Skip to main content
Filter by
Sorted by
Tagged with
0 votes
1 answer
113 views

Can I send encrypted Credit Card data to my non-PCI server for sending it to a PCI Credit Card Service? WITHOUT STORING THE DATA ON MY SERVER

I am working with a payment gateway, which offers me a method to tokenize credit cards, should I send the cc data from the frontend or should I send the (encrypted) data to my backend and then to the ...
Roman's user avatar
  • 320
1 vote
1 answer
76 views

GKE & PCI DSS ASV Scans

For PCI DSS certification in GKE, the question is on ASV scans. Does Google already scan the load balancers or is the client responsible for scanning their own sites hosted in the GKE? Is there a list ...
Wendy's user avatar
  • 11
0 votes
1 answer
85 views

Credit card validation with Auth.net meeting PCI compliance

Our company uses e-commerce sites to sell products. They include sites like Kalio, Magento, and Amazon. As we have an ERP backend system, we have the e-commerce site run the initial CC validation ...
j.hull's user avatar
  • 440
0 votes
1 answer
116 views

CVE-2021-38628 in nodeJs

Description: Disable the use of TLSv1.0 protocol in favor of a cryptographically stronger protocol such as TLSv1.2. The following openssl commands can be used to do a manual test: openssl s_client -...
kuollam's user avatar
  • 79
5 votes
1 answer
236 views

has anyone undergone certification of PCI-DSS using general purpose HSM (and not payshield)?

can we utilise a general purpose HSM for EMV related work ? like ARQC/ARPC ? PCI guidelines do not specifically prohibit general purpose HSM from being used. There are certain constraints (e.g. ...
Sandeep's user avatar
  • 1,825
0 votes
1 answer
245 views

Is it PCI compliant to create PaymentIntent directly from my Flutter app?

I have tried different ways to handle payment via no webhook flow, but the only solution is to call stripe API directly from my dart code as follows: var response = await http.post( Uri.parse('...
Marko's user avatar
  • 355
1 vote
2 answers
174 views

PCI DSS Compliance when extracting data for analysis

Here's the scenario: I've got 2 subnets. 1 is PCI DSS Compliant and the other one is not. Can I extract data to process on Kafka from the PCI compliant subnet into the non-compliant one? tl;dr Data ...
Ton's user avatar
  • 33
1 vote
0 answers
231 views

Masking Card Data Using log4j2

I want to mask track data , card data and etc , my pattern of logging is as follows plain text : userID=1234|trackData=789654asdas|pin=897|userName=445566 Masked text : userID=1234|trackData=|pin=|...
Sachin Pardeshi's user avatar
0 votes
1 answer
82 views

Objective of PCI DSS 3.4 is only for physical theft of disk?

To implement a PCI DSS compliant solution you must satisfy 3.4 requirement: "Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using ...
Sfp's user avatar
  • 549
0 votes
1 answer
187 views

Braintree how to use stored credit card for payments

I have the Nuxt (Vue2) application with Braintree DropIn implementation. Everything works except the stored cards. I would like to activate the card which was used as the last one on DropIn load. ...
Čamo's user avatar
  • 4,134
0 votes
1 answer
121 views

Displaying Credit Cards on User Profile

I'm having a problem understanding this concept. I'm using a payment gateway, and I'm not storing the credit card details anywhere. I get the payment information by using hosted payment fields. I want ...
Shooting Stars's user avatar
0 votes
1 answer
99 views

GCP compliance manager - are there API to download reports?

I need to pro-grammatically download few compliance reports available at GCP compliance manager link - https://cloud.google.com/security/compliance/compliance-reports-manager are there API available ...
user16025310's user avatar
0 votes
0 answers
761 views

Tenable Nessus to approve PCI DSS: Microsoft ASP.NET MS-DOS Device Name DoS (PCI-DSS check)

RequestFiltering not working for MS-DOS device name paths I have the same question but I have one app service in Azure. This was scanned by Tenable Nessus to approve PCI DSS CVE: CVE-2007-2897 BID: ...
Ismael Paredes's user avatar
0 votes
1 answer
987 views

How do I perform a security scan on an Angular 7 app?

We run several security scans on traditional web applications built with JSP, JSF, ASP, etc. and we know to scan them for security vulnerabilities (we use McAfee Secure PCI Compliance Scanning). ...
Joe DiNottra's user avatar
1 vote
0 answers
177 views

Certifications needed for FinTech companies

I am trying to do some research on all the types of certifications needed for a FinTech company like PCI-DSS, etc. What all other certification can be used by the company, in terms of IT security as ...
mr-nobody's user avatar
0 votes
1 answer
422 views

Internal Vulnerability Scan and Pen testing on Elastic Beanstalk for PCI DSS

We are currently building a PCI DSS Level 1 Compliant platform that will run only one application server on Elastic Beanstalk (Linux AMI). The Elastic Beanstalk instance, which will reside inside a ...
3rguy's user avatar
  • 31
1 vote
0 answers
185 views

Deep Packet Inspection with mTLS

Greetings and happy Friday! I have somewhat of an interesting question for the networking and/or GRC Junkies in the room... I have a customer who has a requirement for: Mutual TLS (mTLS) on outbound ...
johnesutton's user avatar
0 votes
1 answer
105 views

Azure Compliance for Web Application

I understand Azure has many compliance certifications (SOC2, ISO27000 etc - a whole list can found here: https://azure.microsoft.com/en-us/overview/trusted-cloud/compliance/). Does hosting an ...
NightlyHakr's user avatar
2 votes
1 answer
1k views

Azure PCI Compliance CPE Based Vulnerabilities for Microsoft IIS httpd 10.0

Hi my azure web application (dotnet core 3.1) was giving a green flag for PCI Compliance until couple of days. However I received an email from the certification providing stating that the application ...
Max's user avatar
  • 482
0 votes
0 answers
211 views

Configuring Omnipay-stripe to work with PCI SCA using Laravel

I'm following the example on Stripe Payment Intents to enable PCI SCA card processing, but receive the following error: dev.ERROR: Call to undefined method Omnipay\Stripe\Message\Response::...
AlexW's user avatar
  • 132
2 votes
1 answer
4k views

Laravel 7 Missing `httpOnly` Cookie Attribute

I scan my application using PCI Scanner from Clone-system. It show 1 vulnerabilities -> Missing httpOnly Cookie Attribute. This is the report https://i.sstatic.net/00tc3.jpg This is my session.php &...
Gypsum Hong's user avatar
2 votes
0 answers
202 views

Azure HSTS security on ports 454 and 455

I'm working with a client on their Azure instance to get them PCI compliant. Scans from BeyondSecurity.com continue to come back with HSTS Missing From HTTPS Server [site.com:454] HSTS Missing From ...
CadmusPaladin's user avatar
0 votes
0 answers
40 views

PCI Compliance - App hosted on AWS no card data stored

I am researching PCI compliance for an app I plan to build. It would essentially be an online market place. I will be using MangoPay as the payment processor (who are level 1 PCI compliant) along with ...
hassan's user avatar
  • 1
1 vote
2 answers
1k views

Sending PCI data through Node.js (authorize.net)

A client has asked me to set-up card payments through authorize.net. However, I've noticed the node SDK hasn't been updated in a year and their Node SDK is only mentioned on some of their doc pages (...
Luke Brown's user avatar
  • 1,882
0 votes
1 answer
944 views

How to ensure PCI Compliant for HTML and Ajax request

I am integrating eWay payment gateway in PHP with recurring payment. It is for Australia region. I have prepared the below HTML form: <form action="submit.php" method="post" id="signup-form" class=...
Rohit Mittal's user avatar
  • 2,104
0 votes
1 answer
278 views

Can I calculate data integrity check for RSA keys using the key itself?

I'm developing a solution which stores in a DB, for each customer, an RSA key which will be used to sign payments. Those keys are so called SIM keys created via an SKS HSM, long story short we don't ...
Leonardo De Santis's user avatar
2 votes
1 answer
608 views

Adding X-meli-session-id Header in MercadoPago SDK

My requirement is to add X-meli-session-id Header in the payment request to MercadoPago, but i cant find a way to add a extra header, I'm using mercadopago SKD "dx-java-1.0.33" and the request is done ...
Leonardo Martinez's user avatar
1 vote
2 answers
648 views

Are private-label credit cards (PLCC) exempt from PCI-DSS?

We are currently tokenizing all MasterCard and Visa cards accepted on our site and not storing card data, but we do not do the same for private-label cards. The private-label cards aren't backed by ...
jg99's user avatar
  • 11
2 votes
1 answer
459 views

.NET Core Blazor PCI compliance

I am not too sure about PCI compliance, but what I believe is that it can be summed up to "don't let the credit card data hit your server". So any post request would basically mean that the data ends ...
Edis Golubich's user avatar
1 vote
1 answer
3k views

Using Stripe API with Flutter Dio package Flutter to Add Cards, Payment Methods, Accounts

Noobish Dev here. I'm developing an app that involves processing payments between customers and a particular service, the app would take a fee and pay the service provider directly to their bank ...
Imy's user avatar
  • 11
0 votes
1 answer
268 views

When tokenizing credit card information, does it make sense tokenize every credit card attribute in order to be PCI compliant?

For example, if credit card has the following attributes: First Name Last Name Credit Card Number CVV Expiration Is tokenizing just the Credit Card Number enough to be PCI compliant? ...
Judy007's user avatar
  • 5,750
0 votes
1 answer
2k views

Fix Ubuntu 16 sweet32 vulnerability

While doing PCI scan our ubuntu16 web servers with apache and nginx has marked failed against Birthday attacks against TLS ciphers with 64bit block size vulnerability (Sweet32). THREAT: Legacy ...
nisamudeen97's user avatar
0 votes
0 answers
160 views

Should I use separate databases for HIPAA and PCI-DSS compliant data?

My question is mostly theoretical, but if I have an application (for example for a private clinic) which stores their patient's health information (HIPAA), accepts payments with cards and stores ...
jumpy's user avatar
  • 317
1 vote
2 answers
451 views

Single-Page Application, APIs, and PCI Compliance

Has anyone worked through the reasoning that if I have a single-page application (SPA) whose HTML and JavaScript are hosted on Server X, sending credit cards to a remote API hosted on Server Y, does ...
Eric's user avatar
  • 321
-1 votes
1 answer
43 views

Need resources and suggestions on how Payments work (authorization settlement clearing) from a cryptographic perspective [closed]

I am trying to understand how transactions, credit cards (magstripes, chips, ..), e-commerce,.. work from a cryptographic perspective. What kind of algorithms are used, how to ensure Confidentiality, ...
Endre's user avatar
  • 1
1 vote
1 answer
40 views

How to Collect Credit Card Info and Charge the Winner of an Auction [closed]

We are looking into adding an auction feature to our online service. Ideally, we would like to be able to ask for a users credit card information at the time of placing a bid and then only charge the ...
Matt T's user avatar
  • 128
2 votes
1 answer
43 views

PCI Standards end to end encyption

In order to comply with all due diligence is required to encrypt all sensitive data when stored and transfer such as cards, address, sex, names, etc. I know TLS 1.3 encrypts all the data. But the ...
fp007's user avatar
  • 452
0 votes
2 answers
2k views

OpenSSL 1.1.1 < 1.1.1d Multiple Vulnerabilities causing PCI Scan failure?

We've got OpenSSL 1.1.1d installed on a windows server 64 Bit running Apache 2.4.*. Everything was working fine until recentlly (Jan 2020) when our daily PCI scan failed with the following synopsis: ...
Enomatix24's user avatar
4 votes
0 answers
845 views

PCI Compliance SAQ A-EP with direct post instead of iframe

For mobile apps, is direct post able to be used with SAQ A-EP? My prior understanding was that only iframe was eligible for this, but there seems to be an unspecified allowance (see below). It makes ...
g491's user avatar
  • 361
1 vote
1 answer
307 views

PCI HTTP header security requirements and AWS CloudFront

I have a web site that does E-commerce. We've been dinged about our security not being PCI DSS compliant because our AWS based servers are returning an HTTP response with: Server: CloudFront as ...
wdtj's user avatar
  • 5,623
0 votes
1 answer
70 views

Guidelines for PII data in use in cloud

There are guidelines on PII data in transit and at rest. What are the guidelines on using PII data in plain text in the logic? (in use at runtime)
user3760894's user avatar
0 votes
1 answer
147 views

Is TLSv1.3 recommended today in production

Security guides (PCI-DSS, NIST, www.ncsc.gov.uk, french ANSSI ..) state that TLSv1.2 only should be allowed, and that TLSv1.0 TLSv1.1 should be desactivated. There is no security guide that give any ...
OlivierThompson's user avatar
1 vote
1 answer
429 views

Is Azure Front Door PCI-DSS Compliant?

Azue Front Door supports TLS versions 1.0, 1.1 and 1.2. Currently removing TLS versions 1.0, 1.1 from Azure Front Door is not supported. PCI standards requires that protocols TLS 1.0, 1.1 can no ...
Kunal Gujar's user avatar
8 votes
2 answers
5k views

PCI failed for Script Src Integrity Check for google js

I have used this in my code: <script type="text/javascript" src='https://www.googleadservices.com/pagead/conversion.js'></script> In PCI Scan i received error for this saying "Script ...
Umesh Deshmukh's user avatar
2 votes
1 answer
3k views

Is Google Cloud Storage PCI compliant?

Here is the Google Cloud Platform: Customer Responsibility Matrix. This document basically goes through all of the PCI DSS requirements and explains what is done by GCP and what is supposed to be done ...
Amit Yadav's user avatar
  • 4,854
0 votes
1 answer
194 views

Is this set-up PCI DSS compliant?

Setup: Mobile uses Stripe to get credit card token. Mobile sends token to Server 1. Server 1 gets credit card details using the token. Instantly, the Server 1 encrypts the details and sends it to a ...
Damia Fuentes's user avatar
0 votes
1 answer
422 views

How to make Google Cloud SQL Instance PCI compliant?

I’m securing my Google Cloud SQL Instance to be PCI DSS compliant, but when I’m scanning the server I get a critical warning over port 3307 saying that accepting a TLSv1.0 is not permitted. Where ...
Yeudiel's user avatar
  • 13
0 votes
1 answer
805 views

Firebase Hosting PCI Compliance

We have built a web application platform considering the Firebase as the centre of the technology and at this point when we need to submit the PCI DSS our system is failing the test, because it is all ...
Anant Anand Gupta's user avatar
1 vote
1 answer
284 views

PHP Storing card data using PCI Standards OR using a third party to store card data?

So I'm facing a challenging issue today. I'm currently working on the payment interface of an app I'm developing. I have to give the apps future users the option to store and edit their payment card ...
Logical Nonsense's user avatar
0 votes
2 answers
3k views

How to mark files in a GCP storage bucket as Read Only for "everyone"?

We have a storage bucket which has sensitive data stored in it, in the form of JSON files. For a PCI compliance, we have to make these files read only. Versioning will be enabled on the bucket so ...
Amit Yadav's user avatar
  • 4,854

1
2 3 4 5
7