Questions tagged [pci-dss]

An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

Filter by
Sorted by
Tagged with
-1 votes
1 answer
35 views

Does PCI DSS allows/restrict bulk sending of cards?

Does PCI DSS allows/restrict bulk sending of cards? eg: Im buying gift cards for my 200 employees, can I have them delivered to my HR? Are there addendums or restrictions on this?
  • 119
13 votes
2 answers
3k views

Validating and storing credit card data for retrieval later

I need to validate and store credit card information (name, card number, expiration date, CVC) for retrieval at a later date. Once retrieved, the data will be used for manual processing on a separate ...
  • 231
2 votes
3 answers
200 views

How do companies like Uber and Paypal store card details? Is it possible to offer PCI compliance whilst saving credit card details locally?

I know there's a question that's been already asked but it's a decade old so wanted to get an up to date answer... It's mentioned quite often that the CVV number should never be stored, but this must ...
  • 123
0 votes
3 answers
72 views

PCI Card Number Definition [closed]

We are using a truncation strategy to eliminate card numbers. In order to develop, I need the original pre-truncated data files. The test environment is not allowed to have live card numbers. ...
  • 101
0 votes
3 answers
115 views

How to check validity of a PCI DSS Attestation of Compliance certificate?

I've been sent a certificate of compliance with PCI DSS (v. 3.2.1) in the form of a PDF. In it company A (issuer) claims that company B passed a formal assessment and is a level 2 merchant. What ...
0 votes
1 answer
48 views

DCP-Portal Vulnerability

This vulnerability is from a third party reviewer for PCI scans. I am stuck for months and can't figure this out. I already used sanitation to my page and it still fail the PCI scanning. I am starting ...
3 votes
1 answer
171 views

Does "row-level security" actually serve a security purpose?

Row-level security is often an industry requirement in secure environments, such as those dealing with payment cards. It's supported by most major relational databases, including PostgreSQL, Microsoft ...
  • 5,308
-1 votes
1 answer
107 views

Encrypting card data at application layer over TLS (MasterCard)

I found an article from MasterCard's blog stating: The transport between client applications and Mastercard is secured using TLS/SSL, which means data are encrypted by default when transmitted across ...
0 votes
1 answer
42 views

VM Hosting requirement for a Virtual Terminal application in SAQ-C-VT

We are a merchant that do exclusively MOTO transactions over the phone. To capture credit card information, our sales agent (on their PCs) uses a browser to access an internally developed ASP.NET ...
0 votes
2 answers
89 views

PCI : scope debate : API consumers

The Problem I have two systems. System A - E-commerce application that handles (does not store cc) customer credit data during purchase. System B - Invoicing system for these transactions (does store ...
  • 103
0 votes
2 answers
100 views

PCI DSS -- eWallet Not storing just displaying Virtual PAN

I have an eWallet application that lets the user (owner of the Virtual Visa) see his virtual card information if he wants to make an online purchase. We are not storing the credit card data in our ...
1 vote
2 answers
173 views

What exactly are the characteristics of TLS required by PCI DSS and which reference describes these?

I am quite familiar with the ROC but am not a QSA. PCI definition of strong cryptography make references to choosing your own standard and follow that, for example; if I followed NIST i.e. TLS as ...
  • 151
1 vote
1 answer
1k views

Are virtual credit cards in scope for PCI Compliance?

My company is using virtual credit cards and since we are PCI compliant (and want to be in the future) I was wondering about the requirements of storing/processing and transmitting PAN numbers of ...
  • 329
0 votes
2 answers
170 views

can HSTS be considered as a remediation for not using secure flag for a pci dss auditor [duplicate]

can HSTS be considered asa remediation for the vulneraberabity "cookies are not protected by secure flag" for a PCI DSS auditor?
0 votes
1 answer
113 views

PCI scope "Encrypted cardholder data that is accessible to an entity that also has access to the decryption key"

I have a question related to this FAQ: https://pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/How-does-encrypted-cardholder-data-impact-PCI-DSS-scope?q=how+does+encrypted+data+impact+...
  • 113
0 votes
2 answers
178 views

How does a card issuer comply with PCI if they have to print PANs in clear text?

I read PCI DSS, and it's not very clear in which contexts you can have the PAN in cleartext. One could think in no context, but that is impossible. You need it in clear text of course to print it ...
  • 113
0 votes
2 answers
142 views

PCI DSS Compliance and Firewalling Dynamic Hosts with MITM Certificates

Question Would using a firewall MITM capability to inspect all HTTPS web requests be against PCI compliance/rules? Further Info We have an issue where we need to allow access to some HTTPS sites on ...
  • 101
1 vote
1 answer
146 views

PCI & e-banking sensitive information tokenization/encryption/obfuscation - Which fields require to be secured?

According to PCI standard all businesses that store, process or transmit payment cardholder data must be PCI Compliant. Taking into account that we are talking about a bank, fields like card number ...
  • 11
1 vote
1 answer
113 views

Do I need to keep production Docker/container images?

Context My company is developing a SaaS solution that needs to conform to PCI-DSS L1 for sure, and possibly FedRAMP and other frameworks later. We can do continuous deployment with feature flagged/...
12 votes
4 answers
3k views

How does collecting sensitive data using iframes increase security?

So this approach seems to be rather popular, particularly among payment processors that provide javascript integrations. The added layer of security that "fields in iframe" brings also ...
  • 222
0 votes
1 answer
144 views

SSH and PCI on Insecure, Dirty Side

Does current PCI code require SSH connections be restricted to enumerated (specific) client IP addresses on the unsecure, dirty side? Isn't that outside the scope of the PCI code?
2 votes
1 answer
149 views

is there a two developer minimum for companies seeking PCI compliance?

I'm doing a questionnaire for PCI compliance and one of the questions (Yes / No / Not Applicable) is as follows: All custom application code changes are reviewed (either using manual or automated ...
  • 1,605
0 votes
1 answer
292 views

PCI Compliance and multi tenancy?

I am developing a Multi-tenant application to allow tenants to open an e-commerce shop (similar to Shopify). We are hosted on AWS. At this point there will be under 20,000 transactions in the first ...
1 vote
1 answer
213 views

file-integrity monitoring tools for PCI compliance

A former employer of mine has reached out to me to assist them with PCI certification (I guess I'll be getting a 1099-NEC from them next year as a result). Here's the point I'm at in the questionnaire:...
  • 1,605
1 vote
0 answers
104 views

Possibility of EMVCO 3DS Authentication Decoding [closed]

I bumped across a request via Traffic analysis through Burp Suite Proxy & it looked like a 3DS Authentication. Sample below: My question was if this authentication could be intercepted, decoded ...
5 votes
1 answer
645 views

PCI Compliance Password time to die change requirement

In the PCI DSS3 requirements it states that the user must change their password every 90 days, how are banks in the UK getting around this requirement? Is it because of 2FA? As a new business we are ...
0 votes
0 answers
23 views

What types of businesses are allowed to store SAD and in particular CVV data? [duplicate]

There must be some kind of business that requires the use of sensitive authentication data (SAD) data. Could someone point me in the right direction on the requirement for the storage of that data?
1 vote
2 answers
236 views

SAQ-A vs SAQ-D Scope

I've received notice from our risk management group that they believe our website falls in scope for SAQ-D. We utilize third party vendors for all of our payment processing - and on the website ...
0 votes
2 answers
146 views

PCI DSS Protectecting Card Data Elements when Transmitting PAN

I'm currently working on a mobile application that will need to transmit a customers full card data to an internal API that will then transmit the information to an external API owned by a payment ...
  • 103
0 votes
1 answer
241 views

File Integrity Monitoring via Syslog-ng or agentless - is it possible?

I am involved in a project which deals with PCI-DSS compliance. Particularly, there is a requirement to implement FIM (File Integrity Monitoring) for critical devices. Within these devices, there are ...
2 votes
1 answer
637 views

PCI Compliance for developers accessing a production database for support

As a developer, when an Incident comes in and reaches Tier 3 support (The development team), how can the developers get access to query the Production Database, while remaining PCI Compliant? I'm ...
2 votes
0 answers
229 views

Grace period for users after re-enabling account disabled by PCI-DSS 8.1.4?

We have an automated system to disable user accounts that have seen no logins for 90 days. We also have a process of re-enabling such accounts (at the behest of the affected users), and this process ...
  • 343
3 votes
1 answer
196 views

PCI-DSS Level 1 requirement for Intrusion Detection and Prevention on AWS API Gateway and AWS Lambda

Our architecture is based on the best practices for PCI-DSS on AWS Amazon WAF -> API Gateway -> AWS Lambda The lambda's are running within a VPC and the SG / Firewall and segmentation have been ...
  • 153
1 vote
2 answers
116 views

Can biometric vectors (i.e. fingerprint vector) be considered as Sensitive Authentication Data (SAD) in PCI?

I am designing a system that uses a certain biometric vector as a secondary user identification step before authorizing a payment. My system does not handle payment card details, rather the payment ...
0 votes
2 answers
485 views

Security camera NVR is making my network not PCI compliant. What can I do?

So family operates a small bar/lounge in Florida and I work for them part time as a bar back / IT technician. For the past couple months we have been trying to become pci compliant. However, we keep ...
0 votes
1 answer
105 views

Monitoring User (developer) interaction

I'm looking for a "tamper proof" way, if there is such a thing, to monitor what a developer/engineer does on a given system. To expand a bit more about this, we have several systems that run ...
2 votes
2 answers
304 views

Storing credit card information - encrypted at rest

A client is asking for a way so his app can receive credit card information and store them. He needs this to process scheduled payments from his clients. I told him that I can build a asymmetrical (...
  • 53
0 votes
2 answers
377 views

Which Authentication mechanism to choose for PCI-DSS system

I want to create Angular 9 + Spring Boot application with strong security complaint to PCI-DSS security standard. Which security protocol is preferred for user sessions in order to have high security ...
1 vote
2 answers
167 views

Call center recording my credit card info

I just made a new contract over the phone with my mobile phone provider and I needed to pay the activation fee. The lady told me that they could accept only credit cards and asked me for the full ...
1 vote
1 answer
137 views

Would using an input field for billing data but not storing or posting any of that data be legal?

We're building a web application embedded in a desktop application (via CefSharp) so that we can use client-side C# methods based on front-end JS on the website. For example, there is a billing data ...
1 vote
1 answer
151 views

PCI scope for credit card forms that talk to Stripe, Braintree, etc

I client of mine is using a custom credit card form, which talks to Stripe, Braintree, etc To make this acceptable for a PCI audit, currently they do the following: They host the files in a ...
0 votes
1 answer
252 views

PCI Compliance - Service Provider vs Merchant

We will be providing a service to a client, where the end user logged on to our system can submit their payment information to Authorize .Net. I need help figuring out if we as a service provider ...
0 votes
1 answer
105 views

PCI DSS: Is there a way to pass encrypted billing data through a server without compliance?

Hope all is well. I am developing a primarily cloud-based tool that allows the end-user to enter in billing data and task data via a desktop application, and the billing data is stored locally (their ...
0 votes
1 answer
92 views

Is it legal to post card data from an ecommerce checkout to a PCI compliant 'store'

Let's say I want to charge a user's credit card with their permission after a sale takes place. But, I don't want to have to ask them their credit card a second time. Is it legal to store the credit ...
  • 105
2 votes
1 answer
3k views

What is the difference between a server and an appliance for PCI purposes?

I administer a few hundred servers and am going through a yearly PCI audit. This time around we need to prove that we've got anti-virus protection on our "systems commonly affected by malicious ...
1 vote
2 answers
319 views

Does Apache Tomcat 9 meet PCI compliance?

Does Apache Tomcat 9 meet PCI compliance? From where I should start reading and gather some information about that topic?
  • 11
0 votes
1 answer
121 views

Should merchant be SAQ-A compliant if full payment processing is outsourced and NO paper (reports or receipts) with cardholder data is retained

Given: e-commerce merchant, which fully outsourced payment processing to third-party PCI DSS compliant service NO paper with cardholder data is ever retained Question: should such merchant still be ...
  • 3
3 votes
0 answers
256 views

PCI Idle Session Timeout general question

Can someone help me understand how the PCI Timeout rules change for an application like the Starbucks App? A user is able to keep their card open ready for scan for longer the 15 minutes if needed, ...
  • 31
1 vote
1 answer
124 views

Cardholder info transmission between issuing and acquiring banks

Which data is actually transmitted between issuing and acquiring banks during various phases of a card payment transaction? Specifically, does the Issuer tell the Acquirer any info (and which if any?)...
0 votes
2 answers
695 views

Is it allowed to store 8-digit BINs outside of CDE

Can I separately store 8-digit BINs and truncated (6/4) PANs outside of my CDE? Truncated PANs are no more than the first 6 and last 4 digits of PAN, compliant to the standard's section 3.4, but it ...
  • 103

1
2 3 4 5
14