107 votes
Accepted

How many digits of a Visa card number can vendors disclose on receipts?

As per PCI, the first 6 (BIN) and the last 4 can be shown, others should be masked: From an official 2008 PDF: PCI Data Storage Do’s and Don’ts: Never store the personal identification number (PIN)...
user avatar
33 votes

Direct access to databases

Some of the non DBA workers (DEV, Fraud, analysts ... ) in my organization need direct access to databases to write their own queries. ... PCI DSS requirement 8.7 stats "Only database ...
user avatar
  • 71.3k
22 votes
Accepted

Does SOC-2 compliance require password rotation

SOC 2 Type 2 does not have specific technical requirements. What you have to do is to satisfy your assessor. And if your company cannot satisfy your assessor, then there is a mechanism called "...
user avatar
  • 123k
20 votes

How many digits of a Visa card number can vendors disclose on receipts?

Just remember that sensitive does not mean secret. The card number is "sensitive" because it can be used to initiate financial transactions, but it is not secret. Only the PIN code is. Earlier, the ...
user avatar
12 votes

How many digits of a Visa card number can vendors disclose on receipts?

In the USA, the Fair and Accurate Credit Transactions Act of 2005 (FACTA) prohibits printing more than five digits of a credit card number. So while your receipt complies with PCI regulations, it ...
user avatar
  • 10.1k
9 votes

Direct access to databases

AFAIK, you cannot. If you want to be conformant to th PCI DSS, neither devs nor analysts should directly access the production database. Once that has been said, you should wonder why they need ...
user avatar
8 votes
Accepted

Credit Card details shown in full after payment on online store

It is not PCI compliant (emphasis added): Never store the personal identification number (PIN) or PIN Block. Be sure to mask PAN whenever it is displayed. The first six and last four digits are the ...
user avatar
  • 9,041
8 votes
Accepted

Can a card issuing company store CVV number, expiry date and 16 digits card number?

Yes. A payment handler (e.g. Amazon, Netflix, Thames Water, Comcast) must not store CVV and must mask the PAN (card number), assuming that they are contractually bound to the Payment Card Industry ...
user avatar
  • 131k
7 votes

How many digits of a Visa card number can vendors disclose on receipts?

Since there's about 1 billion of Visa cards in circulation worldwide (there were 883.5 millions in 2012) and each card has 14 unique digits (the first one is always 4 and the last one is the checksum),...
user avatar
6 votes

Is there a specification for the color values representing information classification levels for the United States?

Ok so after diving into this a bit, this is the best I can come up with. I do not work for the US government so I cant say anything with any level of confidence. However; It seems that the color ...
user avatar
  • 1,614
5 votes

Retention periods for web logs

Most legislation and regulations will not prescribe specific time frames for preserving logs. For example the National Archives Records Control Schedules (RCS) vary according to the document type and ...
user avatar
5 votes

How many digits of a Visa card number can vendors disclose on receipts?

As another user has stated, per PCI-compliance rules, this is perfectly acceptable. I wanted to clarify a bit exactly why things are this way. First off, the first six digits of the card number ...
user avatar
4 votes

PSD2 compliant two factor authentication

tl;dr; Nobody can say for sure and this is highly debatable Little history: there was a change from "trusted execution environment" to "secure execution environment". It is documented here: https://...
user avatar
4 votes
Accepted

Reason for lack of asymmetric cryptography in AWS KMS for regions in China

Asymmetric encryption was only introduced to AWS KMS in 2019. Prior to that, only symmetric encryption was available regardless of which region you were using. Even when AWS made the official ...
user avatar
  • 3,536
4 votes
Accepted

WHOIS Contact Details Abused

people abusing the information within my WHOIS, which if I remember is protected by international laws, or at least should be. I'm pretty sure there's nothing at all to that effect. There are terms ...
user avatar
  • 7,680
3 votes

Can a user login credentials and/or secret questions be considered PII under EU regulations?

A password is not considered PII because it's not something that can be used to identify a person. By contrast, all the others you're listing can be used to do that. Also, notice there are different ...
user avatar
3 votes

Retention periods for web logs

SOX has a 7-year requirement. This SANS Whitepaper (2010) might not be authoritative, but it highlights the matrix of best-practices between various requirements.
user avatar
  • 123k
3 votes

Can an indie apps developer get fined if they unintentionally didn't protect users' data from hackers?

First of all, don't trust any legal advice from a Q&A site on the internet. I am not a lawyer, but I can give you some pointers at least: It mostly depends on your place of jurisdiction. Laws are ...
user avatar
  • 7,204
2 votes

Regulations that specify password length?

NIST SP 800-63b [in draft] now provides detailed guidance for passwords at different levels of authentication levels. A Memorized Secret (a.k.a 'password') SHALL be at least 8 characters in ...
user avatar
  • 123k
2 votes

Unable to completely enforce password policy

There is one compensating control you can implement: Don't allow the users to select password, instead, change the password to a random one each time the user selects to change password. Of course, ...
user avatar
2 votes
Accepted

Do users data from europe have to be stored in the EU?

They don't have to store the data in the EU as long as the data is treated in the other country as if it was stored in the EU. So for example, storing the data in the US is only possible thanks to ...
user avatar
2 votes

How to timestamp a document without electronic signature under eIDAS

Let's start with full disclosure: I work as a software developer for Disig a.s. - Trust Service Provider from Slovakia - and I'll use our products and services to demonstrate the technology I'll ...
user avatar
  • 121
1 vote
Accepted

How to timestamp a document without electronic signature under eIDAS

The usual implementation of eIDAS time-stamps is specified in EN 319 422, which itself is based on RFC 3161. According to RFC 3161 a time-stamping request only requires a hash value of the data to ...
user avatar
  • 116
1 vote

How can I prove that I adhere to stated privacy policy? What audits are effective for voluntary compliance?

In the European Union you have the GDPR (General Data Protection Regulation) that will be enforced on May 25th, 2018 for all member states (that includes United Kingdom). Until now there has been a ...
user avatar
  • 385
1 vote

Differences in classified data handling

No, there are many different requirements for handling information at various levels of classification. What is more, these requirements are going to vary by country, but they include not only the ...
user avatar
  • 35.4k
1 vote

What are the privacy differences with Azure trustee delegates in China, Germany, and other locations?

Specifically for the German one, Microsoft is an American company, therefore subject to American laws. Among many other things, such laws include the possibility to request information from an ...
user avatar
  • 1,163
1 vote
Accepted

What is the minimal security standard needed for this type of software product

What is the minimal security standard that the product needs to meet? This largely depends on procurement requirements you are trying to meet. For US federal government the bare minimum to get on ...
user avatar
1 vote

scans for WIFI access points

1: You should scan everywhere a wireless client in-scope may reach, but also everywhere near all locations that are in-scope. Outdoor scans is not neccessary if you don't also have wifi clients ...
user avatar
1 vote

Security requirements of storing ID numbers in database EU/USA?

Above all: every use of individual related data has to be reported if there isn't an explicit exception! So if the excel sheet contains names, addresses, telephone numbers etc. I would definitely talk ...
user avatar
  • 103
1 vote
Accepted

UK or EU regulations that require Security Awareness Training

I knew it had to be in DPA somewhere...while not an explicit reference to training/awareness, Data Protection Act 1998, Schedule 1, Part II, paragraph 10 states: The data controller must take ...
user avatar
  • 2,923

Only top scored, non community-wiki answers of a minimum length are eligible