Questions tagged [pci-dss]

An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

Filter by
Sorted by
Tagged with
24 votes
3 answers
5k views

Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?

We have recently developed a web application with a RESTful API backend. This web app need to have a certain security certification (something called PCI-DSS), and thus it is being scanned ...
Dantre's user avatar
  • 343
2 votes
1 answer
68 views

Can CVV be input in a standard web site? The site doesn't store it

On my website, payments are done using a PCI-compliant 3rd partner. If the client agrees, I store a TOKEN of the card (returned by the PCI partner). I want to make a new payment with CVV for the ...
Emmanuel Gleizer's user avatar
1 vote
1 answer
53 views

interchangeable IDs for login under PCI DSS like Facebook and Twitter

Is using multiple interchangeable IDs a PCI DSS complaint? Facebook and Twitter uses the same method for sign in. multiple interchangeable IDs such as sign in with email or mobile or username.
HM107's user avatar
  • 113
1 vote
1 answer
127 views

PCI DSS 4.0 - Are SSH tunnels and gateways doomed?

I won't lie, I am not a security expert and I am likely one of them guys in them companies whom working life proficiency is to slowly become little annoying. I work for a company complying with PCI ...
round.robin's user avatar
0 votes
0 answers
73 views

PCI-DSS Compliance: SSL Tunneling Credit Card Information Through A HTTPS Mobile/Residential Proxy Service to A Destination Service

If a PCI compliant service decides to SSL-Tunnel credit card information via an independent residential/mobile proxy service to a destination payment service, would this protocol still be PCI ...
chukky arinze's user avatar
1 vote
2 answers
607 views

Can I use GitHub and be PCI DSS 4.0 compliant?

Is it possible to use any remote DVCS (GitHub, Bitbucket, etc.) with PCI DSS or should I host Git on my own server? The repo obviously doesn't store any sensitive CHD information and I do have my own ...
bbozo's user avatar
  • 513
2 votes
1 answer
165 views

How to Approach CVEs Marked as "DISPUTED" and "WON'T FIX" in PCI-DSS Pentest

When conducting penetration testing in a PCI-DSS compliance context, we found a known security vulnerability that's identified by a CVE number. In this case, the finding in question is CVE-2016-20012, ...
xpelican's user avatar
0 votes
1 answer
113 views

PCI compliance - use of ANSI X9.17 for export keys

we have a concern about a key export. We completed the migration to Key Block LMK in our environment (with HSM Thales 10K). Now, we have to exchange keys with third-parties that still use Keys in ...
MaXbeMan's user avatar
1 vote
1 answer
87 views

Encrypt communication between microservices in PCI DSS env

I have a payment gateway application which will be used to process payment transactions hosted on Kubernetes cluster. Total of 4 microservices will be used to communicate using REST API and Kafka. Is ...
Peter Penzov's user avatar
1 vote
0 answers
47 views

PCI requirements for iPaaS organisations

My organisation acts as a b2b cloud integration platform essentially taking data from one SaaS API and posting it to another. The data that is moved between the SaaS applications is end user ...
newcube's user avatar
  • 11
0 votes
1 answer
64 views

PCI-DSS Compliance

Recently I had to implement a website that had to be PCI-DSS compliant. I am only transferring card details over SSL (encrypted with a random RSA 2048 key generated each time, as well.) The data is ...
LostAllIt's user avatar
0 votes
0 answers
73 views

Which documents may be used to demonstrate compliance with requirement 12.8.2 of PCI DSS 3.2.1?

Does a PCI AoC substitute the written agreement that the PCI DSS requirement 12.8.2 requests? If not, what is the best way to comply?
ChocoLatte's user avatar
1 vote
1 answer
91 views

Is LINKT non-PCI compliance and if so how do I report it

I have received an email from LINKT (part of LendLease) stating I need to update my credit card details. In this email it says "...details such as expiry date or CVV might be saved incorrectly or ...
Ross's user avatar
  • 223
-1 votes
1 answer
78 views

Does PCI DSS allows/restrict bulk sending of cards?

Does PCI DSS allows/restrict bulk sending of cards? eg: Im buying gift cards for my 200 employees, can I have them delivered to my HR? Are there addendums or restrictions on this?
Leonardo's user avatar
  • 119
13 votes
2 answers
4k views

Validating and storing credit card data for retrieval later

I need to validate and store credit card information (name, card number, expiration date, CVC) for retrieval at a later date. Once retrieved, the data will be used for manual processing on a separate ...
tony's user avatar
  • 231
2 votes
3 answers
542 views

How do companies like Uber and Paypal store card details? Is it possible to offer PCI compliance whilst saving credit card details locally?

I know there's a question that's been already asked but it's a decade old so wanted to get an up to date answer... It's mentioned quite often that the CVV number should never be stored, but this must ...
pma07pg's user avatar
  • 123
0 votes
3 answers
114 views

PCI Card Number Definition [closed]

We are using a truncation strategy to eliminate card numbers. In order to develop, I need the original pre-truncated data files. The test environment is not allowed to have live card numbers. ...
Missy's user avatar
  • 101
0 votes
3 answers
1k views

How to check validity of a PCI DSS Attestation of Compliance certificate?

I've been sent a certificate of compliance with PCI DSS (v. 3.2.1) in the form of a PDF. In it company A (issuer) claims that company B passed a formal assessment and is a level 2 merchant. What ...
user1713059's user avatar
0 votes
1 answer
71 views

DCP-Portal Vulnerability

This vulnerability is from a third party reviewer for PCI scans. I am stuck for months and can't figure this out. I already used sanitation to my page and it still fail the PCI scanning. I am starting ...
user1996's user avatar
3 votes
1 answer
377 views

Does "row-level security" actually serve a security purpose?

Row-level security is often an industry requirement in secure environments, such as those dealing with payment cards. It's supported by most major relational databases, including PostgreSQL, Microsoft ...
watchowl's user avatar
  • 5,438
-1 votes
1 answer
250 views

Encrypting card data at application layer over TLS (MasterCard)

I found an article from MasterCard's blog stating: The transport between client applications and Mastercard is secured using TLS/SSL, which means data are encrypted by default when transmitted across ...
CyberSrikanth's user avatar
1 vote
1 answer
69 views

VM Hosting requirement for a Virtual Terminal application in SAQ-C-VT

We are a merchant that do exclusively MOTO transactions over the phone. To capture credit card information, our sales agent (on their PCs) uses a browser to access an internally developed ASP.NET ...
Paul S. Lee's user avatar
0 votes
2 answers
129 views

PCI : scope debate : API consumers

The Problem I have two systems. System A - E-commerce application that handles (does not store cc) customer credit data during purchase. System B - Invoicing system for these transactions (does store ...
mconlin's user avatar
  • 103
0 votes
2 answers
172 views

PCI DSS -- eWallet Not storing just displaying Virtual PAN

I have an eWallet application that lets the user (owner of the Virtual Visa) see his virtual card information if he wants to make an online purchase. We are not storing the credit card data in our ...
TikalDog's user avatar
1 vote
2 answers
444 views

What exactly are the characteristics of TLS required by PCI DSS and which reference describes these?

I am quite familiar with the ROC but am not a QSA. PCI definition of strong cryptography make references to choosing your own standard and follow that, for example; if I followed NIST i.e. TLS as ...
Stof's user avatar
  • 341
1 vote
1 answer
3k views

Are virtual credit cards in scope for PCI Compliance?

My company is using virtual credit cards and since we are PCI compliant (and want to be in the future) I was wondering about the requirements of storing/processing and transmitting PAN numbers of ...
elli's user avatar
  • 329
0 votes
2 answers
270 views

can HSTS be considered as a remediation for not using secure flag for a pci dss auditor [duplicate]

can HSTS be considered asa remediation for the vulneraberabity "cookies are not protected by secure flag" for a PCI DSS auditor?
Corionalus's user avatar
0 votes
1 answer
175 views

PCI scope "Encrypted cardholder data that is accessible to an entity that also has access to the decryption key"

I have a question related to this FAQ: https://pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/How-does-encrypted-cardholder-data-impact-PCI-DSS-scope?q=how+does+encrypted+data+impact+...
Sfp's user avatar
  • 113
0 votes
2 answers
408 views

How does a card issuer comply with PCI if they have to print PANs in clear text?

I read PCI DSS, and it's not very clear in which contexts you can have the PAN in cleartext. One could think in no context, but that is impossible. You need it in clear text of course to print it ...
Sfp's user avatar
  • 113
0 votes
2 answers
181 views

PCI DSS Compliance and Firewalling Dynamic Hosts with MITM Certificates

Question Would using a firewall MITM capability to inspect all HTTPS web requests be against PCI compliance/rules? Further Info We have an issue where we need to allow access to some HTTPS sites on ...
jmurphyau's user avatar
  • 101
2 votes
1 answer
189 views

PCI & e-banking sensitive information tokenization/encryption/obfuscation - Which fields require to be secured?

According to PCI standard all businesses that store, process or transmit payment cardholder data must be PCI Compliant. Taking into account that we are talking about a bank, fields like card number ...
Belf's user avatar
  • 21
1 vote
1 answer
146 views

Do I need to keep production Docker/container images?

Context My company is developing a SaaS solution that needs to conform to PCI-DSS L1 for sure, and possibly FedRAMP and other frameworks later. We can do continuous deployment with feature flagged/...
aries1980's user avatar
12 votes
4 answers
4k views

How does collecting sensitive data using iframes increase security?

So this approach seems to be rather popular, particularly among payment processors that provide javascript integrations. The added layer of security that "fields in iframe" brings also ...
Acorn's user avatar
  • 222
0 votes
1 answer
213 views

SSH and PCI on Insecure, Dirty Side

Does current PCI code require SSH connections be restricted to enumerated (specific) client IP addresses on the unsecure, dirty side? Isn't that outside the scope of the PCI code?
talkinggoat's user avatar
2 votes
1 answer
214 views

is there a two developer minimum for companies seeking PCI compliance?

I'm doing a questionnaire for PCI compliance and one of the questions (Yes / No / Not Applicable) is as follows: All custom application code changes are reviewed (either using manual or automated ...
neubert's user avatar
  • 1,726
0 votes
1 answer
534 views

PCI Compliance and multi tenancy?

I am developing a Multi-tenant application to allow tenants to open an e-commerce shop (similar to Shopify). We are hosted on AWS. At this point there will be under 20,000 transactions in the first ...
shimsag's user avatar
1 vote
1 answer
326 views

file-integrity monitoring tools for PCI compliance

A former employer of mine has reached out to me to assist them with PCI certification (I guess I'll be getting a 1099-NEC from them next year as a result). Here's the point I'm at in the questionnaire:...
neubert's user avatar
  • 1,726
1 vote
0 answers
119 views

Possibility of EMVCO 3DS Authentication Decoding [closed]

I bumped across a request via Traffic analysis through Burp Suite Proxy & it looked like a 3DS Authentication. Sample below: My question was if this authentication could be intercepted, decoded ...
Shritam Bhowmick's user avatar
6 votes
1 answer
810 views

PCI Compliance Password time to die change requirement

In the PCI DSS3 requirements it states that the user must change their password every 90 days, how are banks in the UK getting around this requirement? Is it because of 2FA? As a new business we are ...
Lewis Smith's user avatar
0 votes
0 answers
24 views

What types of businesses are allowed to store SAD and in particular CVV data? [duplicate]

There must be some kind of business that requires the use of sensitive authentication data (SAD) data. Could someone point me in the right direction on the requirement for the storage of that data?
Lucas Shuck's user avatar
1 vote
2 answers
502 views

SAQ-A vs SAQ-D Scope

I've received notice from our risk management group that they believe our website falls in scope for SAQ-D. We utilize third party vendors for all of our payment processing - and on the website ...
user7355700's user avatar
0 votes
2 answers
270 views

PCI DSS Protectecting Card Data Elements when Transmitting PAN

I'm currently working on a mobile application that will need to transmit a customers full card data to an internal API that will then transmit the information to an external API owned by a payment ...
amura.cxg's user avatar
  • 103
0 votes
1 answer
405 views

File Integrity Monitoring via Syslog-ng or agentless - is it possible?

I am involved in a project which deals with PCI-DSS compliance. Particularly, there is a requirement to implement FIM (File Integrity Monitoring) for critical devices. Within these devices, there are ...
Alessandro's user avatar
2 votes
1 answer
1k views

PCI Compliance for developers accessing a production database for support

As a developer, when an Incident comes in and reaches Tier 3 support (The development team), how can the developers get access to query the Production Database, while remaining PCI Compliant? I'm ...
Tolga Ercan's user avatar
2 votes
0 answers
351 views

Grace period for users after re-enabling account disabled by PCI-DSS 8.1.4?

We have an automated system to disable user accounts that have seen no logins for 90 days. We also have a process of re-enabling such accounts (at the behest of the affected users), and this process ...
KlaymenDK's user avatar
  • 343
3 votes
1 answer
336 views

PCI-DSS Level 1 requirement for Intrusion Detection and Prevention on AWS API Gateway and AWS Lambda

Our architecture is based on the best practices for PCI-DSS on AWS Amazon WAF -> API Gateway -> AWS Lambda The lambda's are running within a VPC and the SG / Firewall and segmentation have been ...
Simon's user avatar
  • 153
1 vote
2 answers
152 views

Can biometric vectors (i.e. fingerprint vector) be considered as Sensitive Authentication Data (SAD) in PCI?

I am designing a system that uses a certain biometric vector as a secondary user identification step before authorizing a payment. My system does not handle payment card details, rather the payment ...
Heshan Perera's user avatar
0 votes
2 answers
693 views

Security camera NVR is making my network not PCI compliant. What can I do?

So family operates a small bar/lounge in Florida and I work for them part time as a bar back / IT technician. For the past couple months we have been trying to become pci compliant. However, we keep ...
shywolf91's user avatar
0 votes
1 answer
115 views

Monitoring User (developer) interaction

I'm looking for a "tamper proof" way, if there is such a thing, to monitor what a developer/engineer does on a given system. To expand a bit more about this, we have several systems that run ...
codingbunny's user avatar
2 votes
2 answers
373 views

Storing credit card information - encrypted at rest

A client is asking for a way so his app can receive credit card information and store them. He needs this to process scheduled payments from his clients. I told him that I can build a asymmetrical (...
John Nett's user avatar

1
2 3 4 5
14