withoutfire
  • Member for 4 years, 8 months
  • Last seen more than a week ago
SAQ-D Service Provider without a CDE
4 votes

This depends how you do the integration with the payment processor. Let's pretend for a minute you are a merchant - then the correct SAQs would most probably be SAQ A or SAQ A-EP depending on the ...

View answer
How does a card issuer comply with PCI if they have to print PANs in clear text?
3 votes

@gowenfawr is correct, stored PAN would be encrypted, but decrypted in the card production process. But the standard that applies to card issuing and personalization is the PCI Card Production ...

View answer
How does collecting sensitive data using iframes increase security?
Accepted answer
3 votes

You ask a great question and the technical reason that iframes add a layer of security is covered in many of the above answers. However, you also correctly observe that if an attacker has access to ...

View answer
PCI-DSS for Financial Institutions and Issuer
3 votes

As a card issuer your requirement for compliance will come from the rules of the card scheme (i.e. Visa or Mastercard). I mostly know Visa Europe's rules but understand that Mastercard's rules are ...

View answer
Using an unknown hash algorithm for passwords and be PCI-compliant?
Accepted answer
3 votes

The key phrase in 8.2.1 is 'Strong Cryptography' which is defined in the glossary as: Cryptography based on industry-tested and accepted algorithms, along with strong key lengths (minimum 112-...

View answer
File Integrity Monitoring via Syslog-ng or agentless - is it possible?
Accepted answer
2 votes

PCI DSS requirement 11.5 requires a change detection mechanism (ie it doesn’t have to be FIM) for modification of files, not devices. 11.5 Deploy a change-detection mechanism (for example, file-...

View answer
Can biometric vectors (i.e. fingerprint vector) be considered as Sensitive Authentication Data (SAD) in PCI?
Accepted answer
2 votes

I'd say no. SAD is information relied on by the card issuer to authenticate a transaction. So PINs/PIN Blocks, full track data and CVC2 are all placed on the card by the issuer (OK, that is simplistic ...

View answer
PCI scope for credit card forms that talk to Stripe, Braintree, etc
Accepted answer
2 votes

There are three FAQs on the PCI SSC website that will help you to answer this question. https://pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/Why-is-SAQ-A-EP-used-for-Direct-Post-...

View answer
PCI Compliance - Service Provider vs Merchant
Accepted answer
2 votes

Welcome to the strange world of PCI DSS compliance. The merchant has a contractual relationship with its acquiring/merchant bank (aka acquirer) to comply with PCI DSS. How the merchant demonstrates ...

View answer
Cardholder info transmission between issuing and acquiring banks
2 votes

Typically the issuer does not provide such information to the acquirer/merchant. It will only provide information about the authorization of a transaction (ie accept / decline etc). It will, in ...

View answer
PCI Compliance & Third Parties
Accepted answer
2 votes

Although Conor is correct in his assessment of the entropy of payment cards and hashing, PCI DSS is very clear, that a hashed PAN in an environment where the PAN does not exist (e.g. the third party ...

View answer
PCI DSS compliance on storing email body in database which contains plain text password
Accepted answer
2 votes

That's a really interesting question, and initially because you said that there was a forced password change on first login, I had thought you’d be able to make a convincing argument that the account ...

View answer
Are PCI DSS standard requirements regarding TLS applicable only to customer facing webs or to whole even internal networks?
Accepted answer
2 votes

There is no requirement in PCI DSS to encrypt cardholder data in transit over private (ie not the internet and not wifi) networks. Therefore if you are using early TLS or SSL on an internal wired ...

View answer
PCI P2PE running as independent software on POS?
2 votes

I guess it depends on what you mean by POS, because this isn't really a defined term. A POI (point of interaction) is something typically that interacts with a card and a person. Some POIs have card ...

View answer
Payment device compliance of PCI v2 AND PCIv3
2 votes

I'm going to assume that when you say PCI v2 and PCI v3 you mean the PCI PTS POI standard - ie the one for physical devices that include pin entry or are secure card readers. I’d personally be very ...

View answer
Storing customer credit card information for manual processing later
Accepted answer
2 votes

PCI DSS does not prohibit the storage of the Primary Account Number (PAN). Stored PAN just needs to be protected per PCi DSS requirement 3. You can also store the CVV2 value at with the PAN until the ...

View answer
Required security for storing bank transactions, but not credentials
2 votes

If you’re not a merchant (ie you don't take payment cards) and you are not a service provider to merchants or banks, then there is probably no one who is contractually asking you to comply with PCI ...

View answer
sensitive data temporarily stored, then redacted: PCI compliant?
2 votes

The simple answer is no - that would most likely not be complaint with the requirements in PCI DSS. Sorry. You may get two types of payment card data, the 15/16 digit cc numbers (PCI calls these ...

View answer
PCI : scope debate : API consumers
Accepted answer
1 votes

The core question is whether System A is connected to or, if compromised, could impact the CDE (for example, authentication servers) (v3.2.1 p10 scoping) In this case I'm assuming system B is your ...

View answer
PCI DSS -- eWallet Not storing just displaying Virtual PAN
1 votes

This is a multi-faceted question. And I'm sorry but much of this answer consists of questions you need to answer: 1. PCI Compliance Compliance with any of the 15 PCI standards is a contractual ...

View answer
What exactly are the characteristics of TLS required by PCI DSS and which reference describes these?
Accepted answer
1 votes

My question to be concise is; is there any authoritative source, specifically a framework/standard that meets the PCI requirement of something that can be followed for your implementation, of all the ...

View answer
PCI Compliance and multi tenancy?
1 votes

From the description of your service, your merchants (and I'm assuming they are small merchants, so SAQ eligible) will be required to provide an SAQ A-EP to their acquiring banks. There's lots of ...

View answer
PCI DSS Protectecting Card Data Elements when Transmitting PAN
1 votes

Petris's answer is correct. To answer your question from a general perspective. All the PCI DSS requirements apply to systems that store, process or transmit PAN. Per Page 7 of PCI DSS v3.2.1 The ...

View answer
Monitoring User (developer) interaction
1 votes

Tamper proof monitoring may be used as a compensating control to meet requirement 6.4.2 in respect of separation of duties between Dev/Test/Prod environments. Remember that DSS was written pre-DevOps :...

View answer
Storing credit card information - encrypted at rest
1 votes

You may find PCI SSC FAQ 1233 useful. "How does encrypted cardholder data impact PCI DSS scope for third-party service providers?" https://pcissc.secure.force.com/faq/articles/...

View answer
Which Authentication mechanism to choose for PCI-DSS system
1 votes

The only requirement that directly relates to session management is 6.5.10 which is very general: 6.5.10 Broken authentication and session management. Secure authentication and session management ...

View answer
Is it allowed to store 8-digit BINs outside of CDE
Accepted answer
1 votes

You've found the two FAQs that are relevant. The FAQs have the same authority as the standard, they expand and clarify it but are written, reviewed and approved by the working group that also writes ...

View answer
Is PCI - DSS required to store only card number
Accepted answer
1 votes

Yes - if you store, process or transmit cardholder data you need to comply with PCI DSS. I’d really question your decision to store the 16-digit PAN (credit card number) in the database - Stripe has ...

View answer
Is taking CC info in plain HTML elements, but using a library like Stripe to tokenize PCI compliant?
1 votes

You need to be very careful to understand if you are embedding an IFRAME from Square/Stripe or using JavaScript libraries. As the IFRAME or full redirect is currently classed as outsourcing as Joe ...

View answer
Is a bank's affiliate that provides services to the bank issuer required to show compliance or certification to PCI DSS
1 votes

Both Visa and Mastercard require their issuing banks to only use third party service providers that are compliant with the relevant PCI standards. So it all depends on what services are being provided ...

View answer