322
questions
0
votes
1
answer
113
views
Can I send encrypted Credit Card data to my non-PCI server for sending it to a PCI Credit Card Service? WITHOUT STORING THE DATA ON MY SERVER
I am working with a payment gateway, which offers me a method to tokenize credit cards, should I send the cc data from the frontend or should I send the (encrypted) data to my backend and then to the ...
1
vote
1
answer
76
views
GKE & PCI DSS ASV Scans
For PCI DSS certification in GKE, the question is on ASV scans. Does Google already scan the load balancers or is the client responsible for scanning their own sites hosted in the GKE? Is there a list ...
0
votes
1
answer
85
views
Credit card validation with Auth.net meeting PCI compliance
Our company uses e-commerce sites to sell products. They include sites like Kalio, Magento, and Amazon. As we have an ERP backend system, we have the e-commerce site run the initial CC validation ...
0
votes
1
answer
116
views
CVE-2021-38628 in nodeJs
Description:
Disable the use of TLSv1.0 protocol in favor of a cryptographically stronger protocol such as TLSv1.2.
The following openssl commands can be used to do a manual test: openssl s_client -...
5
votes
1
answer
236
views
has anyone undergone certification of PCI-DSS using general purpose HSM (and not payshield)?
can we utilise a general purpose HSM for EMV related work ? like ARQC/ARPC ? PCI guidelines do not specifically prohibit general purpose HSM from being used. There are certain constraints (e.g. ...
0
votes
1
answer
245
views
Is it PCI compliant to create PaymentIntent directly from my Flutter app?
I have tried different ways to handle payment via no webhook flow, but the only solution is to call stripe API directly from my dart code as follows:
var response = await http.post(
Uri.parse('...
1
vote
2
answers
174
views
PCI DSS Compliance when extracting data for analysis
Here's the scenario: I've got 2 subnets. 1 is PCI DSS Compliant and the other one is not.
Can I extract data to process on Kafka from the PCI compliant subnet into the non-compliant one?
tl;dr
Data ...
1
vote
0
answers
231
views
Masking Card Data Using log4j2
I want to mask track data , card data and etc , my pattern of logging is as follows
plain text : userID=1234|trackData=789654asdas|pin=897|userName=445566
Masked text : userID=1234|trackData=|pin=|...
0
votes
1
answer
82
views
Objective of PCI DSS 3.4 is only for physical theft of disk?
To implement a PCI DSS compliant solution you must satisfy 3.4 requirement:
"Render PAN unreadable anywhere it is stored (including on portable digital media,
backup media, and in logs) by using ...
0
votes
1
answer
187
views
Braintree how to use stored credit card for payments
I have the Nuxt (Vue2) application with Braintree DropIn implementation. Everything works except the stored cards. I would like to activate the card which was used as the last one on DropIn load. ...
0
votes
1
answer
121
views
Displaying Credit Cards on User Profile
I'm having a problem understanding this concept. I'm using a payment gateway, and I'm not storing the credit card details anywhere. I get the payment information by using hosted payment fields. I want ...
0
votes
1
answer
99
views
GCP compliance manager - are there API to download reports?
I need to pro-grammatically download few compliance reports available at GCP compliance manager link - https://cloud.google.com/security/compliance/compliance-reports-manager
are there API available ...
0
votes
0
answers
761
views
Tenable Nessus to approve PCI DSS: Microsoft ASP.NET MS-DOS Device Name DoS (PCI-DSS check)
RequestFiltering not working for MS-DOS device name paths
I have the same question but I have one app service in Azure.
This was scanned by Tenable Nessus to approve PCI DSS
CVE: CVE-2007-2897
BID: ...
0
votes
1
answer
987
views
How do I perform a security scan on an Angular 7 app?
We run several security scans on traditional web applications built with JSP, JSF, ASP, etc. and we know to scan them for security vulnerabilities (we use McAfee Secure PCI Compliance Scanning).
...
1
vote
0
answers
177
views
Certifications needed for FinTech companies
I am trying to do some research on all the types of certifications needed for a FinTech company like PCI-DSS, etc. What all other certification can be used by the company, in terms of IT security as ...
0
votes
1
answer
422
views
Internal Vulnerability Scan and Pen testing on Elastic Beanstalk for PCI DSS
We are currently building a PCI DSS Level 1 Compliant platform that will run only one application server on Elastic Beanstalk (Linux AMI). The Elastic Beanstalk instance, which will reside inside a ...
1
vote
0
answers
185
views
Deep Packet Inspection with mTLS
Greetings and happy Friday!
I have somewhat of an interesting question for the networking and/or GRC Junkies in the room...
I have a customer who has a requirement for:
Mutual TLS (mTLS) on outbound ...
0
votes
1
answer
105
views
Azure Compliance for Web Application
I understand Azure has many compliance certifications (SOC2, ISO27000 etc - a whole list can found here: https://azure.microsoft.com/en-us/overview/trusted-cloud/compliance/).
Does hosting an ...
2
votes
1
answer
1k
views
Azure PCI Compliance CPE Based Vulnerabilities for Microsoft IIS httpd 10.0
Hi my azure web application (dotnet core 3.1) was giving a green flag for PCI Compliance until couple of days.
However I received an email from the certification providing stating that the application ...
0
votes
0
answers
211
views
Configuring Omnipay-stripe to work with PCI SCA using Laravel
I'm following the example on Stripe Payment Intents to enable PCI SCA card processing, but receive the following error:
dev.ERROR: Call to undefined method Omnipay\Stripe\Message\Response::...
2
votes
1
answer
4k
views
Laravel 7 Missing `httpOnly` Cookie Attribute
I scan my application using PCI Scanner from Clone-system.
It show 1 vulnerabilities -> Missing httpOnly Cookie Attribute.
This is the report
https://i.sstatic.net/00tc3.jpg
This is my session.php
&...
2
votes
0
answers
202
views
Azure HSTS security on ports 454 and 455
I'm working with a client on their Azure instance to get them PCI compliant. Scans from BeyondSecurity.com continue to come back with
HSTS Missing From HTTPS Server [site.com:454]
HSTS Missing From ...
0
votes
0
answers
40
views
PCI Compliance - App hosted on AWS no card data stored
I am researching PCI compliance for an app I plan to build. It would essentially be an online market place. I will be using MangoPay as the payment processor (who are level 1 PCI compliant) along with ...
1
vote
2
answers
1k
views
Sending PCI data through Node.js (authorize.net)
A client has asked me to set-up card payments through authorize.net. However, I've noticed the node SDK hasn't been updated in a year and their Node SDK is only mentioned on some of their doc pages (...
0
votes
1
answer
944
views
How to ensure PCI Compliant for HTML and Ajax request
I am integrating eWay payment gateway in PHP with recurring payment. It is for Australia region. I have prepared the below HTML form:
<form action="submit.php" method="post" id="signup-form" class=...
0
votes
1
answer
278
views
Can I calculate data integrity check for RSA keys using the key itself?
I'm developing a solution which stores in a DB, for each customer, an RSA key which will be used to sign payments.
Those keys are so called SIM keys created via an SKS HSM, long story short we don't ...
2
votes
1
answer
608
views
Adding X-meli-session-id Header in MercadoPago SDK
My requirement is to add X-meli-session-id Header in the payment request to MercadoPago, but i cant find a way to add a extra header, I'm using mercadopago SKD "dx-java-1.0.33" and the request is done ...
1
vote
2
answers
648
views
Are private-label credit cards (PLCC) exempt from PCI-DSS?
We are currently tokenizing all MasterCard and Visa cards accepted on our site and not storing card data, but we do not do the same for private-label cards. The private-label cards aren't backed by ...
2
votes
1
answer
459
views
.NET Core Blazor PCI compliance
I am not too sure about PCI compliance, but what I believe is that it can be summed up to "don't let the credit card data hit your server". So any post request would basically mean that the data ends ...
1
vote
1
answer
3k
views
Using Stripe API with Flutter Dio package Flutter to Add Cards, Payment Methods, Accounts
Noobish Dev here. I'm developing an app that involves processing payments between customers and a particular service, the app would take a fee and pay the service provider directly to their bank ...
0
votes
1
answer
268
views
When tokenizing credit card information, does it make sense tokenize every credit card attribute in order to be PCI compliant?
For example, if credit card has the following attributes:
First Name
Last Name
Credit Card Number
CVV
Expiration
Is tokenizing just the Credit Card Number enough to be PCI compliant?
...
0
votes
1
answer
2k
views
Fix Ubuntu 16 sweet32 vulnerability
While doing PCI scan our ubuntu16 web servers with apache and nginx has marked failed against Birthday attacks against TLS ciphers with 64bit block size vulnerability (Sweet32).
THREAT:
Legacy ...
0
votes
0
answers
160
views
Should I use separate databases for HIPAA and PCI-DSS compliant data?
My question is mostly theoretical, but if I have an application (for example for a private clinic) which stores their patient's health information (HIPAA), accepts payments with cards and stores ...
1
vote
2
answers
451
views
Single-Page Application, APIs, and PCI Compliance
Has anyone worked through the reasoning that if I have a single-page application (SPA) whose HTML and JavaScript are hosted on Server X, sending credit cards to a remote API hosted on Server Y, does ...
-1
votes
1
answer
43
views
Need resources and suggestions on how Payments work (authorization settlement clearing) from a cryptographic perspective [closed]
I am trying to understand how transactions, credit cards (magstripes, chips, ..), e-commerce,.. work from a cryptographic perspective.
What kind of algorithms are used, how to ensure Confidentiality, ...
1
vote
1
answer
40
views
How to Collect Credit Card Info and Charge the Winner of an Auction [closed]
We are looking into adding an auction feature to our online service. Ideally, we would like to be able to ask for a users credit card information at the time of placing a bid and then only charge the ...
2
votes
1
answer
43
views
PCI Standards end to end encyption
In order to comply with all due diligence is required to encrypt all sensitive data when stored and transfer such as cards, address, sex, names, etc.
I know TLS 1.3 encrypts all the data. But the ...
0
votes
2
answers
2k
views
OpenSSL 1.1.1 < 1.1.1d Multiple Vulnerabilities causing PCI Scan failure?
We've got OpenSSL 1.1.1d installed on a windows server 64 Bit running Apache 2.4.*. Everything was working fine until recentlly (Jan 2020) when our daily PCI scan failed with the following synopsis: ...
4
votes
0
answers
845
views
PCI Compliance SAQ A-EP with direct post instead of iframe
For mobile apps, is direct post able to be used with SAQ A-EP? My prior understanding was that only iframe was eligible for this, but there seems to be an unspecified allowance (see below). It makes ...
1
vote
1
answer
307
views
PCI HTTP header security requirements and AWS CloudFront
I have a web site that does E-commerce. We've been dinged about our security not being PCI DSS compliant because our AWS based servers are returning an HTTP response with:
Server: CloudFront
as ...
0
votes
1
answer
70
views
Guidelines for PII data in use in cloud
There are guidelines on PII data in transit and at rest. What are the guidelines on using PII data in plain text in the logic? (in use at runtime)
0
votes
1
answer
147
views
Is TLSv1.3 recommended today in production
Security guides (PCI-DSS, NIST, www.ncsc.gov.uk, french ANSSI ..) state that TLSv1.2 only should be allowed, and that TLSv1.0 TLSv1.1 should be desactivated.
There is no security guide that give any ...
1
vote
1
answer
429
views
Is Azure Front Door PCI-DSS Compliant?
Azue Front Door supports TLS versions 1.0, 1.1 and 1.2. Currently removing TLS versions 1.0, 1.1 from Azure Front Door is not supported.
PCI standards requires that protocols TLS 1.0, 1.1 can no ...
8
votes
2
answers
5k
views
PCI failed for Script Src Integrity Check for google js
I have used this in my code:
<script type="text/javascript" src='https://www.googleadservices.com/pagead/conversion.js'></script>
In PCI Scan i received error for this saying "Script ...
2
votes
1
answer
3k
views
Is Google Cloud Storage PCI compliant?
Here is the Google Cloud Platform: Customer Responsibility Matrix. This document basically goes through all of the PCI DSS requirements and explains what is done by GCP and what is supposed to be done ...
0
votes
1
answer
194
views
Is this set-up PCI DSS compliant?
Setup:
Mobile uses Stripe to get credit card token.
Mobile sends token to Server 1.
Server 1 gets credit card details using the token.
Instantly, the Server 1 encrypts the details and sends it to a ...
0
votes
1
answer
422
views
How to make Google Cloud SQL Instance PCI compliant?
I’m securing my Google Cloud SQL Instance to be PCI DSS compliant,
but when I’m scanning the server I get a critical warning over port 3307
saying that accepting a TLSv1.0 is not permitted. Where
...
0
votes
1
answer
805
views
Firebase Hosting PCI Compliance
We have built a web application platform considering the Firebase as the centre of the technology and at this point when we need to submit the PCI DSS our system is failing the test, because it is all ...
1
vote
1
answer
284
views
PHP Storing card data using PCI Standards OR using a third party to store card data?
So I'm facing a challenging issue today. I'm currently working on the payment interface of an app I'm developing. I have to give the apps future users the option to store and edit their payment card ...
0
votes
2
answers
3k
views
How to mark files in a GCP storage bucket as Read Only for "everyone"?
We have a storage bucket which has sensitive data stored in it, in the form of JSON files. For a PCI compliance, we have to make these files read only.
Versioning will be enabled on the bucket so ...