An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

learn more… | top users | synonyms

0
votes
1answer
39 views

How Point-to-Point encryption eliminates PAN storing?

Encrypted Primary Account Numbers (PAN) are stored without any personal info. The intention is to tie it for the refunds purposes. To move to a PCI-DSS environment, a vendor recommends moving to P2PE ...
0
votes
1answer
72 views

HTTPS iFrame embedded in HTTP page - PCI implications?

I'm currently volunteering at a nonprofit. While researching something unrelated, I noticed that a $sisteragency was using an embedded iFrame to accept online donations. While the frame's source uses ...
-1
votes
1answer
37 views

Studying to become a ASV, need some guidence

I have completed the online training/exam to become an ASV (Approved Scanning Vendor) for my company. We currently have Nessus as our platform, and I am not feeling too great about it's capabilities. ...
0
votes
0answers
45 views

Handling Credit Card info in Source Code

Background Info I am using an API to make donation to charities (First Giving API). The API only supports credit card info for making a donation. Due to the requirements of the application, donors ...
3
votes
3answers
45 views

Boundaries of Personally Identifiable Information - PCI-DSS

I am attempting to ascertain the boundaries of personally identifiable information. For example does the combination of John and Doe equate to personally identifiable information since there could ...
1
vote
1answer
44 views

Call recording PCI-DSS issues

For a non-automated payment card entry system, if a caller is providing a payment card details over the phone to a call centre employee who confirms the number to the caller, does that mean the ...
4
votes
0answers
38 views

Major UK company seems to be handling customer & card data recklessly [duplicate]

A company I used to work for is passing customer's personal details as well as card data (number, expiration date, name, CVV2 and the contents of the magstripe thanks to a reader) through Windows XP ...
1
vote
0answers
30 views

Approved Certificate Authorities for certification/compliance with HIPAA, PCI etc

Are there any requirements in PCI or HIPAA, or other security standards that may impact general government, payment processing, healthcare, that would disqualify any CA vendors that are trusted by the ...
3
votes
1answer
25 views

ASV scan - What to expect from external scan services?

We've been asked to perform a vulnerability scan in our servers which process transactions with payment cards as a requirement for PCI compliance. PCI DSS mandates this scan must be done by a ASV. ...
2
votes
1answer
31 views

What is the difference between PCI-DSS compliance and certification?

PCI-DSS compliance and certification appears to be used interchangeably however it isn't clear what the differences are. For example if you are certified does it mean you are compliant and if you ...
3
votes
3answers
168 views

Creditcard store first six digits PCI reference

I need to store masked PAN with first six digits and last four digits along with the card expiry month and year. Is it safe to do it according to the PCI rules? Regarding four digits has been ...
3
votes
1answer
87 views

Unable to completely enforce password policy

PCI DSS has a few requirements regarding the password policy (like remember last four passwords, change password every 90 days, use at least seven numeric and alphabetic characters and more). These ...
2
votes
1answer
101 views

PCI DSS placement of puppet (or chef) server?

I'm puzzled as to whether I am allowed to set up a puppet server in a PCI DSS environment, and if I am, where should it be located? I was planning on installing it on gateway, and all the hosts would ...
1
vote
0answers
19 views

PCI-DSS Helping customers with a third-party booking service

My clients are able to pay for services through a website EXAMPLE.COM. Sometimes, a client will call on the phone looking to pay for services over the phone. I would like to use a device to visit ...
0
votes
1answer
50 views

Storing last 6 digits of payment card vs 4 digits

I am wondering what are the risks associated with storing last 6 digits of a payment card as compared to the last 4 digits. In addition, will it have implications on PCI DSS compliance?
0
votes
1answer
89 views

PCI check failing

I have had a customer come to me with a failed PCI compliance check with the failure apparently caused by an extension I develop. The scenario is that web page content is served by the extension but ...
1
vote
2answers
35 views

PA-DSS & DTMF application

If the payment application is not storing any credit card information, does it needs to be PA-DSS? The application takes the Credit card information using DTMF and pass-through via secure XML for ...
1
vote
0answers
34 views

SAQ D PCI Compliance for Custom Shopping Cart

We use a custom developed open-source e-commerce software. We are SAQ D and I am trying to figure out which of these requirements applies to our cart if: We aren't storing credit card information We ...
2
votes
1answer
60 views

PCI Scope, Tokens, and Processor APIs

A merchant receives a processor provided payment token in response to an authorization from an online order (for the sake of this question assume this part of the process has all its PCI t-s crossed ...
5
votes
3answers
813 views

Cardholder data segmentation for PCI compliance (3.2)

We are currently collecting card holder data in a segmented way. Our system is used by call center agants which I will refer to as channel B Over channel A (mobile carrier) we collect the first 8 ...
1
vote
1answer
59 views

PCI: Does CHD or SAD still need to be protected after implementing a P2PE solution?

The promise of a good (even certified) PCI P2PE v2 solution is that the merchant does not have access to the keys which encrypted the Card Holder Data (CHD) and the Sensitive Authentication Data (SAD) ...
3
votes
1answer
40 views

PCI definition of “store”

In the PCI DSS 3.1 requirements, the term "store" is used often. For example requirement 3.2 says "Do not store sensitive authentication data after authorization (even if encrypted)..." Does this ...
0
votes
2answers
157 views

How to prevent sysadmins tampering with code?

Let's say you have some sensitive user data you need to protect (e.g., for PCI compliance) and you have done this by having the server code encrypt it before storing it in a separate server where no ...
0
votes
1answer
36 views

What type of 'security scan' does a PCIDSS compliance check comprise?

Our firm processes CC information on an ad hoc basis. No cardholder data is ever recorded in any of our databases and we do not grant public access to any of our database or business application ...
0
votes
0answers
38 views

Data Model for a Tokenizing Data Storage System

Hashing Strategy for a Tokenizing Data Storage System We are designing the data model (storage at rest, in a database) for a PCI compliant data storage system using Amazon Web Services (AWS) and ...
7
votes
2answers
114 views

Is PCI-DSS Compliance Required with PayPal Donate/Payment Buttons on Websites?

Reading about PCI-DSS 3 recently: Would like confirmation what I am interpreting here - you need PCI-DSS SAQ-A to have credit card associated payment or donation URL links on a merchant's website? ...
3
votes
1answer
70 views

PCI DSS compliant without private VLAN

I understand that it may be a best practice to hide in-PCI-scope-elements like databases inside a VLAN without a public address and also strict firewall rules. However, my questions is: can ...
1
vote
1answer
78 views

PCI Penetration Testing - Does the whole infrastructure need to be retested on significant change?

The PCI SCC states the following in their penetration testing guidance: Per PCI DSS Requirements 11.3.1 and 11.3.2, penetration testing must be performed at least annually and after any ...
1
vote
2answers
49 views

Access Controls on employees handling credit card data

Employee has access to image format of full credit card data on an application (primary account number, cvv, expiry code, name). He copies from this application and enters manually to another ...
4
votes
1answer
139 views

Banks storing credit card data in plain text?

Are the banks authorized to keep plain text hard copies of full credit card data (Primary account number, CVV, Expiry code, Cardholder name)
1
vote
2answers
106 views

Credit card data sent as a plain image format [closed]

The full Account number data plus Personally Identifiable Information (PII) for a credit card is captured in a document that is scanned as an image for later processing. This image is then uploaded ...
3
votes
2answers
136 views

Firewall UDP Packet Source Port 53 Ruleset Bypass

I have a question regarding recent PCI DSS scan performed on our network. On some of the Windows 2008 servers (physical and VM), there is a risk found "Firewall UDP Packet Source Port 53 Ruleset ...
3
votes
2answers
167 views

Clarification of PCI DSS 3.1 requirement 6+8

I'm quite puzzled about the PCI requirements when it comes to session timeouts and scope definitions. The login is the end user/customer login to the public facing control panel in which they can ...
1
vote
1answer
64 views

Do I need PCI DSS compliance when using PayPal Express Checkout?

If I'm using PayPal Express Checkout on my website, am I required to be PCI DSS compliant? PayPal says "With Website Payments Standard, Online Invoicing, Express Checkout and Website Payments Pro ...
4
votes
1answer
53 views

ASV scan with reverse proxy

We are PCI compliant as a service provider, however our service port forwards some web traffic at TCP level. Customers use our PCI compliant service and can choose to upload a TLS/SSL certificate to ...
2
votes
2answers
80 views

How do I prevent extra javascript from being added into HTML kiosk in public space?

I'm planning a project which is to be PCI compliant, but I am stuck on a particular vulnerability and I can't think of a way to protect against it. The scenario is that there is a kiosk installed in ...
3
votes
2answers
124 views

How to not store the card during 3D Secure authentication, to be PCI DSS compliant?

I'm implementing a payment solution where the cardholder enters his card details on our own website. We need to use 3D Secure for extra authentication of the cardholder. Our payment gateway ...
4
votes
3answers
3k views

Should I disable TLS 1.0 on my servers?

The PCI Data Security Standard 3.1 recommends disabling "early TLS" along with SSL: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after June 30, ...
1
vote
1answer
37 views

Strong Cryptography in PCI PA-DSS

In PCI PA DSS document, the phrase “Strong Cryptography” is often repeated but I couldn’t find a clear definition for that. Is there any document or PCI standard for that?
1
vote
1answer
33 views

What PCI standard(s) a payment app (for Smartphones) should comply with in order to be approved by PCI SSC?

We are a company developing apps for Payment Service Provider(s) and in one of our apps Card Holders should enter payment Card data (such as PAN, PIN 2, CVV, Expiration Date) to do a CNP (Card Not ...
3
votes
1answer
54 views

Which SAQ form do I use for PCI DSS compliance?

I run a small business with a Prestashop e-commerce website that sends customers to Sagepay to make a payment using the Presto Chango Sagepay payment module. In my office I also have a one PC ...
1
vote
1answer
25 views

How to include third parties in PCI DSS SAQ

When filling in the SAQ for PCI compliance, how do you include requirements covered by a third party provider? Say you're using a PCI compliant VPS provider for example. Do you select 'yes' then ...
2
votes
1answer
203 views

Using a CDN to reduce PCI DSS scope

A common scenario for e-commerce credit card types of transactions is a website with a connection to a third party payment processor. For a number of reasons you might not want to use an iFrame or ...
1
vote
2answers
258 views

Validating security log configuration (rsyslog and syslog-ng) for PCI DSS 10.5

I work for a Level 1 merchant with annual onsite QSA audits, so this is a huge deal. PCI DSS 10.5 requires the entity under test to "Secure audit trails so they cannot be altered". In our Unix and ...
2
votes
2answers
96 views

PCI audits, TLS 1.0, and scoring

I'm new to security in a variety of ways. We have a PCI audit coming up soon. We've put together a risk mitigation/migration plan for TLS 1.0 and have submitted it to the auditors. My boss is ...
2
votes
1answer
62 views

PCI DSS 3.1 and Windows XP

I'm looking for some clarification on the effects of PCI DSS v3.1. In an consumer ecommerce context (e.g amazon.com), I'm assuming that customers attempting to make credit card purchases on the ...
2
votes
2answers
28 views

What constitutes submitting payment at a different address for PCI-DSS?

I am attempting to use TransArmor PCI Rapid Comply to verify compliance for my small business. At one point, I have two choices: 1) Customers submit payments at a different web address (i.e. ...
1
vote
2answers
44 views

Is it PCI-compliant/kosher to send a credit card number to a 3rd party sever from a mobile client?

I am building a mobile app, and part of the the functionality of the app is to place an order with a 3rd party. The 3rd party server accepts a credit card number string. Can I build a mobile client to ...
4
votes
3answers
407 views

Storing credit card information for later manual processing

I am rebuilding a clients eCommerce site using Wordpress and WooCommerce as the framework. Their current eCommerce site takes the credit card information and stores it for later manual processing. To ...
0
votes
1answer
263 views

PCI Logging Data Elements for Network Devices, Databases and Wireless Networking

What is the best way to figure out what exactly needs to be logged for Network Devices, Databases and Wireless Networking Devices? I'm not an expert in this area but I need to figure out what data ...