107

As per PCI, the first 6 (BIN) and the last 4 can be shown, others should be masked: From an official 2008 PDF: PCI Data Storage Do’s and Don’ts: Never store the personal identification number (PIN) or PIN Block. Be sure to mask PAN whenever it is displayed. The first six and last four digits are the maximum number of digits that may be displayed. ...


33

Some of the non DBA workers (DEV, Fraud, analysts ... ) in my organization need direct access to databases to write their own queries. ... PCI DSS requirement 8.7 stats "Only database administrators have the ability to directly access or query databases" The usual way of handling this is to create a scrubbed version of the database, with PAN data and ...


19

Just remember that sensitive does not mean secret. The card number is "sensitive" because it can be used to initiate financial transactions, but it is not secret. Only the PIN code is. Earlier, the full number was written down on the receipt, like the full account number is written on a check. As online businesses use only VISA card numbers without ...


14

I believe the National Institute of Standards and Technology (NIST) publishes the United States Government Configuration Baseline (USGCB, formerly known as Federal Desktop Core Configuration or FDCC) checklists, which specify the password complexity, lifetime, and history requirements for U.S. federal organizations. Also, the Center for Internet Security (...


12

To be honest the "official documentation" for all of these standards is incomplete, and as a CISSP in the industry it's really annoying. How I look at it is that no one is going to approve you if you have known vulnerabilities in your software, period. The authority for this is the Community Emergency Response Teams (CERT), and CERTs issue CVE numbers for ...


12

In the USA, the Fair and Accurate Credit Transactions Act of 2005 (FACTA) prohibits printing more than five digits of a credit card number. So while your receipt complies with PCI regulations, it wouldn't comply with the law if you were in the US. However your profile says you're in Slovenia, and I'm not aware of any similar Slovene or EU laws.


10

Common Criteria is a checkbox on DoD and other government department procurement processes. As you are probably aware, CC evolved from TCSEC in the states and combined ITSEC (Europe) and CTCPEC (Canada). So there are those that argue that Common Criteria sets down a standard model of security awareness for any product that goes through its process. With ...


9

AFAIK, you cannot. If you want to be conformant to th PCI DSS, neither devs nor analysts should directly access the production database. Once that has been said, you should wonder why they need direct access to the production database. Devs normally should be satisfied by a dev database containing fake data, provided the size is coherent for performance ...


8

I don't think there are going to be any guarantees. If there is not previous case law on topic, then I would expect this to come down to an assessment of credibility, based upon the testimony of the people involved, possibly testimony from expert witnesses, and the rest of the circumstances surrounding the court case. Keep in mind that the legal process ...


8

It is not PCI compliant (emphasis added): Never store the personal identification number (PIN) or PIN Block. Be sure to mask PAN whenever it is displayed. The first six and last four digits are the maximum number of digits that may be displayed. This requirement does not apply to those authorized with a specific need to see the full PAN, nor does it ...


7

The short answer is that when you put your data on the cloud the provider has the technical capability to do what they want with it. They could sell it, trade it, share it, etc. What is keeping them from doing just that is a) the terms of service or contract agreed (read it to make sure they don't have rights to your data as some claim rights over anything ...


7

Since there's about 1 billion of Visa cards in circulation worldwide (there were 883.5 millions in 2012) and each card has 14 unique digits (the first one is always 4 and the last one is the checksum), it would take 50.000 guesses on average to find a valid number without any prior info. Suchwise, if the hacker is not interested in guessing your number in ...


6

This practice is horribly insecure, and unfortunately way too frequent. As acoolguy said, you can write direct complaints to the bank and your financial ombudsman, but you'll usually end up howling into the wind. If the bank has dealing with payment processing companies such as Visa or Mastercard, you could try contacting them. Often, they have strict rules ...


6

Yes. A payment handler (e.g. Amazon, Netflix, Thames Water, Comcast) must not store CVV and must mask the PAN (card number), assuming that they are contractually bound to the Payment Card Industry Data Security Standard (PCI-DSS) by their bank. The card issuer, however, has no such restrictions. They issued the card and they are ultimately responsible for ...


5

I've seen a similar example implemented in a site with online coursed for students. The parent would create a "parent account", pay for the course and then be able to create a "student account" for their kid. The kid would now have access to the courses for a certain period of time and the parent would be able to track his progress, see what videos he has ...


5

There's an interesting discussion on this topic. I would agree with this assessment that a virtual drive holding the encryption key would not qualify as FIPS 140-2 compliant. In the security policy, §2.3 describes the platforms on which the certification applies: it lists several versions of Windows, with no reference to any particular hardware. Then §6 ...


5

Most legislation and regulations will not prescribe specific time frames for preserving logs. For example the National Archives Records Control Schedules (RCS) vary according to the document type and are adjustable by agency mission and organic legislation. If you can't find better, the FEDERAL RCS are an authoritative basis for specifying retention time ...


5

As another user has stated, per PCI-compliance rules, this is perfectly acceptable. I wanted to clarify a bit exactly why things are this way. First off, the first six digits of the card number constitutes the BIN, a number which is considered "well-known". This is a number assigned to the institution that issued your card, and all other cardholders who are ...


4

There are no Cloud-specific ones I am aware of, however you should definitely think about SoD: Most Financial Audit regulations require Segregation of Duties (SoD), and generally these are relatively easy to manage in a traditional environment. In a virtualised environment (I'm looking at the wider scope of 'cloud' here) front and back office IT may end up ...


4

An asset is whatever your company considers that have value for its business. Information asset is every asset related to information, that in theory, could be anything from people, technology, physical sites, devices, documents, etc. Choosing a correct scope for ISO 27001 can be difficult. If you broaden it too much, it will be difficult to implement the ...


4

MasterCard and VISA enforce very strict regulations on any system which operates in any way in the vicinity of their precious credit cards. If a bank or an ATM operator lets the communication be tapped, then the VISA thugs will skin them alive, trample their organs, then expose their dismembered bodies on the Wall Street Bull, as a warning for other banks. ...


4

Since you are looking for ANY regulatory body, whether applicable to you or not, Department of Defense Instruction 8500.2, Information Assurance Implementation states: For systems utilizing a logon ID as the individual identifier, passwords are, at a minimum, a case sensitive, 8-character mix of upper case letters, lower case letters, numbers, and ...


4

people abusing the information within my WHOIS, which if I remember is protected by international laws, or at least should be. I'm pretty sure there's nothing at all to that effect. There are terms and conditions put in place by service provider companies, but at best people are bound by them as far as they are enforced. There is very little "international ...


4

A password is not considered PII because it's not something that can be used to identify a person. By contrast, all the others you're listing can be used to do that. Also, notice there are different levels of PII. An email and phone number have a 1:1 relation with an identity, while a pair secret question-answer and a IP address might not be directly linked ...


3

EU directive 1999/93/EC (and its upcoming replacement) enforces legal equivalence between a qualified electronic signature and a handwritten signature in all Member States, and "some legal value" for other types of advanced electronic signatures. However, this directive do not address "handwritten digital signatures" but actual electronic signatures, as ...


3

The answer to your question would be: no. The reason behind it being that the only one losing a bit of money if all of your previous mentioned exploits were possible, would be the bank. A bit of money you say? Yes a bit of money, the money you can loose with an ATM are rather low compared to, for instance, SWIFT transactions. Now does that mean there aren'...


3

We have consulted several in this space in this past 6 months. The emerging group for Security reference materials around cloud computing is the https://cloudsecurityalliance.org/ If you are developing an application to ride on the Service Provider stack - there are some great recommendations from the CSA on what to ask your provider and what minimum ...


3

The first question you have to ask is "Does HITECH (and by extension HIPAA) affect my company?" Do you store files with protected information in them? Do you move files with protected information in them? If the answer to either of those questions is YES, then you must examine the security of your organization. Make sure physical and digital access to files/...


3

It is certainly a very bad practice on the bank's part. You can write an email to banking ombudsman in your country asking for clarification on this issue. On your email copy the customer service department of the said bank. These laws differ in every country so it is hard to answer your question. Just make sure that before making it public i.e. posting on ...


Only top voted, non community-wiki answers of a minimum length are eligible