Questions tagged [pci-dss]
An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.
681
questions
24
votes
3
answers
5k
views
Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?
We have recently developed a web application with a RESTful API backend. This web app need to have a certain security certification (something called PCI-DSS), and thus it is being scanned ...
- 343
2
votes
1
answer
68
views
Can CVV be input in a standard web site? The site doesn't store it
On my website, payments are done using a PCI-compliant 3rd partner. If the client agrees, I store a TOKEN of the card (returned by the PCI partner).
I want to make a new payment with CVV for the ...
- 123
1
vote
1
answer
53
views
interchangeable IDs for login under PCI DSS like Facebook and Twitter
Is using multiple interchangeable IDs a PCI DSS complaint? Facebook and Twitter uses the same method for sign in.
multiple interchangeable IDs such as sign in with email or mobile or username.
- 113
1
vote
1
answer
127
views
PCI DSS 4.0 - Are SSH tunnels and gateways doomed?
I won't lie, I am not a security expert and I am likely one of them guys in them companies whom working life proficiency is to slowly become little annoying. I work for a company complying with PCI ...
- 11
0
votes
0
answers
73
views
PCI-DSS Compliance: SSL Tunneling Credit Card Information Through A HTTPS Mobile/Residential Proxy Service to A Destination Service
If a PCI compliant service decides to SSL-Tunnel credit card information via an independent residential/mobile proxy service to a destination payment service, would this protocol still be PCI ...
1
vote
2
answers
607
views
Can I use GitHub and be PCI DSS 4.0 compliant?
Is it possible to use any remote DVCS (GitHub, Bitbucket, etc.) with PCI DSS or should I host Git on my own server?
The repo obviously doesn't store any sensitive CHD information and I do have my own ...
- 513
2
votes
1
answer
165
views
How to Approach CVEs Marked as "DISPUTED" and "WON'T FIX" in PCI-DSS Pentest
When conducting penetration testing in a PCI-DSS compliance context, we found a known security vulnerability that's identified by a CVE number.
In this case, the finding in question is CVE-2016-20012, ...
- 21
0
votes
1
answer
113
views
PCI compliance - use of ANSI X9.17 for export keys
we have a concern about a key export. We completed the migration to Key Block LMK in our environment (with HSM Thales 10K). Now, we have to exchange keys with third-parties that still use Keys in ...
- 11
1
vote
1
answer
87
views
Encrypt communication between microservices in PCI DSS env
I have a payment gateway application which will be used to process payment transactions hosted on Kubernetes cluster. Total of 4 microservices will be used to communicate using REST API and Kafka. Is ...
- 151
1
vote
0
answers
47
views
PCI requirements for iPaaS organisations
My organisation acts as a b2b cloud integration platform essentially taking data from one SaaS API and posting it to another.
The data that is moved between the SaaS applications is end user ...
- 11
0
votes
1
answer
64
views
PCI-DSS Compliance
Recently I had to implement a website that had to be PCI-DSS compliant.
I am only transferring card details over SSL (encrypted with a random RSA 2048 key generated each time, as well.) The data is ...
0
votes
0
answers
73
views
Which documents may be used to demonstrate compliance with requirement 12.8.2 of PCI DSS 3.2.1?
Does a PCI AoC substitute the written agreement that the PCI DSS requirement 12.8.2 requests?
If not, what is the best way to comply?
1
vote
1
answer
91
views
Is LINKT non-PCI compliance and if so how do I report it
I have received an email from LINKT (part of LendLease) stating I need to update my credit card details. In this email it says "...details such as expiry date or CVV might be saved incorrectly or ...
- 223
-1
votes
1
answer
78
views
Does PCI DSS allows/restrict bulk sending of cards?
Does PCI DSS allows/restrict bulk sending of cards? eg: Im buying gift cards for my 200 employees, can I have them delivered to my HR?
Are there addendums or restrictions on this?
- 119
13
votes
2
answers
4k
views
Validating and storing credit card data for retrieval later
I need to validate and store credit card information (name, card number, expiration date, CVC) for retrieval at a later date. Once retrieved, the data will be used for manual processing on a separate ...
- 231
2
votes
3
answers
542
views
How do companies like Uber and Paypal store card details? Is it possible to offer PCI compliance whilst saving credit card details locally?
I know there's a question that's been already asked but it's a decade old so wanted to get an up to date answer...
It's mentioned quite often that the CVV number should never be stored, but this must ...
- 123
0
votes
3
answers
114
views
PCI Card Number Definition [closed]
We are using a truncation strategy to eliminate card numbers. In order to develop, I need the original pre-truncated data files. The test environment is not allowed to have live card numbers. ...
- 101
0
votes
3
answers
1k
views
How to check validity of a PCI DSS Attestation of Compliance certificate?
I've been sent a certificate of compliance with PCI DSS (v. 3.2.1) in the form of a PDF. In it company A (issuer) claims that company B passed a formal assessment and is a level 2 merchant.
What ...
- 145
0
votes
1
answer
71
views
DCP-Portal Vulnerability
This vulnerability is from a third party reviewer for PCI scans. I am stuck for months and can't figure this out. I already used sanitation to my page and it still fail the PCI scanning. I am starting ...
- 1
3
votes
1
answer
377
views
Does "row-level security" actually serve a security purpose?
Row-level security is often an industry requirement in secure environments, such as those dealing with payment cards.
It's supported by most major relational databases, including PostgreSQL, Microsoft ...
- 5,438
-1
votes
1
answer
250
views
Encrypting card data at application layer over TLS (MasterCard)
I found an article from MasterCard's blog stating:
The transport between client applications and Mastercard is secured
using TLS/SSL, which means data are encrypted by default when
transmitted across ...
- 101
1
vote
1
answer
69
views
VM Hosting requirement for a Virtual Terminal application in SAQ-C-VT
We are a merchant that do exclusively MOTO transactions over the phone. To capture credit card information, our sales agent (on their PCs) uses a browser to access an internally developed ASP.NET ...
- 111
0
votes
2
answers
129
views
PCI : scope debate : API consumers
The Problem
I have two systems.
System A - E-commerce application that handles (does not store cc) customer credit data during purchase.
System B - Invoicing system for these transactions (does store ...
- 103
0
votes
2
answers
172
views
PCI DSS -- eWallet Not storing just displaying Virtual PAN
I have an eWallet application that lets the user (owner of the Virtual Visa) see his virtual card information if he wants to make an online purchase.
We are not storing the credit card data in our ...
- 1
1
vote
2
answers
444
views
What exactly are the characteristics of TLS required by PCI DSS and which reference describes these?
I am quite familiar with the ROC but am not a QSA.
PCI definition of strong cryptography make references to choosing your own standard and follow that, for example; if I followed NIST i.e. TLS as ...
- 341
1
vote
1
answer
3k
views
Are virtual credit cards in scope for PCI Compliance?
My company is using virtual credit cards and since we are PCI compliant (and want to be in the future) I was wondering about the requirements of storing/processing and transmitting PAN numbers of ...
- 329
0
votes
2
answers
270
views
can HSTS be considered as a remediation for not using secure flag for a pci dss auditor [duplicate]
can HSTS be considered asa remediation for the vulneraberabity "cookies are not protected by secure flag" for a PCI DSS auditor?
0
votes
1
answer
175
views
PCI scope "Encrypted cardholder data that is accessible to an entity that also has access to the decryption key"
I have a question related to this FAQ:
https://pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/How-does-encrypted-cardholder-data-impact-PCI-DSS-scope?q=how+does+encrypted+data+impact+...
- 113
0
votes
2
answers
408
views
How does a card issuer comply with PCI if they have to print PANs in clear text?
I read PCI DSS, and it's not very clear in which contexts you can have the PAN in cleartext. One could think in no context, but that is impossible. You need it in clear text of course to print it ...
- 113
0
votes
2
answers
181
views
PCI DSS Compliance and Firewalling Dynamic Hosts with MITM Certificates
Question
Would using a firewall MITM capability to inspect all HTTPS web requests be against PCI compliance/rules?
Further Info
We have an issue where we need to allow access to some HTTPS sites on ...
- 101
2
votes
1
answer
189
views
PCI & e-banking sensitive information tokenization/encryption/obfuscation - Which fields require to be secured?
According to PCI standard all businesses that store, process or transmit payment cardholder data must be PCI Compliant.
Taking into account that we are talking about a bank, fields like card number ...
- 21
1
vote
1
answer
146
views
Do I need to keep production Docker/container images?
Context
My company is developing a SaaS solution that needs to conform to PCI-DSS L1 for sure, and possibly FedRAMP and other frameworks later.
We can do continuous deployment with feature flagged/...
- 13
12
votes
4
answers
4k
views
How does collecting sensitive data using iframes increase security?
So this approach seems to be rather popular, particularly among payment processors that provide javascript integrations.
The added layer of security that "fields in iframe" brings also ...
- 222
0
votes
1
answer
213
views
SSH and PCI on Insecure, Dirty Side
Does current PCI code require SSH connections be restricted to enumerated (specific) client IP addresses on the unsecure, dirty side? Isn't that outside the scope of the PCI code?
- 23
2
votes
1
answer
214
views
is there a two developer minimum for companies seeking PCI compliance?
I'm doing a questionnaire for PCI compliance and one of the questions (Yes / No / Not Applicable) is as follows:
All custom application code changes are reviewed (either using manual
or automated ...
- 1,726
0
votes
1
answer
534
views
PCI Compliance and multi tenancy?
I am developing a Multi-tenant application to allow tenants to open an e-commerce shop (similar to Shopify). We are hosted on AWS.
At this point there will be under 20,000 transactions in the first ...
- 1
1
vote
1
answer
326
views
file-integrity monitoring tools for PCI compliance
A former employer of mine has reached out to me to assist them with PCI certification (I guess I'll be getting a 1099-NEC from them next year as a result). Here's the point I'm at in the questionnaire:...
- 1,726
1
vote
0
answers
119
views
Possibility of EMVCO 3DS Authentication Decoding [closed]
I bumped across a request via Traffic analysis through Burp Suite Proxy & it looked like a 3DS Authentication.
Sample below:
My question was if this authentication could be intercepted, decoded ...
- 1,600
6
votes
1
answer
810
views
PCI Compliance Password time to die change requirement
In the PCI DSS3 requirements it states that the user must change their password every 90 days, how are banks in the UK getting around this requirement? Is it because of 2FA?
As a new business we are ...
- 163
0
votes
0
answers
24
views
What types of businesses are allowed to store SAD and in particular CVV data? [duplicate]
There must be some kind of business that requires the use of sensitive authentication data (SAD) data. Could someone point me in the right direction on the requirement for the storage of that data?
- 11
1
vote
2
answers
502
views
SAQ-A vs SAQ-D Scope
I've received notice from our risk management group that they believe our website falls in scope for SAQ-D.
We utilize third party vendors for all of our payment processing - and on the website ...
- 11
0
votes
2
answers
270
views
PCI DSS Protectecting Card Data Elements when Transmitting PAN
I'm currently working on a mobile application that will need to transmit a customers full card data to an internal API that will then transmit the information to an external API owned by a payment ...
- 103
0
votes
1
answer
405
views
File Integrity Monitoring via Syslog-ng or agentless - is it possible?
I am involved in a project which deals with PCI-DSS compliance. Particularly, there is a requirement to implement FIM (File Integrity Monitoring) for critical devices.
Within these devices, there are ...
- 69
2
votes
1
answer
1k
views
PCI Compliance for developers accessing a production database for support
As a developer, when an Incident comes in and reaches Tier 3 support (The development team), how can the developers get access to query the Production Database, while remaining PCI Compliant? I'm ...
- 21
2
votes
0
answers
351
views
Grace period for users after re-enabling account disabled by PCI-DSS 8.1.4?
We have an automated system to disable user accounts that have seen no logins for 90 days. We also have a process of re-enabling such accounts (at the behest of the affected users), and this process ...
- 343
3
votes
1
answer
336
views
PCI-DSS Level 1 requirement for Intrusion Detection and Prevention on AWS API Gateway and AWS Lambda
Our architecture is based on the best practices for PCI-DSS on AWS
Amazon WAF -> API Gateway -> AWS Lambda
The lambda's are running within a VPC and the SG / Firewall and segmentation have been ...
- 153
1
vote
2
answers
152
views
Can biometric vectors (i.e. fingerprint vector) be considered as Sensitive Authentication Data (SAD) in PCI?
I am designing a system that uses a certain biometric vector as a secondary user identification step before authorizing a payment. My system does not handle payment card details, rather the payment ...
- 135
0
votes
2
answers
693
views
Security camera NVR is making my network not PCI compliant. What can I do?
So family operates a small bar/lounge in Florida and I work for them part time as a bar back / IT technician. For the past couple months we have been trying to become pci compliant. However, we keep ...
0
votes
1
answer
115
views
Monitoring User (developer) interaction
I'm looking for a "tamper proof" way, if there is such a thing, to monitor what a developer/engineer does on a given system.
To expand a bit more about this, we have several systems that run ...
- 101
2
votes
2
answers
373
views
Storing credit card information - encrypted at rest
A client is asking for a way so his app can receive credit card information and store them. He needs this to process scheduled payments from his clients.
I told him that I can build a asymmetrical (...
- 73