Questions tagged [pci-dss]

An acronym for Payment Card Industry (PCI) Data Security Standard (DSS). A set of rules and policies for protecting information related to card based financial instruments.

Filter by
Sorted by
Tagged with
3
votes
2answers
3k views

How many rounds should be used to hash card numbers?

We want the ability for payments made without logging in using one of their saved payment methods to be associated with the saved payment method. E.g. if they buy a recurring subscription to magazine ...
4
votes
1answer
102 views

Can a MAC be used as an irreversible PCI Token?

I'm looking at implementing a PCI token generation process based on a MAC code obtained from the PAN. This would be an irreversible token. The method I have in mind seems OK to me, but I'm not quite ...
0
votes
1answer
419 views

How different are Lynis and Wazuh solutions? [closed]

It seems both Cisofy's Lynis and Wazuh's OSSEC share a lot of functionalities. I'm completely newbie on both tools and yet I need to pick one (or both) to help achieve PCI DSS Compliance. Any thoughts?...
1
vote
1answer
361 views

Will Enabling TLS 1.2 and disabling older protocols on Windows Servers have any impact on desktops?

I want to know what the impact would be if I were to enable TLS 1.2 on Windows Servers and disabled older protocols. I enabled TLS 1.2 on my Windows 7 Laptop manually running the Microsoft Fix It ...
6
votes
3answers
210 views

As a security compliance professional, what should I do if I find that my employer has a PCI AOC but is not compliant?

I have an ethical dilemma. A couple of weeks ago, I accepted a security compliance role. For the past five years I have been working as a PCI QSA before accepting this role. In the short time that I ...
6
votes
3answers
357 views

If I'm PCI-DSS compliant, do I need to worry about GDPR?

Next month, the EU's General Data Protection Regulation (GDPR) takes effect. Our organization is already PCI-DSS compliant. Do we need to do anything additional to make sure we are consistent with ...
1
vote
0answers
31 views

Question regarding the impact of additional PTS firmware version to P2PE application and P2PE solution

I have a question regarding the impact of additional PTS firmware version to P2PE application and P2PE solution. Is additional PTS approved firmware version subject to addition of POI device type? ...
3
votes
1answer
447 views

Network setup for PCI-DSS C-VT

Not sure if this is best here on information security or serverfault or Network Engineering. We have a company that takes telephone orders over the telephone using a virtual terminal. PCI-DSS 3.2 ...
1
vote
2answers
183 views

Emailing PAN securely?

Has anyone successfully implemented a PCI approved method of emailing PAN data? I know there are concerns managing all the PCI requirements in an email solution but is there anyone that has actually ...
1
vote
1answer
405 views

PCI DSS PenetrationTesting Requirement 11.3.4

I'm fairly new to PCI DSS and I'm confused over the requirement to perform pen-testing as per 11.3.4. as it states:- Are penetration-testing procedures defined to test all segmentation methods, ...
1
vote
1answer
977 views

PCI compliance for bank card system

There is a bank who has internal system working with card data preparation, generating PANs, and finally preparing personalization files that are sent to third party card manufacturer. The bank can ...
1
vote
1answer
843 views

How long should a JWT be valid in a PCI-DSS compliant service?

Is there any maximum value enforced or recommended by PCI-DSS for the expiration of the access and refresh JWT? If not enforced, what is an appropriate value to avoid problems during audits?
4
votes
1answer
67 views

When to complete PCI DSS Compliance Paperwork

I am working for a startup that will soon begin processing payments with Stripe. Looking at their documentation, it seems we will have to file an SAQ A, SAQ A-EP, or an SAQ D depending on our ...
1
vote
2answers
630 views

PCI Compliance ISP requirements

I am setting up a PCI compliance call center. I am wondering if my internet service provider has to be certified PCI compliant? I am only connecting to a cloud service that uses SSL and that cloud ...
3
votes
1answer
4k views

Is a TLS 1.2 certificate backwards compatible? [duplicate]

I have a site bound to a TLS v1.2 certificate. Can clients that only support TLS 1.0 or 1.1 still communicate over port 443 with my site? I.e., will the web server drop down to TLS 1.0 or 1.1 if it ...
1
vote
1answer
171 views

Shared host that is not a service provider, with no SAQ/AoC. Is compliance possible?

Shared web host says they are not a service provider and have no attestation of compliance or SAQ. But they say they are PCI compliant. According to SAQ, it would seem like I couldn't be compliant on ...
3
votes
2answers
360 views

Are external assets included in the 2018 TLS 1.0 PCI deprecation?

With the upcoming deprecation of TLS 1.0 for PCI compliance, I thought I'd confirm something: what categories of externally referenced assets (if any) could cause a compliance failure if their still ...
6
votes
2answers
237 views

How Should a Midsized Startup Approach Information Security and Compliance?

The situation: An established SaaS startup with <100 employees, a large development team and several self taught networks engineers. Our business involves handling both PII and payment data. As we'...
2
votes
3answers
471 views

PCI compliance when using credit card details on behalf of another person

My client emailed herself her credit card details and she has given me access to her email by sharing the username and password. She wants me purchase plane tickets, items, on her behalf using her ...
0
votes
1answer
685 views

SSL Certificates in PCI DSS compliance

I have come across the PCI DSS compliance which expects SSL certificates to comply with certain standards. I have come across this link which highlights : The latest PCI DSS 3.2 requires migration ...
0
votes
1answer
119 views

Is it safe to use an auto pay feature on my smart watch that stores card info?

(So guess what I got for Christmas...) While I do appreciate the tech and some of the features in the smart watch, I am skeptical of it's biggest feature -- the Pay feature which essentially ...
2
votes
1answer
206 views

Is SAQ A-EP possible on a shared web host?

Our provider is a shared web host, therefore we don't have any control over software, firewall or logs. Considering the following requirements, I was wondering if anyone knew whether it was even ...
2
votes
3answers
420 views

PCI - store card details offline

I work for a company that sends out mail/telephone order goods. Some customers have orders they receive every day, with different amounts. We have been asked a few times by various customers if we ...
3
votes
2answers
688 views

SAQ-D Service Provider without a CDE

We provide a shopping cart service with integrations to multiple third party payment processors (PayPal, Authorize.net, etc.) where all payment processing happens on their networks (i.e., no CC data ...
2
votes
1answer
258 views

PCI DSS compliant method to receive card data for a merchant with no electronic storage

The merchant in question has no electronic cardholder data storage. Currently they receive CHD (no CVV) in non-secure ways and store it on paper in order to execute payments via card-not-present POS ...
0
votes
2answers
137 views

Would one e breaking PCI compliance in this scenario?

First and foremost - I am not planning on going down the road of trying to adhere to PCI compliance myself, It's simply not worth the headache. I am however interested in how some companies manage to ...
0
votes
2answers
165 views

How to handle credit card information on my server [closed]

My company wants to start a subscription based website and I'm implementing it with a payment gateway. The problem is, this payment gateway doesn't give me any tools to encrypt the client's credit ...
4
votes
2answers
997 views

PIN delivery: do PCI DSS requirements prevent sending the PIN to an end-user's mobile phone?

Do PCI DSS requirements prevent processors from sending to endusers' mobile phones the PIN? I went through many PCI documents, such as the PCI security requirements 2.0 and this isn't mentioned. I'm ...
6
votes
2answers
431 views

Does PCI PIN Security allows keeping the PIN in-memory for a short period of time?

I've been asked to implement a page where a user can unblock her account by credit card number and PIN validation + some other method (e.g. SMS OTP) in a two-step process. The flow suggests ...
1
vote
1answer
118 views

PCI-DSS : Sending antivirus logs from private infrastructure to public cloud? [closed]

We are planning to build an environment where all the Linux machines in private infrastructures will send their ClamAV log files to ELK stack hosted in a public cloud for log analysis. Is this PCI ...
2
votes
2answers
495 views

Payment processing in Android

Assume that my company is PCI DSS complaint. I want to provide a custom view (in SDK library for Android) for payment processing to merchants who sell products via their Android mobile application. ...
4
votes
1answer
589 views

Storing customer credit card information for manual processing later

For a solution that we are developing for the hospitality industry, we need to save customer credit card information, and show this to the hotel for them to manually process the payment later. I have ...
3
votes
2answers
513 views

False acceptance rate in biometric authentication for sensitive information

Every type of biometric authentication will have a false acceptance rate, which is the likelihood that the system will incorrectly accept an access attempt by an unauthorized user. Of course, when ...
3
votes
2answers
157 views

What is the process to use previously-deployed POI devices in a PCI P2PE solution?

One question for the FAQ "What is the process to use previously-deployed POI devices in a PCI P2PE solution?" . In the following case, does "reload cryptographic keys" mean that should load POI's new ...
1
vote
2answers
1k views

PCI-DSS for Financial Institutions and Issuer

Here is the scenario: A financial institution outsourced all PCI-DSS related activities. Therefore (in theory), it does not store, transmit, or process credit/debit card data. It also issues debit ...
0
votes
1answer
88 views

Logs for staging servers

Is it required to have logs for staging servers for PCI DSS requirements where the real cards are not used in this environments.
1
vote
1answer
163 views

PCI - Backend Applications and SQL Injection

Currently pursuing PCI certification and our internal team is mandating that all inline SQL be moved to parameterized queries. No question this makes sense for web applications. I'm wondering about ...
2
votes
1answer
2k views

Should a PCI-DSS certification be renewed?

I did not find any mention of the need to renew a self-assesment (PCI DSS SAQ-A or SAQ-A-EP) in the PCI DSS documentation. There are mentions of renewal for assessors (to maintain their ...
0
votes
1answer
278 views

Good book on PCI DSS? [closed]

I need to upgrade my skills on PCI DSS Compliance. I'm looking for a couple of combo: one to cover everything in an extensive way (a sort on encyclopedia to keep as a reference) and a quick guide to ...
1
vote
2answers
213 views

Amazon AWS and PCI DSS [closed]

Does using AWS dedicated-hosts or dedicated instance will be compliant with PCI DSS requirement? Please refer to the comparison section: https://aws.amazon.com/ec2/dedicated-hosts/ Thanks.
3
votes
3answers
1k views

Whitelist ASV IP for PCI external scan

I'm using an external WAF (Cloudflare). My server firewall is setup to only allow connections from the WAF. Currently, I'm using McAfee Secure for the PCI compliance external vulnerability scan. Due ...
0
votes
2answers
203 views

Firewall and PCI DSS Requirement

I would like to ask about the first requirement of PCI DSS which is build and maintain a secure network. Is it required to have a physical firewall or it can be a software example using operating ...
1
vote
1answer
45 views

PCI DSS: Is Mirror/ Identical Server in Pentest or Scanning Scope

I am just wonder if I have a mirror/identical (high availability server) server in my CDE segment, is that mirror server need be in scanning scope? If it is not in the scope, in the scanning report ...
1
vote
2answers
90 views

Do I need to do a PCI Survey

We are using standalone payment terminals (Ingenico ICT220) over IP and our payment processor (heartland) insists we don't need to do any PCI SAQ or get scanning, they insist they will indemnify us if ...
4
votes
3answers
5k views

Does transmitting first 6 and last 4 digits of the card number and expire date require PCI DSS compliance?

If we transmit 16 digit card number from a service provider to my application then PCI DSS is applicable. But if we use (transmit/store) only the first 6 and last 4 digits of the card number and ...
4
votes
3answers
502 views

Using MFA to connect to windows shares on domain controller

I have a requirement to force MFA for all non-console administrative access to our Windows AD servers. I've sorted out log ins with RSA, but that does not prevent a domain admin from mapping a drive ...
1
vote
1answer
239 views

PCI DSS requirement 8.3.1

I have a question regarding this requirement, does even the non-CHD system need to use 2FA? Ex: When accessing CHD server it asks for 2FA, but do we need the system that accessing from to have 2FA as ...
1
vote
1answer
346 views

Required security for storing bank transactions, but not credentials

If I'm using an external bank data aggregation service to get user credit and banking transactions, but the external service itself is handling the process of collecting and managing banking ...
0
votes
1answer
132 views

Third party access and PCI DSS

Does giving access to third party to access the environment where the card holder data are passed against PCI DSS requirement? The third party will have access only to a particular directory where NO ...
0
votes
2answers
271 views

Would running different functions on virtual machines on the same server make me compliant with PCI DSS requirement 2.2.1?

I'm currently going through the PCI DSS requirements and wondered whether running different functions on virtual machines on the same server still make me compliant with the requirement below for PCI ...

1 2
3
4 5
13