106

As per PCI, the first 6 (BIN) and the last 4 can be shown, others should be masked: From an official 2008 PDF: PCI Data Storage Do’s and Don’ts: Never store the personal identification number (PIN) or PIN Block. Be sure to mask PAN whenever it is displayed. The first six and last four digits are the maximum number of digits that may be displayed. ...


33

Some of the non DBA workers (DEV, Fraud, analysts ... ) in my organization need direct access to databases to write their own queries. ... PCI DSS requirement 8.7 stats "Only database administrators have the ability to directly access or query databases" The usual way of handling this is to create a scrubbed version of the database, with PAN data and ...


21

SOC 2 Type 2 does not have specific technical requirements. What you have to do is to satisfy your assessor. And if your company cannot satisfy your assessor, then there is a mechanism called "management response" where the company gets to explain away the findings from the assessor. And if your assessor is 4 years behind in their understanding of best ...


20

Just remember that sensitive does not mean secret. The card number is "sensitive" because it can be used to initiate financial transactions, but it is not secret. Only the PIN code is. Earlier, the full number was written down on the receipt, like the full account number is written on a check. As online businesses use only VISA card numbers without ...


12

In the USA, the Fair and Accurate Credit Transactions Act of 2005 (FACTA) prohibits printing more than five digits of a credit card number. So while your receipt complies with PCI regulations, it wouldn't comply with the law if you were in the US. However your profile says you're in Slovenia, and I'm not aware of any similar Slovene or EU laws.


9

AFAIK, you cannot. If you want to be conformant to th PCI DSS, neither devs nor analysts should directly access the production database. Once that has been said, you should wonder why they need direct access to the production database. Devs normally should be satisfied by a dev database containing fake data, provided the size is coherent for performance ...


8

Yes. A payment handler (e.g. Amazon, Netflix, Thames Water, Comcast) must not store CVV and must mask the PAN (card number), assuming that they are contractually bound to the Payment Card Industry Data Security Standard (PCI-DSS) by their bank. The card issuer, however, has no such restrictions. They issued the card and they are ultimately responsible for ...


8

It is not PCI compliant (emphasis added): Never store the personal identification number (PIN) or PIN Block. Be sure to mask PAN whenever it is displayed. The first six and last four digits are the maximum number of digits that may be displayed. This requirement does not apply to those authorized with a specific need to see the full PAN, nor does it ...


7

Since there's about 1 billion of Visa cards in circulation worldwide (there were 883.5 millions in 2012) and each card has 14 unique digits (the first one is always 4 and the last one is the checksum), it would take 50.000 guesses on average to find a valid number without any prior info. Suchwise, if the hacker is not interested in guessing your number in ...


7

The short answer is that when you put your data on the cloud the provider has the technical capability to do what they want with it. They could sell it, trade it, share it, etc. What is keeping them from doing just that is a) the terms of service or contract agreed (read it to make sure they don't have rights to your data as some claim rights over anything ...


6

Ok so after diving into this a bit, this is the best I can come up with. I do not work for the US government so I cant say anything with any level of confidence. However; It seems that the color classification system is largely based on convenience. Since the whole point of having the classification marked on the pages of each document provides a simple ...


5

Most legislation and regulations will not prescribe specific time frames for preserving logs. For example the National Archives Records Control Schedules (RCS) vary according to the document type and are adjustable by agency mission and organic legislation. If you can't find better, the FEDERAL RCS are an authoritative basis for specifying retention time ...


5

I've seen a similar example implemented in a site with online coursed for students. The parent would create a "parent account", pay for the course and then be able to create a "student account" for their kid. The kid would now have access to the courses for a certain period of time and the parent would be able to track his progress, see what videos he has ...


5

As another user has stated, per PCI-compliance rules, this is perfectly acceptable. I wanted to clarify a bit exactly why things are this way. First off, the first six digits of the card number constitutes the BIN, a number which is considered "well-known". This is a number assigned to the institution that issued your card, and all other cardholders who are ...


4

A password is not considered PII because it's not something that can be used to identify a person. By contrast, all the others you're listing can be used to do that. Also, notice there are different levels of PII. An email and phone number have a 1:1 relation with an identity, while a pair secret question-answer and a IP address might not be directly linked ...


4

MasterCard and VISA enforce very strict regulations on any system which operates in any way in the vicinity of their precious credit cards. If a bank or an ATM operator lets the communication be tapped, then the VISA thugs will skin them alive, trample their organs, then expose their dismembered bodies on the Wall Street Bull, as a warning for other banks. ...


4

An asset is whatever your company considers that have value for its business. Information asset is every asset related to information, that in theory, could be anything from people, technology, physical sites, devices, documents, etc. Choosing a correct scope for ISO 27001 can be difficult. If you broaden it too much, it will be difficult to implement the ...


4

people abusing the information within my WHOIS, which if I remember is protected by international laws, or at least should be. I'm pretty sure there's nothing at all to that effect. There are terms and conditions put in place by service provider companies, but at best people are bound by them as far as they are enforced. There is very little "international ...


4

Asymmetric encryption was only introduced to AWS KMS in 2019. Prior to that, only symmetric encryption was available regardless of which region you were using. Even when AWS made the official announcement for asymmetric keys on KMS, many regions did not get the functionality on day 1. Also, the two regions in China are somewhat special, in that they're ...


3

SOX has a 7-year requirement. This SANS Whitepaper (2010) might not be authoritative, but it highlights the matrix of best-practices between various requirements.


3

The answer to your question would be: no. The reason behind it being that the only one losing a bit of money if all of your previous mentioned exploits were possible, would be the bank. A bit of money you say? Yes a bit of money, the money you can loose with an ATM are rather low compared to, for instance, SWIFT transactions. Now does that mean there aren'...


3

tl;dr; Nobody can say for sure and this is highly debatable Little history: there was a change from "trusted execution environment" to "secure execution environment". It is documented here: https://www.eba.europa.eu/documents/10180/1761863/Final+draft+RTS+on+SCA+and+CSC+under+PSD2+(EBA-RTS-2017-02).pdf Most of the industry (that I know of) agrees that this ...


3

First of all, don't trust any legal advice from a Q&A site on the internet. I am not a lawyer, but I can give you some pointers at least: It mostly depends on your place of jurisdiction. Laws are quite diverse in regards to liability when it comes to cyber security. You should consult with a legal expert familiar with software liability in your place of ...


2

NIST SP 800-63b [in draft] now provides detailed guidance for passwords at different levels of authentication levels. A Memorized Secret (a.k.a 'password') SHALL be at least 8 characters in length if chosen by the subscriber; memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric....


2

Though I am not a expert on ISO27k standard following is how information asset is defined taken from FREE ISO27k Toolkit Information wherever it is handled or stored (e.g., in computers, file cabinets, desktops, fax machines, Xerox, printer, verbal communication etc.) needs to be suitably and appropriately protected from unauthorized access, modification, ...


2

After Sony's PSN network was hacked, there were many class action lawsuits filed against them all around the world. Some were dismissed by the judge, while others reached an expensive settlement. For example, this was the result of just one of the many lawsuits: Settlement approved in Canadian cyber attack suit Class Members who had a credit ...


2

Hummm tricky, but certainly possible. This is coming off of the top of my head so your mileage may very. You've been warned :-) My first thought would be to have multiuser accounts with different roles. For example: STUDENT & GUARDIAN. This way you can set up the accounts and be up and running with an automatic registration, for the STUDENT users, ...


2

This is confusing, perhaps partly explaining why the new 27001:2013 doesn't talk about assets in the main body any more. (Although of course effective asset management is an important security control and as such is discussed in Annex A.8 of 27001 and the corresponding Section 8 of 27002.) You are right that information assets are, by definition, ...


2

There is one compensating control you can implement: Don't allow the users to select password, instead, change the password to a random one each time the user selects to change password. Of course, only the user should know the random password, thus this password will not count as a "initial password" that needs to be immediately changed. Second thing you ...


2

Let's start with full disclosure: I work as a software developer for Disig a.s. - Trust Service Provider from Slovakia - and I'll use our products and services to demonstrate the technology I'll describe in this post. I've written several server-side and client-side products for time-stamping over the years so my perception of legislation/standards/reality ...


Only top voted, non community-wiki answers of a minimum length are eligible