Skip to main content
107 votes
Accepted

Being told my "network" isn't PCI compliant. I don't even have a server! Do I have to comply?

At our office with connect to the internet through our cable modem provided to us by Spectrum Business. Our Treasurer uses a verifone vx520 card reader to process credit card payments. It ...
gowenfawr's user avatar
  • 73k
106 votes
Accepted

How many digits of a Visa card number can vendors disclose on receipts?

As per PCI, the first 6 (BIN) and the last 4 can be shown, others should be masked: From an official 2008 PDF: PCI Data Storage Do’s and Don’ts: Never store the personal identification number (PIN)...
Burhan Khalid's user avatar
63 votes

Validating and storing credit card data for retrieval later

What service in 2022 can I use that has like an API in which I can securely store credit card info and retrieve it at a later date for manual processing? Pick a credit card processor, any credit card ...
gowenfawr's user avatar
  • 73k
41 votes
Accepted

Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?

Automated scanning tools are fairly crude, and don't tend to take that kind of nuance into account - the scanner is most likely flagging any HTTP response that doesn't have the Content-Type header, ...
Gh0stFish's user avatar
  • 13k
38 votes

How many rounds should be used to hash card numbers?

Looks like you are hashing card details along with the CVV. That's bad, very bad. Don't do that. Ever. And there's no way to do the wrong thing on the right way. "A man may do a right thing in a ...
ThoriumBR's user avatar
  • 54.6k
32 votes

Direct access to databases

Some of the non DBA workers (DEV, Fraud, analysts ... ) in my organization need direct access to databases to write their own queries. ... PCI DSS requirement 8.7 stats "Only database ...
gowenfawr's user avatar
  • 73k
32 votes

Being told my "network" isn't PCI compliant. I don't even have a server! Do I have to comply?

Since you are physically handling cards, and sending that card data across a network to your card processor, you do need to secure your network. Besides just being compliant in order to get auditors ...
Ghedipunk's user avatar
  • 6,060
28 votes
Accepted

Can I use GitHub and be PCI DSS compliant?

Note : not a QSA, but I do have some PCI experience. There is nothing in PCI about storage of source code [mod note: this was true pre-version 4.0]. There are requirements about change management, ...
crovers's user avatar
  • 6,381
25 votes

Being told my "network" isn't PCI compliant. I don't even have a server! Do I have to comply?

TLDR: DON'T secure your network. Get a modern card terminal with P2PE (Point to Point Encryption) and acquirer who supports it - e.g. new-market products like Square or PayPal Here, which cost less ...
Harper - Reinstate Monica's user avatar
24 votes
Accepted

Properly masking credit cards

Typically, it's just the last 4 that are shown to the customer, sometimes the first 6. From the PCI DSS 3.4 Standards Never store the personal identification number (PIN) or PIN Block. Be sure ...
HashHazard's user avatar
  • 5,185
20 votes

How many digits of a Visa card number can vendors disclose on receipts?

Just remember that sensitive does not mean secret. The card number is "sensitive" because it can be used to initiate financial transactions, but it is not secret. Only the PIN code is. Earlier, the ...
Serge Ballesta's user avatar
16 votes
Accepted

Password expiration and compliance (ISO, NIST, PCI, etc)

The current version of PCI DSS is 3.2.1*, and in section 8.2.4 it requires users to change their passwords every 90 days. Section 8.2.5 requires that passwords must not be the same as any of the four ...
John Deters's user avatar
  • 34.3k
13 votes

Do you have to ban cellphones and paper to be PCI compliant?

Short version: The PCI-DSS does not explicitly call out the steps you describe. However, those are common sense steps that are reasonably encompassed by several PCI-DSS requirements. They are not ...
gowenfawr's user avatar
  • 73k
13 votes

How many rounds should be used to hash card numbers?

I agree with ThoriumBR's answer. I have a few more details and a suggestion: You are trying to hit a moving target. "How many rounds is enough?" is a question with a changing answer as hardware ...
Conor Mancone's user avatar
12 votes

How many digits of a Visa card number can vendors disclose on receipts?

In the USA, the Fair and Accurate Credit Transactions Act of 2005 (FACTA) prohibits printing more than five digits of a credit card number. So while your receipt complies with PCI regulations, it ...
Mike Scott's user avatar
  • 10.3k
12 votes

Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?

Automated security scans are notoriously prone to false positives. In general I agree with the other answer to pick your battles with the security team. If a false finding can be "remediated"...
user3067860's user avatar
11 votes
Accepted

To whom do the PCI DSS password requirements apply?

The password requirements of PCI DSS, among everything else, state that you must enforce a very specific password policy: You need to force the users to change their passwords every 90 days, ...
gowenfawr's user avatar
  • 73k
11 votes

Being told my "network" isn't PCI compliant. I don't even have a server! Do I have to comply?

In the big picture, the problem is that internet-connected devices face a lot of security threats. The other answers give good tips to address the specific issues that were detected this time. On the ...
Krubo's user avatar
  • 849
11 votes
Accepted

PCI Compliance Password time to die change requirement

I assume you are talking about customers of the bank not being required to change their password every 90 days. Customers of the bank are not covered by PCI; PCI dictates what employees and others ...
gowenfawr's user avatar
  • 73k
11 votes

How does collecting sensitive data using iframes increase security?

... if a bad actor is able to run javascript on your page That's exactly the point one want to avoid. Iframes allow third-party sides including script to be part of the visible page without having ...
Steffen Ullrich's user avatar
10 votes
Accepted

Do It Yourself Credit Card Storage (PCI - DSS Compliant)

The PCI DSS isn't expressly clear on this topic. The meaning of secure key storage and secure key management is left up to the QSA's interpretation. You may find that that one QSA considers the ...
John Deters's user avatar
  • 34.3k
9 votes

A store I visited is breaching PCI DSS. What should I do?

Printing full PAN and expiry date on the customer receipt is a violation of Visa's requirements listed in "Card Acceptance Guidelines for Visa Merchants". Therefore I suggest you to submit merchant ...
Artem Bychkov's user avatar
9 votes

Direct access to databases

AFAIK, you cannot. If you want to be conformant to th PCI DSS, neither devs nor analysts should directly access the production database. Once that has been said, you should wonder why they need ...
Serge Ballesta's user avatar
9 votes
Accepted

Can a card issuing company store CVV number, expiry date and 16 digits card number?

Yes. A payment handler (e.g. Amazon, Netflix, Thames Water, Comcast) must not store CVV and must mask the PAN (card number), assuming that they are contractually bound to the Payment Card Industry ...
Polynomial's user avatar
  • 135k
9 votes
Accepted

If I'm PCI-DSS compliant, do I need to worry about GDPR?

Assuming GDPR apply to your organization, yes you should worry about GDPR. PCI-DSS compliance doesn't imply GDPR compliance. There are many concept present in GDPR and not in PCI-DSS or not with the ...
Whysmerhill's user avatar
9 votes
Accepted

When credit card tokens are leaked / stolen, what can the attacker do with them?

My payment processor supports recurring payments via "credit card tokens". This means that when someone makes a purchase, either you or the customer will send their credit card to your processor, and ...
gowenfawr's user avatar
  • 73k
9 votes
Accepted

Which self assessment questionairre should I use for PCI DSS compliance

Unfortunately for you, because the raw card data transits your servers in cleartext, you have to use SAQ D, and because you aren't the merchant yourself, it would be SAQ D for Service Providers. ...
Bobson's user avatar
  • 1,485
8 votes
Accepted

Store PCI DSS data in an encrypted form in non PCI DSS scope

Using that external storage effectively brings it within PCI scope, however you are correct: If you have strong encryption sufficient to protect the data, and can evidence that, storing it on an ...
Rory Alsop's user avatar
  • 61.5k
8 votes
Accepted

Is Docker a PCI DSS compliant form of virtualization?

A self-answer after a convo on the #docker IRC, PCI DSS v3.2 doesn't state anything about the kind of virtualization that is required, nothing states you should use hardware instead of OS-level ...
bbozo's user avatar
  • 511
8 votes
Accepted

Credit Card details shown in full after payment on online store

It is not PCI compliant (emphasis added): Never store the personal identification number (PIN) or PIN Block. Be sure to mask PAN whenever it is displayed. The first six and last four digits are the ...
John Wu's user avatar
  • 9,331

Only top scored, non community-wiki answers of a minimum length are eligible