Questions tagged [pci-dss]

An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

Filter by
Sorted by
Tagged with
0
votes
0answers
36 views

Monitoring User (developer) interaction

I'm looking for a "tamper proof" way, if there is such a thing, to monitor what a developer/engineer does on a given system. To expand a bit more about this, we have several systems that run ...
2
votes
2answers
99 views

Storing credit card information - encrypted at rest

A client is asking for a way so his app can receive credit card information and store them. He needs this to process scheduled payments from his clients. I told him that I can build a asymmetrical (...
0
votes
1answer
51 views

Which Authentication mechanism to choose for PCI-DSS system

I want to create Angular 9 + Spring Boot application with strong security complaint to PCI-DSS security standard. Which security protocol is preferred for user sessions in order to have high security ...
1
vote
2answers
89 views

Call center recording my credit card info

I just made a new contract over the phone with my mobile phone provider and I needed to pay the activation fee. The lady told me that they could accept only credit cards and asked me for the full ...
1
vote
1answer
63 views

Would using an input field for billing data but not storing or posting any of that data be legal?

We're building a web application embedded in a desktop application (via CefSharp) so that we can use client-side C# methods based on front-end JS on the website. For example, there is a billing data ...
1
vote
1answer
60 views

PCI scope for credit card forms that talk to Stripe, Braintree, etc

I client of mine is using a custom credit card form, which talks to Stripe, Braintree, etc To make this acceptable for a PCI audit, currently they do the following: They host the files in a ...
0
votes
1answer
63 views

PCI Compliance - Service Provider vs Merchant

We will be providing a service to a client, where the end user logged on to our system can submit their payment information to Authorize .Net. I need help figuring out if we as a service provider ...
0
votes
1answer
52 views

PCI DSS: Is there a way to pass encrypted billing data through a server without compliance?

Hope all is well. I am developing a primarily cloud-based tool that allows the end-user to enter in billing data and task data via a desktop application, and the billing data is stored locally (their ...
0
votes
1answer
42 views

Is it legal to post card data from an ecommerce checkout to a PCI compliant 'store'

Let's say I want to charge a user's credit card with their permission after a sale takes place. But, I don't want to have to ask them their credit card a second time. Is it legal to store the credit ...
1
vote
1answer
57 views

What is the difference between a server and an appliance for PCI purposes?

I administer a few hundred servers and am going through a yearly PCI audit. This time around we need to prove that we've got anti-virus protection on our "systems commonly affected by malicious ...
1
vote
2answers
100 views

Does Apache Tomcat 9 meet PCI compliance?

Does Apache Tomcat 9 meet PCI compliance? From where I should start reading and gather some information about that topic?
0
votes
1answer
41 views

Should merchant be SAQ-A compliant if full payment processing is outsourced and NO paper (reports or receipts) with cardholder data is retained

Given: e-commerce merchant, which fully outsourced payment processing to third-party PCI DSS compliant service NO paper with cardholder data is ever retained Question: should such merchant still be ...
2
votes
0answers
61 views

PCI Idle Session Timeout general question

Can someone help me understand how the PCI Timeout rules change for an application like the Starbucks App? A user is able to keep their card open ready for scan for longer the 15 minutes if needed, ...
1
vote
1answer
79 views

Cardholder info transmission between issuing and acquiring banks

Which data is actually transmitted between issuing and acquiring banks during various phases of a card payment transaction? Specifically, does the Issuer tell the Acquirer any info (and which if any?)...
0
votes
2answers
123 views

Is it allowed to store 8-digit BINs outside of CDE

Can I separately store 8-digit BINs and truncated (6/4) PANs outside of my CDE? Truncated PANs are no more than the first 6 and last 4 digits of PAN, compliant to the standard's section 3.4, but it ...
3
votes
0answers
96 views

Can AWS Time Sync be argued PCI compliant?

We're setting up a card processing service on Amazon AWS, and were wondering whether the AWS Time Sync service could be incorporated without running afoul of the PCI time sync requirements? ...
0
votes
1answer
54 views

PCI DSS 1.2.1 Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment

A strict interpretation of that rule would seem to prohibit any non-payment related web browsing by PCs that are used to transmit card details to a payment processor, and perhaps also prohibit web ...
0
votes
0answers
37 views

PCI DSS Requirement 6 Clarification

I’m hoping to clarify this: If there is a segmented network and card data is only in one section, do the Section 6 requirements for development apply to the network segment that allows card data? Do ...
0
votes
0answers
34 views

PCI compliance and VM server administrator

I have a situation where an application has to encrypt/decrypt some credit card data, each encryption key (it could be symmetric or private asymmetric) has to be in two separate places, managed by ...
1
vote
1answer
87 views

Business located in USA does it need to be PCI and SCA compliant?

The business is located in the US. But: Has European customers who put a transaction via a custom-built shopping cart Sells via tradeshow in Europe or Asia in person Could Customers send credit cards ...
1
vote
2answers
124 views

PCI Compliance & Third Parties

Let's say that company X is PCI certified and compliant as a merchant. In terms of PCI compliance, what does company X have to consider while working with third parties? E.g. for business reasons ...
1
vote
1answer
95 views

What PCI self assessment questionnaire to choose?

We need to fill out a PCI self assessment questionnaire, and I am wondering If we need to fill out SAQ A-EP or SAQ D. We are an e-commerce merchant that doesnt operate trough a website, but we ...
0
votes
1answer
44 views

HMAC output of CVV

Would storing the output of a HMAC function with the PAN and CVV as input be considered PCI-DSS compliant ? This is post authorisation. I suspect probably not as PCI-DSS explicitly forbids ...
0
votes
0answers
30 views

I need to store the first 6 digits and last 4 digits of a credit card. (not derived from a PAN) [duplicate]

Note: it is not really a masked PAN as nothing is masked so to speak. For testing purposes, I need users to only submit their first 6 and 4 last digits of their CC. At no point at all will they ...
1
vote
2answers
105 views

PCI DSS compliance on storing email body in database which contains plain text password

I work in a PCI DSS certified environment, which (as many secure environments) require 'Strong Cryptography' when storing user passwords, as per requirement 8.2.1. We simply hash them using BCrpyt. ...
0
votes
1answer
67 views

Platform Change

So we converted our website from an internally created site to a Magento Cloud environment. In the process, we had to change how we handle credit cards. We used to redirect the user to the payment ...
1
vote
1answer
327 views

PCI Compliance 8.2.1, 8.2.3, 8.2.4 - Which user passwords is this talking about?

Say you have an e-commerce site that falls under the SAQ A-EP standard, due to extra content on the same page as the iframe that takes the credit card info. This used to fall under the SAQ A ...
1
vote
1answer
74 views

Is encryption required to store non-PAN data under PCI DSS?

We do not store PAN card data, but we do store other non-PAN data such as expiration date, billing zip, and cardholder name. We store this info for use with card-on-file tokens provided by our ...
1
vote
1answer
102 views

Is it reasonable to provide admin access for a PCI vulnerability scan?

My organization is going through a PCI-DSS compliance process. As part of that, we're contracting out our external and internal vulnerability scans. The contractor is asking for admin access to our ...
0
votes
2answers
91 views

Telling donors we will no longer accept card information in writing [closed]

What is positive wording for telling donors we no longer accept card information in writing, for their security?
3
votes
2answers
134 views

Final-Mile Shipping Company Wants Customer Email Address - PCI Compliance Issue? (United States)

My company ships very large, very heavy products to the homes of everyday consumers (think big home renovation materials). Currently, we provide the customer's name, shipping address, and phone number ...
1
vote
1answer
114 views

PCI DSS SAQ A compliance with WooCommerce and 3rd party payment gateways - possible? [closed]

I am considering using Wordpress, WooCommerce, third party payment processor and different plugins for an ecommerce store. I have trouble figuring out if it is possible to do all that and to be PCI ...
0
votes
1answer
221 views

How to communicate Credit Card details to customers when instantly approved in PCI-DSS compliant way?

Would displaying the full Credit Card details (PAN, Expiry date and CVV/CVC) in Online Banking and / Mobile Banking be considered both PCI-DSS and secure? Or what would be Best practice to display the ...
1
vote
4answers
253 views

Collecting banking, credit-card statements from users

I want to build a service that collects user spending history with their permission. Users would send over (banking, credit card) account statements and I would extract, store the following ...
105
votes
5answers
13k views

Being told my “network” isn't PCI compliant. I don't even have a server! Do I have to comply?

We are a brick and mortar company... literally. We are brick masons. At our office we connect to the internet through our cable modem provided to us by Spectrum Business. Our Treasurer uses a ...
1
vote
1answer
80 views

Is there a PCI Requirement for shuffling digits while accepting PIN?

The following image shows a PIN entry device which shuffles the digits. . via twitter I've seen this question, but it doesn't cover why companies are still doing this. I looked at the POS PIN Entry ...
2
votes
1answer
78 views

Using browser XMLHttpRequest to initiate credit card transaction with processor?

I have a website where people can make purchases. The entire website is served with https. On the first page, I accept user profile data and generate a random ID for my client and store that in my ...
0
votes
0answers
45 views

PCI Compliance Self Assessment Verification - Third Parties

I am currently working for an Org which provide access to third parties to issue Credit Cards to their customer. We act as a supplier to these third parties for credit card services. My Question ...
0
votes
0answers
37 views

Does PCI-DSS requirement 10 (“track and monitor all access to … card holder data”) apply if I am not storing card holder data?

Requirement 10 states: Track and monitor all access to network resources and card holder data I find this a little vague and I have two questions. If I don't store card holder data - do I just need ...
0
votes
0answers
88 views

Are AWS security groups enough to segment network and reduce PCI scope?

I was reading this paper https://d1.awsstatic.com/whitepapers/pci-dss-scoping-on-aws.pdf It shows this image Am I correct in saying that - as long as instances have proper security groups that ...
7
votes
1answer
123 views

Which self assessment questionairre should I use for PCI DSS compliance

My system is passed card data securely over HTTPS from an upstream system. The upstream system captures information via telephone input. This telephone input is sent to us, to invoke payments via ...
0
votes
1answer
368 views

Can AWS KMS be used for both KEK and DEK for PCI DSS?

Right now we're using our own built-in solution based on SSS, and we want to switch to KMS. How far can we go? Can we use AWS' KMS for both the KEK and the DEK?
0
votes
0answers
38 views

are there PCI DSS (or equivalent) requirements for user-interface security for cardholders?

The PCI DSS requirements around account security (password strength, password changes, etc.) all seem to apply to system users who have access to cardholder data. Are there any industry standards ...
1
vote
4answers
1k views

Are PCI DSS standard requirements regarding TLS applicable only to customer facing webs or to whole even internal networks?

I have found Are You Ready for 30 June 2018? Saying Goodbye to SSL/early TLS article that says TLS 1.0 should be disabled: 30 June 2018 is the deadline for disabling SSL/early TLS and implementing ...
1
vote
1answer
230 views

Paypal and PCI Compliance

I currently manage a few of my client's websites on a couple shared hosting providers "A2Hosting" and "Interserver". My client wants to make a simple webstore and accept payments from said webstore. I ...
2
votes
0answers
181 views

PCI 8.6.1 - Minimum attempted login window?

PCI 8.6.1 says: Limit repeated access attempts by locking out the user ID after not more than six attempts. But says nothing about a minimum duration between the first failed login attempt and the ...
1
vote
1answer
58 views

PCI P2PE running as independent software on POS?

I have failed to find a good diagram or explanation of how a P2PE solution manifests itself within a point-of-sale (POS) device. Is it software running in a process on an embedded OS that knows how ...
1
vote
1answer
277 views

Can we write both encrypted text and plain text to the same file?

We have a requirement from customer to write payment transaction information to a text file. Of many lines of data per transaction, only one line contains cardholder information, which needs ...
1
vote
2answers
82 views

PCI Definition of “user”

PCI version 3 section 5.3 states Ensure that anti-virus mechanisms are actively running and cannot be disabled or altered by users, unless specifically authorized by management on a case-by-...
1
vote
1answer
80 views

XSS vulnerability in a module that doesn't exist

We did a vulnerability scan on our systems and received a vulnerability: Basit Submit Module Cross Site Scripting Vulnerability. We are not even aware of this application on our system. We filed a ...

1
2 3 4 5
13