Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pci-dss]

An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

0
votes
0answers
44 views

Collect Visible Credit Card Details & Remain PCI Compliant? [closed]

I need to make payments on behalf of clients to 3rd parties. This means I need to actually see the credit card details to input them into the 3rd parties' online payment facilities. What is the ...
0
votes
3answers
103 views

Are PCI DSS standard requirements regarding TLS applicable only to customer facing webs or to whole even internal networks?

I have found Are You Ready for 30 June 2018? Saying Goodbye to SSL/early TLS article that says TLS 1.0 should be disabled: 30 June 2018 is the deadline for disabling SSL/early TLS and implementing ...
1
vote
1answer
65 views

Paypal and PCI Compliance

I currently manage a few of my client's websites on a couple shared hosting providers "A2Hosting" and "Interserver". My client wants to make a simple webstore and accept payments from said webstore. I ...
2
votes
0answers
46 views

PCI 8.6.1 - Minimum attempted login window?

PCI 8.6.1 says: Limit repeated access attempts by locking out the user ID after not more than six attempts. But says nothing about a minimum duration between the first failed login attempt and the ...
1
vote
1answer
52 views

PCI P2PE running as independent software on POS?

I have failed to find a good diagram or explanation of how a P2PE solution manifests itself within a point-of-sale (POS) device. Is it software running in a process on an embedded OS that knows how ...
1
vote
1answer
138 views

Can we write both encrypted text and plain text to the same file?

We have a requirement from customer to write payment transaction information to a text file. Of many lines of data per transaction, only one line contains cardholder information, which needs ...
1
vote
2answers
70 views

PCI Definition of “user”

PCI version 3 section 5.3 states Ensure that anti-virus mechanisms are actively running and cannot be disabled or altered by users, unless specifically authorized by management on a case-by-...
1
vote
1answer
66 views

XSS vulnerability in a module that doesn't exist

We did a vulnerability scan on our systems and received a vulnerability: Basit Submit Module Cross Site Scripting Vulnerability. We are not even aware of this application on our system. We filed a ...
-2
votes
2answers
40 views

Does PCI Apply to PAN only?

I am trying to find out if a credit card application would be in-scope for PCI DSS. As part of the application process, customers can submit their credit card number (PAN) from another institution. No ...
0
votes
3answers
162 views

I have recovered my credit card PAN (6 chars masked) and expiration date on a merchant site, acceptable or not?

I have a credit card saved in X merchant. I only see the last 4 digits in the UI. I have launched a 3D secure payment transaction by using my saved card. Then I have noticed that even in the failed ...
0
votes
0answers
43 views

Usage of a self-signed certificate between Akamai and Azure

First of all, some background of what is proposed: The client's browser initialises request The request is resolved by public DNS (CNAME) to Akamai Edge The request is processed by Akamai accordingly ...
0
votes
1answer
25 views

Payment device compliance of PCI v2 AND PCIv3

Is there any known case of a pin pad device being compliant PCI v2 but by changing just a software component it becomes PCI v3 compliant?
0
votes
1answer
83 views

Outsourcing PCI data: Is this ok?

The organization I work for hold PCI-DSS compliance as merchants (we fill in SAQ-D). At the same time, due to document/payment verification processes, we request from our customers pictures of their ...
2
votes
2answers
61 views

For PCI compliance, is a central Auth required for domain and non-domain security principles?

We have a Saas offering that is hosted within our own data centers. Our software offering utilizes OpenLDAP as it backing for token auth security. Our operations team has asserted that for PCI ...
0
votes
1answer
78 views

Displaying complete credit card information to end user

I am using an ecommerce website that accepts and stores CC information. In the webpage, they show only the last 4 digits (which is perfectly fine). But when I intercept the request/response, I could ...
1
vote
1answer
149 views

PCI scan shows unknown vulnerabilities

Basit Submit Module Cross Site Scripting Vulnerability DCP-Portal Cross Site Scripting Bugs, CVE-2004-2511 CVE- 2003-1536 CVE-2004-2512 These two vulnerabilities have been identified in the scan ...
0
votes
0answers
25 views

anti-spoofing measures for SAQ C business with iPads/NCR silver

So I'm just wondering what types of anti-spoofing measures a SAQ-C business would need: https://www.pcisecuritystandards.org/documents/PCI-DSS-v3_2_1-SAQ-D_Merchant.pdf There's a lot of built in ...
0
votes
2answers
70 views

What are eligible service providers for SAQ-D in PCI DSS?

PCI SSC specifies that Self-Assessment Questionnaire D can be used by "eligible" service providers (source): Questionnaire D. For Service Providers: All service providers defined by a payment card ...
-1
votes
1answer
92 views

Solution to pci-dss 4.2?

PCI-DSS 4.2 Never send unprotected PANs by end-user messaging technologies (for example, e-mail, instant messaging, chat, etc.). Is there any way to send payment card data securely through some ...
0
votes
1answer
392 views

Dealing with OpenSSH CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6

How are you dealing with the OpenSSH vulnerabilities CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6 in a PCI server? OpenSSH doesn't seem to have a fix for this yet, but it fails ...
3
votes
1answer
147 views

PCI DSS minimum password strength equivalent in passphrase

The PCI DSS requirement 8.2.3 says: Passwords/passphrases must meet the following: Require a minimum length of at least seven characters. Contain both numeric and alphabetic characters. ...
2
votes
2answers
104 views

Can multiple SAQs be used for PCI compliance?

If we have a SAQ A compliant website for online signups, can we also use SAQ C-VT for phone orders? I'm thinking yes since they're separate payment channels but this aspect is new to me.
1
vote
1answer
88 views

Does End of Life Hardware comply with PCI DSS 3.2 if still under support from a Third-Party, Not the actual vendor?

Can some one help me to confirm that End of Life hardware complies with PCI DSS 3.2 or not? I only see requirements for software but no mention of hardware? Any guidance would be greatly appreciated. ...
1
vote
0answers
130 views

Does my eCommerce SaaS vendor need to be PCI DSS compliant?

I'm feeling super confused by the whole PCI DSS business. I'm working with a local, HK-based eCommerce SaaS vendor for my eCommerce website - they provide everything from web development to hosting, ...
0
votes
1answer
91 views

PCI-DSS scope: Using P2PE Compliant devices

We use EMV card readers to automate the payments at the entry and exit to our services. These card readers and the unattended payment terminals are fully PTS complaint and use P2PE encryption. Also, ...
5
votes
2answers
320 views

Are the sha1 hashes used by common ssh configurations insecure?

I got an automated PCI security test result that checked various server configurations. The automated test determined the server to be unsafe due to the use of sha1 algorithm in some elements of the ...
3
votes
3answers
137 views

What level of compliance do I need as a software vendor?

I am having a bit a difficult time trying to assess to what level my business needs to be PCI compliant. My business is developing eCommerce websites that are hosted by the client. The websites have ...
3
votes
1answer
69 views

PCI DSS 3.2 SAQ-A for card-not-present mail/telephone orders (MOTO)

What methods of processing payments fit into the definition of SAQ-A for orders made over the phone? I am confused because it says SAQ-A is valid when "All processing of cardholder data is entirely ...
0
votes
1answer
37 views

Do you need to validate compensating controls of a certified organization?

Our web application uses Google's G Suite Single Sign-on for authentication into our application. As part of writing documentation around compensating controls, the PCI DSS requires "Validation of ...
0
votes
0answers
79 views

Store Credit Card data in memory for using with native payment SDKs (iOS, Android)

I am implementing a Credit Card processing in mobile apps for iOS (Swift) and Android (Kotlin) using native SDK (SAQ A EP compliance level) We thought about: disabling clipboard for CC field ...
1
vote
1answer
85 views

PCI compliance dilemma

I am looking for advice on PCI compliance. I am being told that I am not currently PCI compliant although I am not sure if this is accurate. We outsource the payment management and card storage to a ...
0
votes
1answer
77 views

PCI-DSS scoping when there is no CDE

We are a merchant who processes over 2m transactions a year. However, we have outsourced all the payment functions to compliant 3rd party providers. Understand that PCI is about people, process and ...
0
votes
2answers
175 views

AWS serverless architecture compliance with PCI DSS 11.3 penetration testing segmentation

I am wondering how to comply with PCI DSS requirements (11.3) to test segmentation controls using penetration testing in AWS serverless architecture. We are using components such as AWS Lambda, AWS ...
0
votes
1answer
93 views

Angular application for PCI-DSS certification

I want to design Angular 6 application for PCI-DSS compliance. Is it a good idea to use it having in mind that this is a client-side application with a server back-end? Do you know if there any ...
0
votes
1answer
50 views

Is PCI - DSS required to store only card number

We need to save the credit card number in our database , but not the cvv. Should we be PCI - DSS compliant for this or some security measures is enough. After the save we will use that to call stripe ...
1
vote
2answers
147 views

Is taking CC info in plain HTML elements, but using a library like Stripe to tokenize PCI compliant?

I am building a site which will accept payments. I will be processing payments with either Stripe or Square. Stripe now has Stripe Elements, and Square has Square Payment Form. I have tried Square ...
1
vote
0answers
230 views

TLS1.2, weak cypher suites and PCI DSS V3.2.1 compliance

Are below cypher suites, which are part of TLSv1.2: TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA ...
0
votes
3answers
122 views

What is two full-length key components PCI DSS requirement 3.5.3

PCI DSS requirement 3.5.3 3.5.3 Store secret and private keys used to encrypt/decrypt cardholder data in one (or more) of the following forms at all times: ............ As at least two full-length ...
0
votes
1answer
45 views

Only using TLS 1.1 or 1.2 is enough for PCI DSS compliance on transmission of cardholder data (point 4)?

I've read the description provideed on PCI DSS 3.2.1 for requierement 4, and I'm having a hard time understanding if it's required to have additional encryption on top of TLS 1.1 / 1.2 using a secure ...
-3
votes
2answers
253 views

Is PCI compliance required by law?

Is PCI compliance required by law? We are creating a website where we will accept customer card data and pass it to merchant API. Everywhere on the internet you will find PCI is required. But what ...
0
votes
1answer
218 views

AWS Load Balancer Response Header Apache Server Disclosure

I have a node.js environment deployed using AWS Elastic Beanstalk on an Apache server. I have run a PCI scan on the environment and I'm getting 2 failures: Apache ServerTokens Information Disclosure ...
1
vote
2answers
92 views

Log and file Auditing

I am going through this PCI compliance for the first time. I have some questions because it is not clear what they are expecting and maybe I am over thinking it. Question 1: 10.3.1 through 10.7 ...
1
vote
1answer
87 views

How to support search of data under PCI-DSS?

Suppose that the data in question is a card PAN. According to PCI-DSS, you have to store it with extra security (encrypt it before storing in database and store the secret key elsewhere with more ...
1
vote
2answers
132 views

Audio Recording of my Credit Card Info?

If I call into a call center to order a product or service, and they take my credit card - do I have any assurance they are not recording the phone call "for quality purposes" which includes my credit ...
1
vote
1answer
62 views

Backing up PCI data outside of the cardholder data environment

Assume a cardholder data environment (CHDE) is segregated appropriately, data in the environment is encrypted at rest and in transmission. We have a backup service that sits outside the CHDE. If we ...
1
vote
1answer
94 views

PCI Compliance Scan & Globalscape EFT Web App Cookies Not Marked Secure

I have a situation where we are performing external PCI compliance scans against our Globalscape EFT server. The scan is reporting: HTTP (443/tcp) - Web Application Cookies Not Marked Secure Per our ...
0
votes
2answers
208 views

PCI MFA (Multi-Factor Authentication)

Following this link: https://www.pcisecuritystandards.org/pdfs/Multi-Factor-Authentication-Guidance-v1.pdf All I understand is that: The intent of multi-factor authentication (MFA) is to provide a ...
0
votes
1answer
782 views

Display Full Credit Card Number and PCI compliance

I've been reading through PCI compliance rules to see if it is ever PCI compliant to display the full credit card number on a webpage to a user. I've found some info about paper receipts and rules ...
0
votes
1answer
102 views

Logging requirement in PCI DSS for in house application

Recently we had an PCI Gap assessment, and the auditor asked as to show the application log, but we had very basic application log that only stores events and any exception. But auditor told us that ...
1
vote
1answer
61 views

Is a bank's affiliate that provides services to the bank issuer required to show compliance or certification to PCI DSS

Is a bank's affiliate that provides services to the bank issuer required to demonstrate compliance or certification to PCI DSS? If so, how is this typically done?