Questions tagged [pci-dss]

An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

Filter by
Sorted by
Tagged with
2
votes
1answer
67 views

is there a two developer minimum for companies seeking PCI compliance?

I'm doing a questionnaire for PCI compliance and one of the questions (Yes / No / Not Applicable) is as follows: All custom application code changes are reviewed (either using manual or automated ...
0
votes
1answer
77 views

PCI Compliance and multi tenancy?

I am developing a Multi-tenant application to allow tenants to open an e-commerce shop (similar to Shopify). We are hosted on AWS. At this point there will be under 20,000 transactions in the first ...
0
votes
0answers
50 views

file-integrity monitoring tools for PCI compliance

A former employer of mine has reached out to me to assist them with PCI certification (I guess I'll be getting a 1099-NEC from them next year as a result). Here's the point I'm at in the questionnaire:...
1
vote
0answers
60 views

Possibility of EMVCO 3DS Authentication Decoding [closed]

I bumped across a request via Traffic analysis through Burp Suite Proxy & it looked like a 3DS Authentication. Sample below: My question was if this authentication could be intercepted, decoded ...
5
votes
1answer
502 views

PCI Compliance Password time to die change requirement

In the PCI DSS3 requirements it states that the user must change their password every 90 days, how are banks in the UK getting around this requirement? Is it because of 2FA? As a new business we are ...
0
votes
0answers
20 views

What types of businesses are allowed to store SAD and in particular CVV data? [duplicate]

There must be some kind of business that requires the use of sensitive authentication data (SAD) data. Could someone point me in the right direction on the requirement for the storage of that data?
1
vote
2answers
41 views

SAQ-A vs SAQ-D Scope

I've received notice from our risk management group that they believe our website falls in scope for SAQ-D. We utilize third party vendors for all of our payment processing - and on the website ...
0
votes
2answers
59 views

PCI DSS Protectecting Card Data Elements when Transmitting PAN

I'm currently working on a mobile application that will need to transmit a customers full card data to an internal API that will then transmit the information to an external API owned by a payment ...
0
votes
1answer
84 views

File Integrity Monitoring via Syslog-ng or agentless - is it possible?

I am involved in a project which deals with PCI-DSS compliance. Particularly, there is a requirement to implement FIM (File Integrity Monitoring) for critical devices. Within these devices, there are ...
1
vote
1answer
151 views

PCI Compliance for developers accessing a production database for support

As a developer, when an Incident comes in and reaches Tier 3 support (The development team), how can the developers get access to query the Production Database, while remaining PCI Compliant? I'm ...
2
votes
0answers
92 views

Grace period for users after re-enabling account disabled by PCI-DSS 8.1.4?

We have an automated system to disable user accounts that have seen no logins for 90 days. We also have a process of re-enabling such accounts (at the behest of the affected users), and this process ...
1
vote
0answers
43 views

PCI-DSS Level 1 requirement for Intrusion Detection and Prevention on AWS API Gateway and AWS Lambda

Our architecture is based on the best practices for PCI-DSS on AWS Amazon WAF -> API Gateway -> AWS Lambda The lambda's are running within a VPC and the SG / Firewall and segmentation have been ...
1
vote
2answers
59 views

Can biometric vectors (i.e. fingerprint vector) be considered as Sensitive Authentication Data (SAD) in PCI?

I am designing a system that uses a certain biometric vector as a secondary user identification step before authorizing a payment. My system does not handle payment card details, rather the payment ...
0
votes
2answers
166 views

Security camera NVR is making my network not PCI compliant. What can I do?

So family operates a small bar/lounge in Florida and I work for them part time as a bar back / IT technician. For the past couple months we have been trying to become pci compliant. However, we keep ...
0
votes
1answer
63 views

Monitoring User (developer) interaction

I'm looking for a "tamper proof" way, if there is such a thing, to monitor what a developer/engineer does on a given system. To expand a bit more about this, we have several systems that run ...
2
votes
2answers
123 views

Storing credit card information - encrypted at rest

A client is asking for a way so his app can receive credit card information and store them. He needs this to process scheduled payments from his clients. I told him that I can build a asymmetrical (...
0
votes
1answer
101 views

Which Authentication mechanism to choose for PCI-DSS system

I want to create Angular 9 + Spring Boot application with strong security complaint to PCI-DSS security standard. Which security protocol is preferred for user sessions in order to have high security ...
1
vote
2answers
102 views

Call center recording my credit card info

I just made a new contract over the phone with my mobile phone provider and I needed to pay the activation fee. The lady told me that they could accept only credit cards and asked me for the full ...
1
vote
1answer
86 views

Would using an input field for billing data but not storing or posting any of that data be legal?

We're building a web application embedded in a desktop application (via CefSharp) so that we can use client-side C# methods based on front-end JS on the website. For example, there is a billing data ...
1
vote
1answer
66 views

PCI scope for credit card forms that talk to Stripe, Braintree, etc

I client of mine is using a custom credit card form, which talks to Stripe, Braintree, etc To make this acceptable for a PCI audit, currently they do the following: They host the files in a ...
0
votes
1answer
100 views

PCI Compliance - Service Provider vs Merchant

We will be providing a service to a client, where the end user logged on to our system can submit their payment information to Authorize .Net. I need help figuring out if we as a service provider ...
0
votes
1answer
57 views

PCI DSS: Is there a way to pass encrypted billing data through a server without compliance?

Hope all is well. I am developing a primarily cloud-based tool that allows the end-user to enter in billing data and task data via a desktop application, and the billing data is stored locally (their ...
0
votes
1answer
46 views

Is it legal to post card data from an ecommerce checkout to a PCI compliant 'store'

Let's say I want to charge a user's credit card with their permission after a sale takes place. But, I don't want to have to ask them their credit card a second time. Is it legal to store the credit ...
1
vote
1answer
380 views

What is the difference between a server and an appliance for PCI purposes?

I administer a few hundred servers and am going through a yearly PCI audit. This time around we need to prove that we've got anti-virus protection on our "systems commonly affected by malicious ...
1
vote
2answers
160 views

Does Apache Tomcat 9 meet PCI compliance?

Does Apache Tomcat 9 meet PCI compliance? From where I should start reading and gather some information about that topic?
0
votes
1answer
48 views

Should merchant be SAQ-A compliant if full payment processing is outsourced and NO paper (reports or receipts) with cardholder data is retained

Given: e-commerce merchant, which fully outsourced payment processing to third-party PCI DSS compliant service NO paper with cardholder data is ever retained Question: should such merchant still be ...
3
votes
0answers
104 views

PCI Idle Session Timeout general question

Can someone help me understand how the PCI Timeout rules change for an application like the Starbucks App? A user is able to keep their card open ready for scan for longer the 15 minutes if needed, ...
1
vote
1answer
80 views

Cardholder info transmission between issuing and acquiring banks

Which data is actually transmitted between issuing and acquiring banks during various phases of a card payment transaction? Specifically, does the Issuer tell the Acquirer any info (and which if any?)...
0
votes
2answers
347 views

Is it allowed to store 8-digit BINs outside of CDE

Can I separately store 8-digit BINs and truncated (6/4) PANs outside of my CDE? Truncated PANs are no more than the first 6 and last 4 digits of PAN, compliant to the standard's section 3.4, but it ...
3
votes
0answers
157 views

Can AWS Time Sync be argued PCI compliant?

We're setting up a card processing service on Amazon AWS, and were wondering whether the AWS Time Sync service could be incorporated without running afoul of the PCI time sync requirements? ...
0
votes
1answer
96 views

PCI DSS 1.2.1 Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment

A strict interpretation of that rule would seem to prohibit any non-payment related web browsing by PCs that are used to transmit card details to a payment processor, and perhaps also prohibit web ...
1
vote
1answer
88 views

Business located in USA does it need to be PCI and SCA compliant?

The business is located in the US. But: Has European customers who put a transaction via a custom-built shopping cart Sells via tradeshow in Europe or Asia in person Could Customers send credit cards ...
1
vote
2answers
136 views

PCI Compliance & Third Parties

Let's say that company X is PCI certified and compliant as a merchant. In terms of PCI compliance, what does company X have to consider while working with third parties? E.g. for business reasons ...
1
vote
1answer
107 views

What PCI self assessment questionnaire to choose?

We need to fill out a PCI self assessment questionnaire, and I am wondering If we need to fill out SAQ A-EP or SAQ D. We are an e-commerce merchant that doesnt operate trough a website, but we ...
0
votes
1answer
52 views

HMAC output of CVV

Would storing the output of a HMAC function with the PAN and CVV as input be considered PCI-DSS compliant ? This is post authorisation. I suspect probably not as PCI-DSS explicitly forbids ...
0
votes
0answers
31 views

I need to store the first 6 digits and last 4 digits of a credit card. (not derived from a PAN) [duplicate]

Note: it is not really a masked PAN as nothing is masked so to speak. For testing purposes, I need users to only submit their first 6 and 4 last digits of their CC. At no point at all will they ...
1
vote
2answers
129 views

PCI DSS compliance on storing email body in database which contains plain text password

I work in a PCI DSS certified environment, which (as many secure environments) require 'Strong Cryptography' when storing user passwords, as per requirement 8.2.1. We simply hash them using BCrpyt. ...
0
votes
1answer
67 views

Platform Change

So we converted our website from an internally created site to a Magento Cloud environment. In the process, we had to change how we handle credit cards. We used to redirect the user to the payment ...
1
vote
1answer
557 views

PCI Compliance 8.2.1, 8.2.3, 8.2.4 - Which user passwords is this talking about?

Say you have an e-commerce site that falls under the SAQ A-EP standard, due to extra content on the same page as the iframe that takes the credit card info. This used to fall under the SAQ A ...
1
vote
1answer
104 views

Is encryption required to store non-PAN data under PCI DSS?

We do not store PAN card data, but we do store other non-PAN data such as expiration date, billing zip, and cardholder name. We store this info for use with card-on-file tokens provided by our ...
1
vote
1answer
105 views

Is it reasonable to provide admin access for a PCI vulnerability scan?

My organization is going through a PCI-DSS compliance process. As part of that, we're contracting out our external and internal vulnerability scans. The contractor is asking for admin access to our ...
0
votes
2answers
91 views

Telling donors we will no longer accept card information in writing [closed]

What is positive wording for telling donors we no longer accept card information in writing, for their security?
3
votes
2answers
134 views

Final-Mile Shipping Company Wants Customer Email Address - PCI Compliance Issue? (United States)

My company ships very large, very heavy products to the homes of everyday consumers (think big home renovation materials). Currently, we provide the customer's name, shipping address, and phone number ...
1
vote
1answer
147 views

PCI DSS SAQ A compliance with WooCommerce and 3rd party payment gateways - possible? [closed]

I am considering using Wordpress, WooCommerce, third party payment processor and different plugins for an ecommerce store. I have trouble figuring out if it is possible to do all that and to be PCI ...
0
votes
1answer
234 views

How to communicate Credit Card details to customers when instantly approved in PCI-DSS compliant way?

Would displaying the full Credit Card details (PAN, Expiry date and CVV/CVC) in Online Banking and / Mobile Banking be considered both PCI-DSS and secure? Or what would be Best practice to display the ...
1
vote
4answers
308 views

Collecting banking, credit-card statements from users

I want to build a service that collects user spending history with their permission. Users would send over (banking, credit card) account statements and I would extract, store the following ...
105
votes
5answers
13k views

Being told my “network” isn't PCI compliant. I don't even have a server! Do I have to comply?

We are a brick and mortar company... literally. We are brick masons. At our office we connect to the internet through our cable modem provided to us by Spectrum Business. Our Treasurer uses a ...
1
vote
1answer
92 views

Is there a PCI Requirement for shuffling digits while accepting PIN?

The following image shows a PIN entry device which shuffles the digits. . via twitter I've seen this question, but it doesn't cover why companies are still doing this. I looked at the POS PIN Entry ...
2
votes
1answer
91 views

Using browser XMLHttpRequest to initiate credit card transaction with processor?

I have a website where people can make purchases. The entire website is served with https. On the first page, I accept user profile data and generate a random ID for my client and store that in my ...
0
votes
0answers
40 views

Does PCI-DSS requirement 10 (“track and monitor all access to … card holder data”) apply if I am not storing card holder data?

Requirement 10 states: Track and monitor all access to network resources and card holder data I find this a little vague and I have two questions. If I don't store card holder data - do I just need ...

1
2 3 4 5
13