Questions tagged [pci-scope]
The pci-scope tag has no usage guidance.
91
questions
1
vote
1answer
23 views
PCI scope for a Direct-Post e-commerce site (SAQ A-EP)
An e-commerce site uses the Direct-Post method (see page 14 PCI e-commerce security).
Is the server for the e-commerce application and network it resides on in scope for PCI? There are questions in ...
0
votes
0answers
20 views
What types of businesses are allowed to store SAD and in particular CVV data? [duplicate]
There must be some kind of business that requires the use of sensitive authentication data (SAD) data. Could someone point me in the right direction on the requirement for the storage of that data?
0
votes
0answers
18 views
KMS with payment HSMin-scope for PCI audit
If I install a KMS into a PCI environment, the KMS touches the keys of the payment HSM. does the KMS come into scope for a PCI audit.
1
vote
2answers
58 views
Can biometric vectors (i.e. fingerprint vector) be considered as Sensitive Authentication Data (SAD) in PCI?
I am designing a system that uses a certain biometric vector as a secondary user identification step before authorizing a payment. My system does not handle payment card details, rather the payment ...
0
votes
1answer
82 views
PCI Compliance - Service Provider vs Merchant
We will be providing a service to a client, where the end user logged on to our system can submit their payment information to Authorize .Net.
I need help figuring out if we as a service provider ...
0
votes
1answer
45 views
Is it legal to post card data from an ecommerce checkout to a PCI compliant 'store'
Let's say I want to charge a user's credit card with their permission after a sale takes place. But, I don't want to have to ask them their credit card a second time.
Is it legal to store the credit ...
1
vote
1answer
202 views
What is the difference between a server and an appliance for PCI purposes?
I administer a few hundred servers and am going through a yearly PCI audit. This time around we need to prove that we've got anti-virus protection on our "systems commonly affected by malicious ...
3
votes
0answers
97 views
PCI Idle Session Timeout general question
Can someone help me understand how the PCI Timeout rules change for an application like the Starbucks App? A user is able to keep their card open ready for scan for longer the 15 minutes if needed, ...
4
votes
1answer
136 views
PCI compliance with multiple AWS VPCs
If I have VPC which is in-scope (the "PCI VPC") and another which is not (the "NON-PCI VPC"), would peering them bring the non-pci vpc in-scope? Is there a way to avoid this?
I have an aurora RDS ...
0
votes
1answer
45 views
Account Security Cardholder data
Ok, so we do not store any cardholder data so I get confused by these questions.
"Is all access to any database containing cardholder data (including access by applications, administrators, and all ...
0
votes
1answer
67 views
Platform Change
So we converted our website from an internally created site to a Magento Cloud environment. In the process, we had to change how we handle credit cards.
We used to redirect the user to the payment ...
0
votes
0answers
38 views
Does PCI-DSS requirement 10 (“track and monitor all access to … card holder data”) apply if I am not storing card holder data?
Requirement 10 states: Track and monitor all access to network resources and card holder data
I find this a little vague and I have two questions.
If I don't store card holder data - do I just need ...
0
votes
0answers
101 views
Are AWS security groups enough to segment network and reduce PCI scope?
I was reading this paper
https://d1.awsstatic.com/whitepapers/pci-dss-scoping-on-aws.pdf
It shows this image
Am I correct in saying that - as long as instances have proper security groups that ...
7
votes
1answer
126 views
Which self assessment questionairre should I use for PCI DSS compliance
My system is passed card data securely over HTTPS from an upstream system. The upstream system captures information via telephone input. This telephone input is sent to us, to invoke payments via ...
2
votes
1answer
226 views
Is web site in-scope for PCI even though it redirects to a 3rd-party for card transaction?
Even though the web site never sees the cardholder data or sensitive authentication data in the clear, and never has access to the encryption keys, I would think the web site is in-scope because it ...
-2
votes
2answers
209 views
Does PCI Apply to PAN only?
I am trying to find out if a credit card application would be in-scope for PCI DSS. As part of the application process, customers can submit their credit card number (PAN) from another institution. No ...
0
votes
1answer
98 views
Outsourcing PCI data: Is this ok?
The organization I work for hold PCI-DSS compliance as merchants (we fill in SAQ-D). At the same time, due to document/payment verification processes, we request from our customers pictures of their ...
1
vote
1answer
437 views
If only getting and storing BIN part of credit card number, should I comply with any PCI (or other) specification?
I have a fraud detection system.
From the client side (browser) I want to receive the store BIN section of the card number (first 6 digits) and if possible also the last 4 digits
Besides the above, ...
1
vote
2answers
217 views
Emailing PAN securely?
Has anyone successfully implemented a PCI approved method of emailing PAN data? I know there are concerns managing all the PCI requirements in an email solution but is there anyone that has actually ...
1
vote
1answer
457 views
PCI DSS PenetrationTesting Requirement 11.3.4
I'm fairly new to PCI DSS and I'm confused over the requirement to perform pen-testing as per 11.3.4. as it states:-
Are penetration-testing procedures defined to test all segmentation
methods, ...
1
vote
1answer
1k views
PCI compliance for bank card system
There is a bank who has internal system working with card data preparation, generating PANs, and finally preparing personalization files that are sent to third party card manufacturer.
The bank can ...
4
votes
1answer
69 views
When to complete PCI DSS Compliance Paperwork
I am working for a startup that will soon begin processing payments with Stripe.
Looking at their documentation, it seems we will have to file an SAQ A, SAQ A-EP, or an SAQ D depending on our ...
2
votes
3answers
190 views
PCI Compliance question from a merchant
I'm a new business that conducts online auctions for estate sales. When searching for software to use, I had no idea about PCI Compliance. My merchant account told me it was easy. It would be if the ...
2
votes
3answers
445 views
PCI - store card details offline
I work for a company that sends out mail/telephone order goods. Some customers have orders they receive every day, with different amounts.
We have been asked a few times by various customers if we ...
3
votes
2answers
744 views
SAQ-D Service Provider without a CDE
We provide a shopping cart service with integrations to multiple third party payment processors (PayPal, Authorize.net, etc.) where all payment processing happens on their networks (i.e., no CC data ...
1
vote
1answer
122 views
PCI-DSS : Sending antivirus logs from private infrastructure to public cloud? [closed]
We are planning to build an environment where all the Linux machines in private infrastructures will send their ClamAV log files to ELK stack hosted in a public cloud for log analysis. Is this PCI ...
1
vote
1answer
45 views
PCI DSS: Is Mirror/ Identical Server in Pentest or Scanning Scope
I am just wonder if I have a mirror/identical (high availability server) server in my CDE segment, is that mirror server need be in scanning scope?
If it is not in the scope, in the scanning report ...
1
vote
1answer
289 views
Credit card store first four and last four which PCI SAQ?
In our application, we only transfer cardholder data to a PCI DSS compliant service provider, and don't store it ourselves. We only store first four and last four digits of credit card number for ...
1
vote
1answer
2k views
PCI Consideration for HTTP Headers? [closed]
Recently, some of our servers were being flagged for not implementing proper HTTP headers in a Qualys scan.
One of the sites that I visit regularly - http://pentestit.com has some good HTTP headers ...
1
vote
1answer
732 views
What compliance does my mobile application need?
We are going to develop an application for payment gateway which is already PCI DSS compliant,
This application will be handling the payment through the API.
My questions is is the application needs ...
3
votes
1answer
1k views
PCI scope when entering card details into browser
Suppose I have an ecommerce web site, hosted in Azure (or AWS). I will use a third party payment gateway that is fully certified as PCI level 1. All communication is done with TLS 1.1 or better.
...
2
votes
0answers
95 views
Compliance/ FCA regulations
First of all, please accept my apology for being ingnorant to compliance/FCA regulations as I have been digging out everywhere to get the answer of a very specific question:
SCENARIO
I am planning ...
0
votes
1answer
76 views
Multi-factor auth into centralized log server
I've been searching for an answer to this question. According to PCI DSS Requirement 10.5.3, it asks for sending logs to a centralized secure internal log server.
Would we need to enable multi-factor ...
2
votes
2answers
266 views
Receiving encrypted Credit Card number - PCI
We are in situation where our application receives a payment confirmation from a third party service, which includes an encrypted credit card number too. Our application needs to store the response. ...
3
votes
1answer
1k views
Can Revolut be PCI DSS compliant?
Basically, the Revolut app shows the PAN and CVV by default in-app and it has a "show PIN" option, how can this be compliant?
Here's a screenshot from the app, I have seen the real app and it really ...
2
votes
4answers
3k views
Would user workstations be considered part of the PCI-DSS CDE when collecting cardholder data using a secure portal
Supposing I had an office full of call centre operators, who sometimes update customers payment details by way of receiving these over the phone and then keying them into a secure web application, ...
0
votes
1answer
251 views
Do we need to include SIEM hosted in the cloud in CDE scope for PCI DSS requirement..? where no CD or transacation logs are being process or managed
We have our cardholder data environment (CDE) hosted in on-premise model (private datacenter), except SIEM solution is implemented for logging and monitoring in private cloud. where we are forwarding ...
4
votes
2answers
661 views
Are client-side-only apps regulated by PCI?
Consider a client-side-only application. It may allow a user to make a payment by redirecting them to payment gateway website, where they enter the credit card details. If I understand correctly, in ...
0
votes
1answer
358 views
PCI Compliance : Capture Credit Card, make ajax call to save address, then post of Payment Provider
Say on the guest checkout page of an e-commerce website, if the user enters the delivery address, payment details (Credit card details) and clicks Submit button - and if
an ajax request is made to ...
0
votes
2answers
6k views
Block cipher algorithms with block size of 64 bits (like DES and 3DES) birthday attack known as Sweet32
I am using nodejs and Ubuntu.
When i scan my domain on trustwave.com i got following error
Block cipher algorithms with block size of 64 bits (like DES and 3DES) birthday attack known as Sweet32
...
14
votes
1answer
4k views
Can I use GitHub and be PCI DSS compliant?
Is it possible to use any remote DVCS (GitHub, Bitbucket, etc.) with PCI DSS or should I host Git on my own server?
1
vote
1answer
136 views
Does PCI-required WiFi testing apply to all company facilities?
The PCI-DSS requirements define scope in terms of the CDE and systems connected to it. The requirements that specifically deal with physical security (9.x) are phrased in terms of facilities that ...
3
votes
2answers
108 views
Secure online credit card payment on a delayed time scale
I'm in charge of security for a small online store that wishes to request credit card information, but not actually charge the customer until approximately a month after the purchase - this cannot be ...
4
votes
2answers
177 views
PCI DSS Storage Definition - BizTalk Consideration
I am having trouble locating a clear PCI DSS definition for "Storage" and wether or not Microsoft BizTalk could be considered within that definition. Could an overloaded BizTalk server or failed ...
3
votes
1answer
171 views
SSL terminates on webserver instead of load balancer. PCI compliance question
We have a website that processes credit card data and uses a load balancer for our two web servers. The SSL connection terminates on the webservers and not the load balancer. Is the load balancer in ...
4
votes
1answer
653 views
If my company receives credit card statements showing credit card number, does it have to be PCI compliant?
I understand PCI requirements on the storing, processing and transmitting of credit card information (PAN, expiration date, no on CVV, etc.).
However, I found nothing about receiving PAN (no ...
2
votes
1answer
165 views
Can a non-PCI Compliant Service Provider provide SAQ A-EP compliance?
I am trying to find clarification regarding PCI Compliance SAQ A-EP and third party hosting solutions.
In order to achieve SAQ A-EP PCI Compliance using "Hosting Company A" is it necessary for "...
0
votes
1answer
808 views
PCI DSS Scope outside CDE
Our organization is in process of determining if our PCI DSS scope is correct. We have done lots of research and read the Open PCI DSS Scoping Toolkit document. However, we still struggle to fully ...
4
votes
1answer
98 views
Store PCI DSS data in an encrypted form in non PCI DSS scope
Am I allowed to save a strongly encrypted archive containing the CHD on an external storage which is outside our PCI-DSS infrastructure ?
For example, we'd like to save an encrypted backup archive ...
3
votes
4answers
974 views
How to be PCI compliant with Shopkeep (and others)?
When I walk into some businesses, I see them using Shopkeep on an iPad.
I don't understand how this is PCI compliant, as the iPad itself would be in scope, and it can send unconstrained traffic to ...
