Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pci-dss]

An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

0
votes
1answer
51 views

Dealing with OpenSSH CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6

How are you dealing with the OpenSSH vulnerabilities CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6 in a PCI server? OpenSSH doesn't seem to have a fix for this yet, but it fails ...
3
votes
1answer
58 views

PCI DSS minimum password strength equivalent in passphrase

The PCI DSS requirement 8.2.3 says: Passwords/passphrases must meet the following: Require a minimum length of at least seven characters. Contain both numeric and alphabetic characters. ...
2
votes
2answers
70 views

Can multiple SAQs be used for PCI compliance?

If we have a SAQ A compliant website for online signups, can we also use SAQ C-VT for phone orders? I'm thinking yes since they're separate payment channels but this aspect is new to me.
1
vote
1answer
38 views

Does End of Life Hardware comply with PCI DSS 3.2 if still under support from a Third-Party, Not the actual vendor?

Can some one help me to confirm that End of Life hardware complies with PCI DSS 3.2 or not? I only see requirements for software but no mention of hardware? Any guidance would be greatly appreciated. ...
1
vote
0answers
81 views

Does my eCommerce SaaS vendor need to be PCI DSS compliant?

I'm feeling super confused by the whole PCI DSS business. I'm working with a local, HK-based eCommerce SaaS vendor for my eCommerce website - they provide everything from web development to hosting, ...
0
votes
1answer
80 views

PCI-DSS scope: Using P2PE Compliant devices

We use EMV card readers to automate the payments at the entry and exit to our services. These card readers and the unattended payment terminals are fully PTS complaint and use P2PE encryption. Also, ...
2
votes
0answers
71 views

Are the sha1 hashes used by common ssh configurations insecure?

I got an automated PCI security test result that checked various server configurations. The automated test determined the server to be unsafe due to the use of sha1 algorithm in some elements of the ...
3
votes
3answers
106 views

What level of compliance do I need as a software vendor?

I am having a bit a difficult time trying to assess to what level my business needs to be PCI compliant. My business is developing eCommerce websites that are hosted by the client. The websites have ...
3
votes
1answer
34 views

PCI DSS 3.2 SAQ-A for card-not-present mail/telephone orders (MOTO)

What methods of processing payments fit into the definition of SAQ-A for orders made over the phone? I am confused because it says SAQ-A is valid when "All processing of cardholder data is entirely ...
0
votes
1answer
31 views

Do you need to validate compensating controls of a certified organization?

Our web application uses Google's G Suite Single Sign-on for authentication into our application. As part of writing documentation around compensating controls, the PCI DSS requires "Validation of ...
0
votes
0answers
62 views

Store Credit Card data in memory for using with native payment SDKs (iOS, Android)

I am implementing a Credit Card processing in mobile apps for iOS (Swift) and Android (Kotlin) using native SDK (SAQ A EP compliance level) We thought about: disabling clipboard for CC field ...
1
vote
1answer
74 views

PCI compliance dilemma

I am looking for advice on PCI compliance. I am being told that I am not currently PCI compliant although I am not sure if this is accurate. We outsource the payment management and card storage to a ...
0
votes
1answer
65 views

PCI-DSS scoping when there is no CDE

We are a merchant who processes over 2m transactions a year. However, we have outsourced all the payment functions to compliant 3rd party providers. Understand that PCI is about people, process and ...
0
votes
2answers
80 views

AWS serverless architecture compliance with PCI DSS 11.3 penetration testing segmentation

I am wondering how to comply with PCI DSS requirements (11.3) to test segmentation controls using penetration testing in AWS serverless architecture. We are using components such as AWS Lambda, AWS ...
0
votes
1answer
56 views

Angular application for PCI-DSS certification

I want to design Angular 6 application for PCI-DSS compliance. Is it a good idea to use it having in mind that this is a client-side application with a server back-end? Do you know if there any ...
0
votes
1answer
40 views

Is PCI - DSS required to store only card number

We need to save the credit card number in our database , but not the cvv. Should we be PCI - DSS compliant for this or some security measures is enough. After the save we will use that to call stripe ...
1
vote
2answers
115 views

Is taking CC info in plain HTML elements, but using a library like Stripe to tokenize PCI compliant?

I am building a site which will accept payments. I will be processing payments with either Stripe or Square. Stripe now has Stripe Elements, and Square has Square Payment Form. I have tried Square ...
1
vote
0answers
109 views

TLS1.2, weak cypher suites and PCI DSS V3.2.1 compliance

Are below cypher suites, which are part of TLSv1.2: TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA ...
0
votes
3answers
82 views

What is two full-length key components PCI DSS requirement 3.5.3

PCI DSS requirement 3.5.3 3.5.3 Store secret and private keys used to encrypt/decrypt cardholder data in one (or more) of the following forms at all times: ............ As at least two full-length ...
0
votes
1answer
38 views

Only using TLS 1.1 or 1.2 is enough for PCI DSS compliance on transmission of cardholder data (point 4)?

I've read the description provideed on PCI DSS 3.2.1 for requierement 4, and I'm having a hard time understanding if it's required to have additional encryption on top of TLS 1.1 / 1.2 using a secure ...
-3
votes
2answers
187 views

Is PCI compliance required by law?

Is PCI compliance required by law? We are creating a website where we will accept customer card data and pass it to merchant API. Everywhere on the internet you will find PCI is required. But what ...
0
votes
1answer
136 views

AWS Load Balancer Response Header Apache Server Disclosure

I have a node.js environment deployed using AWS Elastic Beanstalk on an Apache server. I have run a PCI scan on the environment and I'm getting 2 failures: Apache ServerTokens Information Disclosure ...
1
vote
2answers
86 views

Log and file Auditing

I am going through this PCI compliance for the first time. I have some questions because it is not clear what they are expecting and maybe I am over thinking it. Question 1: 10.3.1 through 10.7 ...
1
vote
1answer
63 views

How to support search of data under PCI-DSS?

Suppose that the data in question is a card PAN. According to PCI-DSS, you have to store it with extra security (encrypt it before storing in database and store the secret key elsewhere with more ...
1
vote
2answers
96 views

Audio Recording of my Credit Card Info?

If I call into a call center to order a product or service, and they take my credit card - do I have any assurance they are not recording the phone call "for quality purposes" which includes my credit ...
1
vote
1answer
52 views

Backing up PCI data outside of the cardholder data environment

Assume a cardholder data environment (CHDE) is segregated appropriately, data in the environment is encrypted at rest and in transmission. We have a backup service that sits outside the CHDE. If we ...
1
vote
1answer
76 views

PCI Compliance Scan & Globalscape EFT Web App Cookies Not Marked Secure

I have a situation where we are performing external PCI compliance scans against our Globalscape EFT server. The scan is reporting: HTTP (443/tcp) - Web Application Cookies Not Marked Secure Per our ...
0
votes
2answers
151 views

PCI MFA (Multi-Factor Authentication)

Following this link: https://www.pcisecuritystandards.org/pdfs/Multi-Factor-Authentication-Guidance-v1.pdf All I understand is that: The intent of multi-factor authentication (MFA) is to provide a ...
0
votes
1answer
561 views

Display Full Credit Card Number and PCI compliance

I've been reading through PCI compliance rules to see if it is ever PCI compliant to display the full credit card number on a webpage to a user. I've found some info about paper receipts and rules ...
0
votes
1answer
74 views

Logging requirement in PCI DSS for in house application

Recently we had an PCI Gap assessment, and the auditor asked as to show the application log, but we had very basic application log that only stores events and any exception. But auditor told us that ...
1
vote
1answer
55 views

Is a bank's affiliate that provides services to the bank issuer required to show compliance or certification to PCI DSS

Is a bank's affiliate that provides services to the bank issuer required to demonstrate compliance or certification to PCI DSS? If so, how is this typically done?
1
vote
0answers
205 views

Is this code as insecure as it looks? [closed]

The company I work for is looking for a payment processor. Ideally we want a fully and seamlessly integrated solution. I came across this from one of the recommended companies I had to look in to ...
3
votes
2answers
648 views

Does PCI-DSS password guidance apply to service accounts?

A service account is a user account created for the sole purpose of running an application. For example, an online banking web site may have a single service account under which the code runs. ...
-1
votes
1answer
65 views

Question about saving credit card info on PW reset [PCI]

I work for a retail organization with a large ecommerce presence. We allow our customers to store CC information for easy check-out, like many retailers. Currently we remove all stored CC ...
1
vote
3answers
561 views

Storing credit card numbers for enterprise payments

There is a business requirement to store credit card numbers on behalf of end users in the enterprise for the use cases below. Currently these users store credit card numbers in insecure locations ...
0
votes
1answer
83 views

PCI Compliance and Card Data Transmit

I have read that PCI enforces the merchants to store first six and last four digits are the maximum number of digits that may be displayed/stored. I am trying to find what is required in regards to ...
2
votes
0answers
84 views

PCI Compliance and Git

We are currently moving to get a ci\cd pipeline running on Gitlab. Our current set up is we have a non-production and a production environment on separate networks. This reduces the PCI scope to just ...
2
votes
2answers
540 views

TLS1.0 deprecation and PCI DSS requirements

It won't be easy) As you know there are new PCI DSS requirements after 30 June which say we shouldn't use "SSL/early TLS". But also there is the comments that merchants could save TLS 1.0 but with ...
1
vote
1answer
67 views

if PCI DSS requires encrypted storage of credit cards, what are requirements for storing the decryption key?

https://www.pcisecuritystandards.org/documents/PCIDSS_QRGv3_2.pdf requires that you encrypt stored credit card information -- for example, if you're an online merchant like Amazon that allows repeat ...
-2
votes
1answer
90 views

How to force authentication over HTTPS - Wordpress

During our last PCI scan, we received these 2 fail points: "Basic Authentication over HTTP" and "Web Page Transmits Login Credentials Without Encryption." Both were on Port 2077. Though our ...
3
votes
5answers
386 views

PCI compliance requirements when acting as a pass-through for credit card details

I'm working for a startup and we generate prepaid Mastercards from a card issuer. In our database we save a card reference id, not the 16 digit PAN or CVC. Later we do an API to the card issuer to get ...
3
votes
2answers
2k views

How many rounds should be used to hash card numbers?

We want the ability for payments made without logging in using one of their saved payment methods to be associated with the saved payment method. E.g. if they buy a recurring subscription to magazine ...
4
votes
1answer
89 views

Can a MAC be used as an irreversible PCI Token?

I'm looking at implementing a PCI token generation process based on a MAC code obtained from the PAN. This would be an irreversible token. The method I have in mind seems OK to me, but I'm not quite ...
0
votes
1answer
249 views

How different are Lynis and Wazuh solutions? [closed]

It seems both Cisofy's Lynis and Wazuh's OSSEC share a lot of functionalities. I'm completely newbie on both tools and yet I need to pick one (or both) to help achieve PCI DSS Compliance. Any thoughts?...
1
vote
1answer
225 views

Will Enabling TLS 1.2 and disabling older protocols on Windows Servers have any impact on desktops?

I want to know what the impact would be if I were to enable TLS 1.2 on Windows Servers and disabled older protocols. I enabled TLS 1.2 on my Windows 7 Laptop manually running the Microsoft Fix It ...
0
votes
0answers
75 views

Ossec With AlienVault Looking For Credit Card Information PCI

I am trying to use OSSEC with Alienvault to have some sort of file integrity monitoring. I have installed the ossec agent and I want to look for files containing credit card information. I found this ...
5
votes
3answers
186 views

As a security compliance professional, what should I do if I find that my employer has a PCI AOC but is not compliant?

I have an ethical dilemma. A couple of weeks ago, I accepted a security compliance role. For the past five years I have been working as a PCI QSA before accepting this role. In the short time that I ...
6
votes
3answers
322 views

If I'm PCI-DSS compliant, do I need to worry about GDPR?

Next month, the EU's General Data Protection Regulation (GDPR) takes effect. Our organization is already PCI-DSS compliant. Do we need to do anything additional to make sure we are consistent with ...
1
vote
0answers
29 views

Question regarding the impact of additional PTS firmware version to P2PE application and P2PE solution

I have a question regarding the impact of additional PTS firmware version to P2PE application and P2PE solution. Is additional PTS approved firmware version subject to addition of POI device type? ...
0
votes
0answers
97 views

Are there any security standards for bank cheques? (the equivalent of PCI DSS maybe)

The card payments industry is ruled by the PCI DSS that sets security standards for all processors for instance to be followed. What about bank cheques (e.g. Cashier's cheque etc.) ? Are there any ...