Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Hot answers tagged

107 votes
Accepted

How many digits of a Visa card number can vendors disclose on receipts?

As per PCI, the first 6 (BIN) and the last 4 can be shown, others should be masked: From an official 2008 PDF: PCI Data Storage Do’s and Don’ts: Never store the personal identification number (PIN)...
user avatar
107 votes
Accepted

Being told my "network" isn't PCI compliant. I don't even have a server! Do I have to comply?

At our office with connect to the internet through our cable modem provided to us by Spectrum Business. Our Treasurer uses a verifone vx520 card reader to process credit card payments. It ...
user avatar
  • 71.8k
58 votes

Validating and storing credit card data for retrieval later

What service in 2022 can I use that has like an API in which I can securely store credit card info and retrieve it at a later date for manual processing? Pick a credit card processor, any credit card ...
user avatar
  • 71.8k
52 votes
Accepted

Should I disable TLS 1.0 on my servers?

TLS 1.0 when properly configured has no known security vulnerabilities. Newer protocols are better designed and better address the potential for new vulnerabilities. So that's why I wouldn't ...
user avatar
  • 21.5k
38 votes

How many rounds should be used to hash card numbers?

Looks like you are hashing card details along with the CVV. That's bad, very bad. Don't do that. Ever. And there's no way to do the wrong thing on the right way. "A man may do a right thing in a ...
user avatar
  • 50.5k
34 votes

How to store credit card information for repeated transactions and still be PCI compliant?

Ivan, this is an absolutely huge topic. And you have a bunch of questions here. I'll try to help but this will likely be closed as too broad. I'm planning on making a case to the higher-ups that ...
user avatar
  • 3,762
33 votes

Effect on PCI compliance of not checking SSL certificate?

Yes, this is wrong, and here is why. As you mentioned, PCI-DSS requires that communication containing sensitive data be handled over a secure channel. As a part of this process, certificate ...
user avatar
  • 35.5k
33 votes

Direct access to databases

Some of the non DBA workers (DEV, Fraud, analysts ... ) in my organization need direct access to databases to write their own queries. ... PCI DSS requirement 8.7 stats "Only database ...
user avatar
  • 71.8k
32 votes

Being told my "network" isn't PCI compliant. I don't even have a server! Do I have to comply?

Since you are physically handling cards, and sending that card data across a network to your card processor, you do need to secure your network. Besides just being compliant in order to get auditors ...
user avatar
  • 5,756
29 votes
Accepted

Can I use GitHub and be PCI DSS compliant?

Note : not a QSA, but I do have some PCI experience. There is nothing in PCI about storage of source code - there are requirements about change management, which github would help with, but nothing ...
user avatar
  • 6,281
24 votes
Accepted

Properly masking credit cards

Typically, it's just the last 4 that are shown to the customer, sometimes the first 6. From the PCI DSS 3.4 Standards Never store the personal identification number (PIN) or PIN Block. Be sure ...
user avatar
  • 5,105
24 votes

Being told my "network" isn't PCI compliant. I don't even have a server! Do I have to comply?

TLDR: DON'T secure your network. Get a modern card terminal with P2PE (Point to Point Encryption) and acquirer who supports it - e.g. new-market products like Square or PayPal Here, which cost less ...
user avatar
22 votes

PCI Compliance Scan Failing for supporting TLS 1.0, but removing support breaks < IE 10

Short version: TLS 1.0 is on notice as of PCI DSS 3.1 TrustWave is carping, but you may be able to continue using TLS 1.0 if it's not a "new application" Long version: PCI DSS 3.1 was released two ...
user avatar
  • 71.8k
20 votes

How many digits of a Visa card number can vendors disclose on receipts?

Just remember that sensitive does not mean secret. The card number is "sensitive" because it can be used to initiate financial transactions, but it is not secret. Only the PIN code is. Earlier, the ...
user avatar
18 votes

Is storing CVV compliant with PCI standards?

Storing CVV is not allowed: There are a few things to consider: You assume booking.com is storing CVV You're assuming a CVV is needed to process a transaction. On 1) - there can be no way to ...
user avatar
  • 8,662
16 votes
Accepted

Storing CVC / CVV / CVV2 until payment is processed

Technically, according to PCI SSC you can hold onto CVV and other sensitive authentication data until authorization has occurred. In other words the restriction on storing sensitive authentication ...
user avatar
  • 571
16 votes
Accepted

Password expiration and compliance (ISO, NIST, PCI, etc)

The current version of PCI DSS is 3.2.1*, and in section 8.2.4 it requires users to change their passwords every 90 days. Section 8.2.5 requires that passwords must not be the same as any of the four ...
user avatar
  • 33.6k
15 votes
Accepted

How to pass PCI DSS 2.0 anti-virus requirement (5.1) on Linux?

Can you pass PCI DSS without installing antivirus on all linux workstations and servers? Yes, absolutely. Can you pass PCI DSS without installing additional firewalls or configuring iptables ...
user avatar
  • 71.8k
14 votes

Should I disable TLS 1.0 on my servers?

I also recommend disabling TLS 1.0 if possible and supporting the most modern cryptography and cipher suites your web servers can handle. TLS 1.0 is vulnerable in many implementations to a couple ...
user avatar
13 votes

Do you have to ban cellphones and paper to be PCI compliant?

Short version: The PCI-DSS does not explicitly call out the steps you describe. However, those are common sense steps that are reasonably encompassed by several PCI-DSS requirements. They are not ...
user avatar
  • 71.8k
13 votes

How many rounds should be used to hash card numbers?

I agree with ThoriumBR's answer. I have a few more details and a suggestion: You are trying to hit a moving target. "How many rounds is enough?" is a question with a changing answer as hardware ...
user avatar
12 votes
Accepted

Does sending credit card info over email violates PCI DSS?

Yes, PCI DSS requirement 4.2: Never send unprotected PANs by end-user messaging technologies (for example, e-mail, instant messaging, chat, etc.). Unless the email is somehow encrypted, you are ...
user avatar
  • 1,905
12 votes
Accepted

Cardholder data segmentation for PCI compliance (3.2)

Here are the basic do's and dont's for PCI-DSS: Regardless of segmentation you are not allowed to store the CVV data. The effectiveness of this code is limited to the ability to keep it out of the ...
user avatar
12 votes

How many digits of a Visa card number can vendors disclose on receipts?

In the USA, the Fair and Accurate Credit Transactions Act of 2005 (FACTA) prohibits printing more than five digits of a credit card number. So while your receipt complies with PCI regulations, it ...
user avatar
  • 10.1k
11 votes
Accepted

To whom do the PCI DSS password requirements apply?

The password requirements of PCI DSS, among everything else, state that you must enforce a very specific password policy: You need to force the users to change their passwords every 90 days, ...
user avatar
  • 71.8k
11 votes

Being told my "network" isn't PCI compliant. I don't even have a server! Do I have to comply?

In the big picture, the problem is that internet-connected devices face a lot of security threats. The other answers give good tips to address the specific issues that were detected this time. On the ...
user avatar
  • 769
11 votes

How does collecting sensitive data using iframes increase security?

... if a bad actor is able to run javascript on your page That's exactly the point one want to avoid. Iframes allow third-party sides including script to be part of the visible page without having ...
user avatar
10 votes
Accepted

Do It Yourself Credit Card Storage (PCI - DSS Compliant)

The PCI DSS isn't expressly clear on this topic. The meaning of secure key storage and secure key management is left up to the QSA's interpretation. You may find that that one QSA considers the ...
user avatar
  • 33.6k
10 votes
Accepted

PCI Compliance Password time to die change requirement

I assume you are talking about customers of the bank not being required to change their password every 90 days. Customers of the bank are not covered by PCI; PCI dictates what employees and others ...
user avatar
  • 71.8k
9 votes

How can Stripe be PCI-compliant?

(Disclosure, I work for Braintree, a competitor to Stripe) At Braintree we also allow the CVV code to be passed in our API. You are correct that the PCI-DSS explicitly forbids non-issuers from ...
user avatar
  • 1,905

Only top scored, non community-wiki answers of a minimum length are eligible