 4)?

I've read the description provideed on PCI DSS 3.2.1 for requierement 4, and I'm having a hard time understanding if it's required to have additional encryption on top of TLS 1.1 / 1.2 using a secure ...
-3
votes
2answers
150 views

Is PCI compliance required by law?

Is PCI compliance required by law? We are creating a website where we will accept customer card data and pass it to merchant API. Everywhere on the internet you will find PCI is required. But what ...
0
votes
1answer
65 views

AWS Load Balancer Response Header Apache Server Disclosure

I have a node.js environment deployed using AWS Elastic Beanstalk on an Apache server. I have run a PCI scan on the environment and I'm getting 2 failures: Apache ServerTokens Information Disclosure ...
1
vote
2answers
72 views

Log and file Auditing

I am going through this PCI compliance for the first time. I have some questions because it is not clear what they are expecting and maybe I am over thinking it. Question 1: 10.3.1 through 10.7 ...
1
vote
1answer
51 views

How to support search of data under PCI-DSS?

Suppose that the data in question is a card PAN. According to PCI-DSS, you have to store it with extra security (encrypt it before storing in database and store the secret key elsewhere with more ...
1
vote
2answers
87 views

Audio Recording of my Credit Card Info?

If I call into a call center to order a product or service, and they take my credit card - do I have any assurance they are not recording the phone call "for quality purposes" which includes my credit ...
1
vote
1answer
46 views

Backing up PCI data outside of the cardholder data environment

Assume a cardholder data environment (CHDE) is segregated appropriately, data in the environment is encrypted at rest and in transmission. We have a backup service that sits outside the CHDE. If we ...
1
vote
1answer
52 views

PCI Compliance Scan & Globalscape EFT Web App Cookies Not Marked Secure

I have a situation where we are performing external PCI compliance scans against our Globalscape EFT server. The scan is reporting: HTTP (443/tcp) - Web Application Cookies Not Marked Secure Per our ...
0
votes
2answers
92 views

PCI MFA (Multi-Factor Authentication)

Following this link: https://www.pcisecuritystandards.org/pdfs/Multi-Factor-Authentication-Guidance-v1.pdf All I understand is that: The intent of multi-factor authentication (MFA) is to provide a ...
0
votes
1answer
352 views

Display Full Credit Card Number and PCI compliance

I've been reading through PCI compliance rules to see if it is ever PCI compliant to display the full credit card number on a webpage to a user. I've found some info about paper receipts and rules ...
0
votes
1answer
56 views

Logging requirement in PCI DSS for in house application

Recently we had an PCI Gap assessment, and the auditor asked as to show the application log, but we had very basic application log that only stores events and any exception. But auditor told us that ...
1
vote
1answer
37 views

Is a bank's affiliate that provides services to the bank issuer required to show compliance or certification to PCI DSS

Is a bank's affiliate that provides services to the bank issuer required to demonstrate compliance or certification to PCI DSS? If so, how is this typically done?
1
vote
0answers
197 views

Is this code as insecure as it looks? [closed]

The company I work for is looking for a payment processor. Ideally we want a fully and seamlessly integrated solution. I came across this from one of the recommended companies I had to look in to ...
3
votes
2answers
431 views

Does PCI-DSS password guidance apply to service accounts?

A service account is a user account created for the sole purpose of running an application. For example, an online banking web site may have a single service account under which the code runs. ...
-1
votes
1answer
64 views

Question about saving credit card info on PW reset [PCI]

I work for a retail organization with a large ecommerce presence. We allow our customers to store CC information for easy check-out, like many retailers. Currently we remove all stored CC ...
1
vote
3answers
324 views

Storing credit card numbers for enterprise payments

There is a business requirement to store credit card numbers on behalf of end users in the enterprise for the use cases below. Currently these users store credit card numbers in insecure locations ...
0
votes
1answer
76 views

PCI Compliance and Card Data Transmit

I have read that PCI enforces the merchants to store first six and last four digits are the maximum number of digits that may be displayed/stored. I am trying to find what is required in regards to ...
2
votes
0answers
71 views

PCI Compliance and Git

We are currently moving to get a ci\cd pipeline running on Gitlab. Our current set up is we have a non-production and a production environment on separate networks. This reduces the PCI scope to just ...
2
votes
2answers
404 views

TLS1.0 deprecation and PCI DSS requirements

It won't be easy) As you know there are new PCI DSS requirements after 30 June which say we shouldn't use "SSL/early TLS". But also there is the comments that merchants could save TLS 1.0 but with ...
1
vote
1answer
63 views

if PCI DSS requires encrypted storage of credit cards, what are requirements for storing the decryption key?

https://www.pcisecuritystandards.org/documents/PCIDSS_QRGv3_2.pdf requires that you encrypt stored credit card information -- for example, if you're an online merchant like Amazon that allows repeat ...
-2
votes
1answer
79 views

How to force authentication over HTTPS - Wordpress

During our last PCI scan, we received these 2 fail points: "Basic Authentication over HTTP" and "Web Page Transmits Login Credentials Without Encryption." Both were on Port 2077. Though our ...
3
votes
5answers
293 views

PCI compliance requirements when acting as a pass-through for credit card details

I'm working for a startup and we generate prepaid Mastercards from a card issuer. In our database we save a card reference id, not the 16 digit PAN or CVC. Later we do an API to the card issuer to get ...
3
votes
2answers
2k views

How many rounds should be used to hash card numbers?

We want the ability for payments made without logging in using one of their saved payment methods to be associated with the saved payment method. E.g. if they buy a recurring subscription to magazine ...
4
votes
1answer
85 views

Can a MAC be used as an irreversible PCI Token?

I'm looking at implementing a PCI token generation process based on a MAC code obtained from the PAN. This would be an irreversible token. The method I have in mind seems OK to me, but I'm not quite ...
0
votes
1answer
212 views

How different are Lynis and Wazuh solutions? [closed]

It seems both Cisofy's Lynis and Wazuh's OSSEC share a lot of functionalities. I'm completely newbie on both tools and yet I need to pick one (or both) to help achieve PCI DSS Compliance. Any thoughts?...
1
vote
1answer
201 views

Will Enabling TLS 1.2 and disabling older protocols on Windows Servers have any impact on desktops?

I want to know what the impact would be if I were to enable TLS 1.2 on Windows Servers and disabled older protocols. I enabled TLS 1.2 on my Windows 7 Laptop manually running the Microsoft Fix It ...
0
votes
0answers
63 views

Ossec With AlienVault Looking For Credit Card Information PCI

I am trying to use OSSEC with Alienvault to have some sort of file integrity monitoring. I have installed the ossec agent and I want to look for files containing credit card information. I found this ...
5
votes
3answers
176 views

As a security compliance professional, what should I do if I find that my employer has a PCI AOC but is not compliant?

I have an ethical dilemma. A couple of weeks ago, I accepted a security compliance role. For the past five years I have been working as a PCI QSA before accepting this role. In the short time that I ...
6
votes
3answers
308 views

If I'm PCI-DSS compliant, do I need to worry about GDPR?

Next month, the EU's General Data Protection Regulation (GDPR) takes effect. Our organization is already PCI-DSS compliant. Do we need to do anything additional to make sure we are consistent with ...
1
vote
0answers
25 views

Question regarding the impact of additional PTS firmware version to P2PE application and P2PE solution

I have a question regarding the impact of additional PTS firmware version to P2PE application and P2PE solution. Is additional PTS approved firmware version subject to addition of POI device type? ...
0
votes
0answers
85 views

Are there any security standards for bank cheques? (the equivalent of PCI DSS maybe)

The card payments industry is ruled by the PCI DSS that sets security standards for all processors for instance to be followed. What about bank cheques (e.g. Cashier's cheque etc.) ? Are there any ...
3
votes
1answer
190 views

Network setup for PCI-DSS C-VT

Not sure if this is best here on information security or serverfault or Network Engineering. We have a company that takes telephone orders over the telephone using a virtual terminal. PCI-DSS 3.2 ...
1
vote
2answers
102 views

Emailing PAN securely?

Has anyone successfully implemented a PCI approved method of emailing PAN data? I know there are concerns managing all the PCI requirements in an email solution but is there anyone that has actually ...
1
vote
1answer
205 views

PCI DSS PenetrationTesting Requirement 11.3.4

I'm fairly new to PCI DSS and I'm confused over the requirement to perform pen-testing as per 11.3.4. as it states:- Are penetration-testing procedures defined to test all segmentation methods, ...
1
vote
1answer
384 views

PCI compliance for bank card system

There is a bank who has internal system working with card data preparation, generating PANs, and finally preparing personalization files that are sent to third party card manufacturer. The bank can ...
1
vote
1answer
417 views

How long should a JWT be valid in a PCI-DSS compliant service?

Is there any maximum value enforced or recommended by PCI-DSS for the expiration of the access and refresh JWT? If not enforced, what is an appropriate value to avoid problems during audits?
4
votes
1answer
63 views

When to complete PCI DSS Compliance Paperwork

I am working for a startup that will soon begin processing payments with Stripe. Looking at their documentation, it seems we will have to file an SAQ A, SAQ A-EP, or an SAQ D depending on our ...
1
vote
2answers
260 views

PCI Compliance ISP requirements

I am setting up a PCI compliance call center. I am wondering if my internet service provider has to be certified PCI compliant? I am only connecting to a cloud service that uses SSL and that cloud ...
1
vote
1answer
2k views

Is a TLS 1.2 certificate backwards compatible? [duplicate]

I have a site bound to a TLS v1.2 certificate. Can clients that only support TLS 1.0 or 1.1 still communicate over port 443 with my site? I.e., will the web server drop down to TLS 1.0 or 1.1 if it ...
1
vote
1answer
98 views

Shared host that is not a service provider, with no SAQ/AoC. Is compliance possible?

Shared web host says they are not a service provider and have no attestation of compliance or SAQ. But they say they are PCI compliant. According to SAQ, it would seem like I couldn't be compliant on ...
3
votes
2answers
244 views

Are external assets included in the 2018 TLS 1.0 PCI deprecation?

With the upcoming deprecation of TLS 1.0 for PCI compliance, I thought I'd confirm something: what categories of externally referenced assets (if any) could cause a compliance failure if their still ...
6
votes
2answers
189 views

How Should a Midsized Startup Approach Information Security and Compliance?

The situation: An established SaaS startup with <100 employees, a large development team and several self taught networks engineers. Our business involves handling both PII and payment data. As we'...
2
votes
3answers
276 views

PCI compliance when using credit card details on behalf of another person

My client emailed herself her credit card details and she has given me access to her email by sharing the username and password. She wants me purchase plane tickets, items, on her behalf using her ...