Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pci-dss]

An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

0
votes
1answer
59 views

Outsourcing PCI data: Is this ok?

The organization I work for hold PCI-DSS compliance as merchants (we fill in SAQ-D). At the same time, due to document/payment verification processes, we request from our customers pictures of their ...
2
votes
2answers
49 views

For PCI compliance, is a central Auth required for domain and non-domain security principles?

We have a Saas offering that is hosted within our own data centers. Our software offering utilizes OpenLDAP as it backing for token auth security. Our operations team has asserted that for PCI ...
0
votes
1answer
65 views

Displaying complete credit card information to end user

I am using an ecommerce website that accepts and stores CC information. In the webpage, they show only the last 4 digits (which is perfectly fine). But when I intercept the request/response, I could ...
1
vote
1answer
142 views

PCI scan shows unknown vulnerabilities

Basit Submit Module Cross Site Scripting Vulnerability DCP-Portal Cross Site Scripting Bugs, CVE-2004-2511 CVE- 2003-1536 CVE-2004-2512 These two vulnerabilities have been identified in the scan ...
0
votes
0answers
23 views

anti-spoofing measures for SAQ C business with iPads/NCR silver

So I'm just wondering what types of anti-spoofing measures a SAQ-C business would need: https://www.pcisecuritystandards.org/documents/PCI-DSS-v3_2_1-SAQ-D_Merchant.pdf There's a lot of built in ...
0
votes
2answers
40 views

What are eligible service providers for SAQ-D in PCI DSS?

PCI SSC specifies that Self-Assessment Questionnaire D can be used by "eligible" service providers (source): Questionnaire D. For Service Providers: All service providers defined by a payment card ...
-1
votes
1answer
78 views

Solution to pci-dss 4.2?

PCI-DSS 4.2 Never send unprotected PANs by end-user messaging technologies (for example, e-mail, instant messaging, chat, etc.). Is there any way to send payment card data securely through some ...
0
votes
1answer
161 views

Dealing with OpenSSH CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6

How are you dealing with the OpenSSH vulnerabilities CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6 in a PCI server? OpenSSH doesn't seem to have a fix for this yet, but it fails ...
3
votes
1answer
67 views

PCI DSS minimum password strength equivalent in passphrase

The PCI DSS requirement 8.2.3 says: Passwords/passphrases must meet the following: Require a minimum length of at least seven characters. Contain both numeric and alphabetic characters. ...
2
votes
2answers
80 views

Can multiple SAQs be used for PCI compliance?

If we have a SAQ A compliant website for online signups, can we also use SAQ C-VT for phone orders? I'm thinking yes since they're separate payment channels but this aspect is new to me.
1
vote
1answer
43 views

Does End of Life Hardware comply with PCI DSS 3.2 if still under support from a Third-Party, Not the actual vendor?

Can some one help me to confirm that End of Life hardware complies with PCI DSS 3.2 or not? I only see requirements for software but no mention of hardware? Any guidance would be greatly appreciated. ...
1
vote
0answers
118 views

Does my eCommerce SaaS vendor need to be PCI DSS compliant?

I'm feeling super confused by the whole PCI DSS business. I'm working with a local, HK-based eCommerce SaaS vendor for my eCommerce website - they provide everything from web development to hosting, ...
0
votes
1answer
84 views

PCI-DSS scope: Using P2PE Compliant devices

We use EMV card readers to automate the payments at the entry and exit to our services. These card readers and the unattended payment terminals are fully PTS complaint and use P2PE encryption. Also, ...
5
votes
2answers
216 views
+50

Are the sha1 hashes used by common ssh configurations insecure?

I got an automated PCI security test result that checked various server configurations. The automated test determined the server to be unsafe due to the use of sha1 algorithm in some elements of the ...
3
votes
3answers
111 views

What level of compliance do I need as a software vendor?

I am having a bit a difficult time trying to assess to what level my business needs to be PCI compliant. My business is developing eCommerce websites that are hosted by the client. The websites have ...
3
votes
1answer
40 views

PCI DSS 3.2 SAQ-A for card-not-present mail/telephone orders (MOTO)

What methods of processing payments fit into the definition of SAQ-A for orders made over the phone? I am confused because it says SAQ-A is valid when "All processing of cardholder data is entirely ...
0
votes
1answer
34 views

Do you need to validate compensating controls of a certified organization?

Our web application uses Google's G Suite Single Sign-on for authentication into our application. As part of writing documentation around compensating controls, the PCI DSS requires "Validation of ...
0
votes
0answers
68 views

Store Credit Card data in memory for using with native payment SDKs (iOS, Android)

I am implementing a Credit Card processing in mobile apps for iOS (Swift) and Android (Kotlin) using native SDK (SAQ A EP compliance level) We thought about: disabling clipboard for CC field ...
1
vote
1answer
76 views

PCI compliance dilemma

I am looking for advice on PCI compliance. I am being told that I am not currently PCI compliant although I am not sure if this is accurate. We outsource the payment management and card storage to a ...
0
votes
1answer
74 views

PCI-DSS scoping when there is no CDE

We are a merchant who processes over 2m transactions a year. However, we have outsourced all the payment functions to compliant 3rd party providers. Understand that PCI is about people, process and ...
0
votes
2answers
100 views

AWS serverless architecture compliance with PCI DSS 11.3 penetration testing segmentation

I am wondering how to comply with PCI DSS requirements (11.3) to test segmentation controls using penetration testing in AWS serverless architecture. We are using components such as AWS Lambda, AWS ...
0
votes
1answer
65 views

Angular application for PCI-DSS certification

I want to design Angular 6 application for PCI-DSS compliance. Is it a good idea to use it having in mind that this is a client-side application with a server back-end? Do you know if there any ...
0
votes
1answer
43 views

Is PCI - DSS required to store only card number

We need to save the credit card number in our database , but not the cvv. Should we be PCI - DSS compliant for this or some security measures is enough. After the save we will use that to call stripe ...
1
vote
2answers
128 views

Is taking CC info in plain HTML elements, but using a library like Stripe to tokenize PCI compliant?

I am building a site which will accept payments. I will be processing payments with either Stripe or Square. Stripe now has Stripe Elements, and Square has Square Payment Form. I have tried Square ...
1
vote
0answers
152 views

TLS1.2, weak cypher suites and PCI DSS V3.2.1 compliance

Are below cypher suites, which are part of TLSv1.2: TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA ...
0
votes
3answers
91 views

What is two full-length key components PCI DSS requirement 3.5.3

PCI DSS requirement 3.5.3 3.5.3 Store secret and private keys used to encrypt/decrypt cardholder data in one (or more) of the following forms at all times: ............ As at least two full-length ...
0
votes
1answer
41 views

Only using TLS 1.1 or 1.2 is enough for PCI DSS compliance on transmission of cardholder data (point 4)?

I've read the description provideed on PCI DSS 3.2.1 for requierement 4, and I'm having a hard time understanding if it's required to have additional encryption on top of TLS 1.1 / 1.2 using a secure ...
-3
votes
2answers
207 views

Is PCI compliance required by law?

Is PCI compliance required by law? We are creating a website where we will accept customer card data and pass it to merchant API. Everywhere on the internet you will find PCI is required. But what ...
0
votes
1answer
168 views

AWS Load Balancer Response Header Apache Server Disclosure

I have a node.js environment deployed using AWS Elastic Beanstalk on an Apache server. I have run a PCI scan on the environment and I'm getting 2 failures: Apache ServerTokens Information Disclosure ...
1
vote
2answers
88 views

Log and file Auditing

I am going through this PCI compliance for the first time. I have some questions because it is not clear what they are expecting and maybe I am over thinking it. Question 1: 10.3.1 through 10.7 ...
1
vote
1answer
73 views

How to support search of data under PCI-DSS?

Suppose that the data in question is a card PAN. According to PCI-DSS, you have to store it with extra security (encrypt it before storing in database and store the secret key elsewhere with more ...
1
vote
2answers
108 views

Audio Recording of my Credit Card Info?

If I call into a call center to order a product or service, and they take my credit card - do I have any assurance they are not recording the phone call "for quality purposes" which includes my credit ...
1
vote
1answer
53 views

Backing up PCI data outside of the cardholder data environment

Assume a cardholder data environment (CHDE) is segregated appropriately, data in the environment is encrypted at rest and in transmission. We have a backup service that sits outside the CHDE. If we ...
1
vote
1answer
80 views

PCI Compliance Scan & Globalscape EFT Web App Cookies Not Marked Secure

I have a situation where we are performing external PCI compliance scans against our Globalscape EFT server. The scan is reporting: HTTP (443/tcp) - Web Application Cookies Not Marked Secure Per our ...
0
votes
2answers
171 views

PCI MFA (Multi-Factor Authentication)

Following this link: https://www.pcisecuritystandards.org/pdfs/Multi-Factor-Authentication-Guidance-v1.pdf All I understand is that: The intent of multi-factor authentication (MFA) is to provide a ...
0
votes
1answer
632 views

Display Full Credit Card Number and PCI compliance

I've been reading through PCI compliance rules to see if it is ever PCI compliant to display the full credit card number on a webpage to a user. I've found some info about paper receipts and rules ...
0
votes
1answer
84 views

Logging requirement in PCI DSS for in house application

Recently we had an PCI Gap assessment, and the auditor asked as to show the application log, but we had very basic application log that only stores events and any exception. But auditor told us that ...
1
vote
1answer
57 views

Is a bank's affiliate that provides services to the bank issuer required to show compliance or certification to PCI DSS

Is a bank's affiliate that provides services to the bank issuer required to demonstrate compliance or certification to PCI DSS? If so, how is this typically done?
1
vote
0answers
209 views

Is this code as insecure as it looks? [closed]

The company I work for is looking for a payment processor. Ideally we want a fully and seamlessly integrated solution. I came across this from one of the recommended companies I had to look in to ...
3
votes
2answers
772 views

Does PCI-DSS password guidance apply to service accounts?

A service account is a user account created for the sole purpose of running an application. For example, an online banking web site may have a single service account under which the code runs. ...
-1
votes
1answer
66 views

Question about saving credit card info on PW reset [PCI]

I work for a retail organization with a large ecommerce presence. We allow our customers to store CC information for easy check-out, like many retailers. Currently we remove all stored CC ...
1
vote
3answers
624 views

Storing credit card numbers for enterprise payments

There is a business requirement to store credit card numbers on behalf of end users in the enterprise for the use cases below. Currently these users store credit card numbers in insecure locations ...
0
votes
1answer
94 views

PCI Compliance and Card Data Transmit

I have read that PCI enforces the merchants to store first six and last four digits are the maximum number of digits that may be displayed/stored. I am trying to find what is required in regards to ...
2
votes
0answers
88 views

PCI Compliance and Git

We are currently moving to get a ci\cd pipeline running on Gitlab. Our current set up is we have a non-production and a production environment on separate networks. This reduces the PCI scope to just ...
2
votes
2answers
591 views

TLS1.0 deprecation and PCI DSS requirements

It won't be easy) As you know there are new PCI DSS requirements after 30 June which say we shouldn't use "SSL/early TLS". But also there is the comments that merchants could save TLS 1.0 but with ...
1
vote
1answer
71 views

if PCI DSS requires encrypted storage of credit cards, what are requirements for storing the decryption key?

https://www.pcisecuritystandards.org/documents/PCIDSS_QRGv3_2.pdf requires that you encrypt stored credit card information -- for example, if you're an online merchant like Amazon that allows repeat ...
-2
votes
1answer
94 views

How to force authentication over HTTPS - Wordpress

During our last PCI scan, we received these 2 fail points: "Basic Authentication over HTTP" and "Web Page Transmits Login Credentials Without Encryption." Both were on Port 2077. Though our ...
3
votes
5answers
420 views

PCI compliance requirements when acting as a pass-through for credit card details

I'm working for a startup and we generate prepaid Mastercards from a card issuer. In our database we save a card reference id, not the 16 digit PAN or CVC. Later we do an API to the card issuer to get ...
3
votes
2answers
2k views

How many rounds should be used to hash card numbers?

We want the ability for payments made without logging in using one of their saved payment methods to be associated with the saved payment method. E.g. if they buy a recurring subscription to magazine ...
4
votes
1answer
91 views

Can a MAC be used as an irreversible PCI Token?

I'm looking at implementing a PCI token generation process based on a MAC code obtained from the PAN. This would be an irreversible token. The method I have in mind seems OK to me, but I'm not quite ...