107
votes
Accepted
How many digits of a Visa card number can vendors disclose on receipts?
As per PCI, the first 6 (BIN) and the last 4 can be shown, others should be masked:
From an official 2008 PDF: PCI Data Storage Do’s and Don’ts:
Never store the personal identification number (PIN)...
- 926
107
votes
Accepted
Being told my "network" isn't PCI compliant. I don't even have a server! Do I have to comply?
At our office with connect to the internet through our cable modem
provided to us by Spectrum Business.
Our Treasurer uses a verifone vx520 card reader to process credit card
payments. It ...
- 71.8k
58
votes
Validating and storing credit card data for retrieval later
What service in 2022 can I use that has like an API in which I can
securely store credit card info and retrieve it at a later date for
manual processing?
Pick a credit card processor, any credit card ...
- 71.8k
52
votes
Accepted
Should I disable TLS 1.0 on my servers?
TLS 1.0 when properly configured has no known security vulnerabilities. Newer protocols are better designed and better address the potential for new vulnerabilities. So that's why
I wouldn't ...
- 21.5k
38
votes
How many rounds should be used to hash card numbers?
Looks like you are hashing card details along with the CVV. That's bad, very bad. Don't do that. Ever. And there's no way to do the wrong thing on the right way.
"A man may do a right thing in a ...
- 50.5k
34
votes
How to store credit card information for repeated transactions and still be PCI compliant?
Ivan, this is an absolutely huge topic. And you have a bunch of questions here. I'll try to help but this will likely be closed as too broad.
I'm planning on making a case to the higher-ups that ...
- 3,762
33
votes
Effect on PCI compliance of not checking SSL certificate?
Yes, this is wrong, and here is why. As you mentioned, PCI-DSS requires that communication containing sensitive data be handled over a secure channel. As a part of this process, certificate ...
- 35.5k
33
votes
Direct access to databases
Some of the non DBA workers (DEV, Fraud, analysts ... ) in my organization need direct access to databases to write their own queries.
...
PCI DSS requirement 8.7 stats "Only database ...
- 71.8k
32
votes
Being told my "network" isn't PCI compliant. I don't even have a server! Do I have to comply?
Since you are physically handling cards, and sending that card data across a network to your card processor, you do need to secure your network. Besides just being compliant in order to get auditors ...
- 5,756
29
votes
Accepted
Can I use GitHub and be PCI DSS compliant?
Note : not a QSA, but I do have some PCI experience.
There is nothing in PCI about storage of source code - there are requirements about change management, which github would help with, but nothing ...
- 6,281
24
votes
Accepted
Properly masking credit cards
Typically, it's just the last 4 that are shown to the customer, sometimes the first 6.
From the PCI DSS 3.4 Standards
Never store the personal identification number (PIN) or PIN Block. Be
sure ...
- 5,105
24
votes
Being told my "network" isn't PCI compliant. I don't even have a server! Do I have to comply?
TLDR: DON'T secure your network. Get a modern card terminal with P2PE (Point to Point Encryption) and acquirer who supports it - e.g. new-market products like Square or PayPal Here, which cost less ...
22
votes
PCI Compliance Scan Failing for supporting TLS 1.0, but removing support breaks < IE 10
Short version:
TLS 1.0 is on notice as of PCI DSS 3.1
TrustWave is carping, but you may be able to continue using TLS 1.0 if it's not a "new application"
Long version:
PCI DSS 3.1 was released two ...
- 71.8k
20
votes
How many digits of a Visa card number can vendors disclose on receipts?
Just remember that sensitive does not mean secret. The card number is "sensitive" because it can be used to initiate financial transactions, but it is not secret. Only the PIN code is.
Earlier, the ...
- 25.5k
18
votes
Is storing CVV compliant with PCI standards?
Storing CVV is not allowed:
There are a few things to consider:
You assume booking.com is storing CVV
You're assuming a CVV is needed to process a transaction.
On 1) - there can be no way to ...
- 8,662
16
votes
Accepted
Storing CVC / CVV / CVV2 until payment is processed
Technically, according to PCI SSC you can hold onto CVV and other sensitive authentication data until authorization has occurred. In other words the restriction on storing sensitive authentication ...
- 571
16
votes
Accepted
Password expiration and compliance (ISO, NIST, PCI, etc)
The current version of PCI DSS is 3.2.1*, and in section 8.2.4 it requires users to change their passwords every 90 days. Section 8.2.5 requires that passwords must not be the same as any of the four ...
- 33.6k
15
votes
Accepted
How to pass PCI DSS 2.0 anti-virus requirement (5.1) on Linux?
Can you pass PCI DSS without installing antivirus on all linux
workstations and servers?
Yes, absolutely.
Can you pass PCI DSS without installing additional firewalls or
configuring iptables ...
- 71.8k
14
votes
Should I disable TLS 1.0 on my servers?
I also recommend disabling TLS 1.0 if possible and supporting the most modern cryptography and cipher suites your web servers can handle.
TLS 1.0 is vulnerable in many implementations to a couple ...
- 4,232
13
votes
Do you have to ban cellphones and paper to be PCI compliant?
Short version:
The PCI-DSS does not explicitly call out the steps you describe. However, those are common sense steps that are reasonably encompassed by several PCI-DSS requirements. They are not ...
- 71.8k
13
votes
How many rounds should be used to hash card numbers?
I agree with ThoriumBR's answer. I have a few more details and a suggestion:
You are trying to hit a moving target. "How many rounds is enough?" is a question with a changing answer as hardware ...
- 29.8k
12
votes
Accepted
Does sending credit card info over email violates PCI DSS?
Yes, PCI DSS requirement 4.2:
Never send unprotected PANs by end-user messaging technologies (for example, e-mail, instant messaging, chat, etc.).
Unless the email is somehow encrypted, you are ...
- 1,905
12
votes
Accepted
Cardholder data segmentation for PCI compliance (3.2)
Here are the basic do's and dont's for PCI-DSS:
Regardless of segmentation you are not allowed to store the CVV data. The effectiveness of this code is limited to the ability to keep it out of the ...
- 54.2k
12
votes
How many digits of a Visa card number can vendors disclose on receipts?
In the USA, the Fair and Accurate Credit Transactions Act of 2005 (FACTA) prohibits printing more than five digits of a credit card number. So while your receipt complies with PCI regulations, it ...
- 10.1k
11
votes
Accepted
To whom do the PCI DSS password requirements apply?
The password requirements of PCI DSS, among everything else, state
that you must enforce a very specific password policy:
You need to force the users to change their passwords every 90 days,
...
- 71.8k
11
votes
Being told my "network" isn't PCI compliant. I don't even have a server! Do I have to comply?
In the big picture, the problem is that internet-connected devices face a lot of security threats. The other answers give good tips to address the specific issues that were detected this time.
On the ...
- 769
11
votes
How does collecting sensitive data using iframes increase security?
... if a bad actor is able to run javascript on your page
That's exactly the point one want to avoid. Iframes allow third-party sides including script to be part of the visible page without having ...
- 181k
10
votes
Accepted
Do It Yourself Credit Card Storage (PCI - DSS Compliant)
The PCI DSS isn't expressly clear on this topic. The meaning of secure key storage and secure key management is left up to the QSA's interpretation. You may find that that one QSA considers the ...
- 33.6k
10
votes
Accepted
PCI Compliance Password time to die change requirement
I assume you are talking about customers of the bank not being required to change their password every 90 days.
Customers of the bank are not covered by PCI; PCI dictates what employees and others ...
- 71.8k
9
votes
How can Stripe be PCI-compliant?
(Disclosure, I work for Braintree, a competitor to Stripe)
At Braintree we also allow the CVV code to be passed in our API. You are correct that the PCI-DSS explicitly forbids non-issuers from ...
- 1,905
Only top scored, non community-wiki answers of a minimum length are eligible