Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pci-scope]

The tag has no usage guidance.

0
votes
0answers
49 views

If only getting and storing BIN part of credit card number, should I comply with any PCI (or other) specification?

I have a fraud detection system. From the client side (browser) I want to receive the store BIN section of the card number (first 6 digits) and if possible also the last 4 digits Besides the above, ...
1
vote
2answers
122 views

Emailing PAN securely?

Has anyone successfully implemented a PCI approved method of emailing PAN data? I know there are concerns managing all the PCI requirements in an email solution but is there anyone that has actually ...
1
vote
1answer
239 views

PCI DSS PenetrationTesting Requirement 11.3.4

I'm fairly new to PCI DSS and I'm confused over the requirement to perform pen-testing as per 11.3.4. as it states:- Are penetration-testing procedures defined to test all segmentation methods, ...
1
vote
1answer
509 views

PCI compliance for bank card system

There is a bank who has internal system working with card data preparation, generating PANs, and finally preparing personalization files that are sent to third party card manufacturer. The bank can ...
4
votes
1answer
65 views

When to complete PCI DSS Compliance Paperwork

I am working for a startup that will soon begin processing payments with Stripe. Looking at their documentation, it seems we will have to file an SAQ A, SAQ A-EP, or an SAQ D depending on our ...
2
votes
3answers
163 views

PCI Compliance question from a merchant

I'm a new business that conducts online auctions for estate sales. When searching for software to use, I had no idea about PCI Compliance. My merchant account told me it was easy. It would be if the ...
1
vote
3answers
241 views

PCI - store card details offline

I work for a company that sends out mail/telephone order goods. Some customers have orders they receive every day, with different amounts. We have been asked a few times by various customers if we ...
3
votes
2answers
403 views

SAQ-D Service Provider without a CDE

We provide a shopping cart service with integrations to multiple third party payment processors (PayPal, Authorize.net, etc.) where all payment processing happens on their networks (i.e., no CC data ...
1
vote
1answer
99 views

PCI-DSS : Sending antivirus logs from private infrastructure to public cloud? [closed]

We are planning to build an environment where all the Linux machines in private infrastructures will send their ClamAV log files to ELK stack hosted in a public cloud for log analysis. Is this PCI ...
1
vote
1answer
44 views

PCI DSS: Is Mirror/ Identical Server in Pentest or Scanning Scope

I am just wonder if I have a mirror/identical (high availability server) server in my CDE segment, is that mirror server need be in scanning scope? If it is not in the scope, in the scanning report ...
1
vote
1answer
182 views

Credit card store first four and last four which PCI SAQ?

In our application, we only transfer cardholder data to a PCI DSS compliant service provider, and don't store it ourselves. We only store first four and last four digits of credit card number for ...
0
votes
1answer
2k views

PCI Consideration for HTTP Headers? [closed]

Recently, some of our servers were being flagged for not implementing proper HTTP headers in a Qualys scan. One of the sites that I visit regularly - http://pentestit.com has some good HTTP headers ...
0
votes
1answer
361 views

What compliance does my mobile application need?

We are going to develop an application for payment gateway which is already PCI DSS compliant, This application will be handling the payment through the API. My questions is is the application needs ...
3
votes
1answer
715 views

PCI scope when entering card details into browser

Suppose I have an ecommerce web site, hosted in Azure (or AWS). I will use a third party payment gateway that is fully certified as PCI level 1. All communication is done with TLS 1.1 or better. ...
2
votes
0answers
66 views

Compliance/ FCA regulations

First of all, please accept my apology for being ingnorant to compliance/FCA regulations as I have been digging out everywhere to get the answer of a very specific question: SCENARIO I am planning ...
0
votes
1answer
72 views

Multi-factor auth into centralized log server

I've been searching for an answer to this question. According to PCI DSS Requirement 10.5.3, it asks for sending logs to a centralized secure internal log server. Would we need to enable multi-factor ...
2
votes
2answers
198 views

Receiving encrypted Credit Card number - PCI

We are in situation where our application receives a payment confirmation from a third party service, which includes an encrypted credit card number too. Our application needs to store the response. ...
4
votes
1answer
576 views

Can Revolut be PCI DSS compliant?

Basically, the Revolut app shows the PAN and CVV by default in-app and it has a "show PIN" option, how can this be compliant? Here's a screenshot from the app, I have seen the real app and it really ...
3
votes
4answers
1k views

Would user workstations be considered part of the PCI-DSS CDE when collecting cardholder data using a secure portal

Supposing I had an office full of call centre operators, who sometimes update customers payment details by way of receiving these over the phone and then keying them into a secure web application, ...
0
votes
1answer
189 views

Do we need to include SIEM hosted in the cloud in CDE scope for PCI DSS requirement..? where no CD or transacation logs are being process or managed

We have our cardholder data environment (CDE) hosted in on-premise model (private datacenter), except SIEM solution is implemented for logging and monitoring in private cloud. where we are forwarding ...
3
votes
2answers
426 views

Are client-side-only apps regulated by PCI?

Consider a client-side-only application. It may allow a user to make a payment by redirecting them to payment gateway website, where they enter the credit card details. If I understand correctly, in ...
0
votes
1answer
242 views

PCI Compliance : Capture Credit Card, make ajax call to save address, then post of Payment Provider

Say on the guest checkout page of an e-commerce website, if the user enters the delivery address, payment details (Credit card details) and clicks Submit button - and if an ajax request is made to ...
0
votes
2answers
5k views

Block cipher algorithms with block size of 64 bits (like DES and 3DES) birthday attack known as Sweet32

I am using nodejs and Ubuntu. When i scan my domain on trustwave.com i got following error Block cipher algorithms with block size of 64 bits (like DES and 3DES) birthday attack known as Sweet32 ...
13
votes
1answer
3k views

Can I use GitHub and be PCI DSS compliant?

Is it possible to use any remote DVCS (GitHub, Bitbucket, etc.) with PCI DSS or should I host Git on my own server?
1
vote
1answer
111 views

Does PCI-required WiFi testing apply to all company facilities?

The PCI-DSS requirements define scope in terms of the CDE and systems connected to it. The requirements that specifically deal with physical security (9.x) are phrased in terms of facilities that ...
3
votes
2answers
98 views

Secure online credit card payment on a delayed time scale

I'm in charge of security for a small online store that wishes to request credit card information, but not actually charge the customer until approximately a month after the purchase - this cannot be ...
4
votes
2answers
161 views

PCI DSS Storage Definition - BizTalk Consideration

I am having trouble locating a clear PCI DSS definition for "Storage" and wether or not Microsoft BizTalk could be considered within that definition. Could an overloaded BizTalk server or failed ...
4
votes
1answer
104 views

SSL terminates on webserver instead of load balancer. PCI compliance question

We have a website that processes credit card data and uses a load balancer for our two web servers. The SSL connection terminates on the webservers and not the load balancer. Is the load balancer in ...
4
votes
1answer
414 views

If my company receives credit card statements showing credit card number, does it have to be PCI compliant?

I understand PCI requirements on the storing, processing and transmitting of credit card information (PAN, expiration date, no on CVV, etc.). However, I found nothing about receiving PAN (no ...
0
votes
0answers
307 views

Managed hosting with PCI SAQ D for Service Providers compliance

We have some hotel websites on our current managed hosting that link via URL redirect to a PCI Compliant third party booking engine hosted elsewhere. We do no more than pass date of arrival and number ...
2
votes
1answer
130 views

Can a non-PCI Compliant Service Provider provide SAQ A-EP compliance?

I am trying to find clarification regarding PCI Compliance SAQ A-EP and third party hosting solutions. In order to achieve SAQ A-EP PCI Compliance using "Hosting Company A" is it necessary for "...
0
votes
1answer
668 views

PCI DSS Scope outside CDE

Our organization is in process of determining if our PCI DSS scope is correct. We have done lots of research and read the Open PCI DSS Scoping Toolkit document. However, we still struggle to fully ...
4
votes
1answer
93 views

Store PCI DSS data in an encrypted form in non PCI DSS scope

Am I allowed to save a strongly encrypted archive containing the CHD on an external storage which is outside our PCI-DSS infrastructure ? For example, we'd like to save an encrypted backup archive ...
3
votes
4answers
689 views

How to be PCI compliant with Shopkeep (and others)?

When I walk into some businesses, I see them using Shopkeep on an iPad. I don't understand how this is PCI compliant, as the iPad itself would be in scope, and it can send unconstrained traffic to ...
0
votes
1answer
2k views

PCI-DSS compliance in scope if part of card number and expiry stored only? [duplicate]

If we were to store the following information about a credit card, would we need to be PCI-DSS compliance or are we out of scope? Please assume for the purposes of this question that we only store ...
3
votes
3answers
1k views

Boundaries of Personally Identifiable Information - PCI-DSS

I am attempting to ascertain the boundaries of personally identifiable information. For example does the combination of John and Doe equate to personally identifiable information since there could ...
3
votes
2answers
135 views

Risks of using a webpage without SSL/TLS for donations

There is a site called www.mysite.com. It uses Qgiv for taking donations and has some HTML5 data-attributes like: <div class="qgiv-embed-container visible-lg-block" > data-qgiv-embed="true" ...
1
vote
2answers
86 views

PA-DSS & DTMF application

If the payment application is not storing any credit card information, does it needs to be PA-DSS? The application takes the Credit card information using DTMF and pass-through via secure XML for ...
2
votes
1answer
155 views

PCI Scope, Tokens, and Processor APIs

A merchant receives a processor provided payment token in response to an authorization from an online order (for the sake of this question assume this part of the process has all its PCI t-s crossed ...
4
votes
1answer
423 views

PCI DSS compliant without private VLAN

I understand that it may be a best practice to hide in-PCI-scope-elements like databases inside a VLAN without a public address and also strict firewall rules. However, my questions is: can ...
6
votes
2answers
7k views

Clarification of PCI DSS 3.1 requirement 6+8

I'm quite puzzled about the PCI requirements when it comes to session timeouts and scope definitions. The login is the end user/customer login to the public facing control panel in which they can ...
4
votes
1answer
113 views

ASV scan with reverse proxy

We are PCI compliant as a service provider, however our service port forwards some web traffic at TCP level. Customers use our PCI compliant service and can choose to upload a TLS/SSL certificate to ...
3
votes
1answer
796 views

Using a CDN to reduce PCI DSS scope

A common scenario for e-commerce credit card types of transactions is a website with a connection to a third party payment processor. For a number of reasons you might not want to use an iFrame or ...
0
votes
1answer
746 views

PCI requirement 8.3 - 2FA for all network access originating outside the network

Requirement 8.3: Incorporate two-factor authentication for remote network access originating from outside the network by personnel (including users and administrators) and all third parties, (...
5
votes
2answers
1k views

Source code scanning - PCI Requirement - Service Provider

I've been doing a lot of research regarding the requirements for source code scanning but haven't found anything conclusive when it comes to my question below. So I need some guidance from PCI Experts ...
3
votes
2answers
204 views

Can Windows 8 be PCI compliant?

I am in the process of getting PCI. I am in the last step in which I would need a secure PC on my internal network. All the scans I must run are only available through a plugin in browsers for Windows ...
7
votes
5answers
749 views

Can I show Credit Card Data to final customers and be PCI Compliant?

I work with reservation management syatems. In the hospitality industry there is the concept of credit card as guarantee. By it when making any kind of reservation you are asked for your credit card ...
1
vote
0answers
36 views

PCI process, how to solve mambo vulnerability CVE 2006-0871 on debian 8?

I am involved in the process of becoming pci-dss compliant. I am really close to get it although I am having this vulnerability on the server when I am doing an external scan. Does someone know how to ...
1
vote
2answers
840 views

PCI-DSS, what is the best distro? [closed]

What is the best distro of Linux to get PCI-DSS compliant? I am using Debian 8 because I think Debian is one of the most stable versions, but it seems not to be enough, I am struggling with a lot of ...
3
votes
1answer
1k views

What are the differences between DIACAP and RMF?

I am currently certifying systems (products) under DIACAP (DoD Information Assurance Certification and Accreditation Process). In the future we will need to use RMF (Risk Management Framework). What ...