The Payment Card Industry Data Security Standard (PCI DSS) is a worldwide security standard that was formed with the support of credit card companies to align their security standards.

learn more… | top users | synonyms (1)

7
votes
1answer
119 views

PSTools psexec and PCI

I am just wondering if anyone knows of any reason why using psexec would cause the failure of a PCI DSS audit. I have never been able to find information, though have always been told that it can't ...
3
votes
1answer
144 views

Upgrading OpenSSH on web server (Ubuntu) for PCI Compliance

I've been trying to upgrade OpenSSH for PCI compliance on our company's web server. I cannot for the life of me figure out how to do this though. I have attempted the following commands via SSH ...
1
vote
0answers
43 views

Separating Secure Network and DMZ (nonsecure) in a PCI Compliant Infrastructure

We are setting up a PCI Compliant infrastructure where most of our applications are running in a DMZ (demilitarised zone) that contain no sensitive information. The part that contains sensitive ...
1
vote
2answers
53 views

Quarterly external vulnerability scans, IPs to include

I have questions regarding the PCI DSS requirements for quarterly external vulnerability scans by an ASV, specifically what public IPs I need to include in these scans. The organization is a retail ...
2
votes
1answer
116 views

Ubuntu PCI-DSS Compliance Issue

I'm trying to get PCI compliant and the PCI scanning company is flagging our Ubuntu 12.04 PHP 5.3.10-1ubuntu3.9 for CVE-2013-1635. According to ...
0
votes
1answer
92 views

PHP and PCI Compliance

I have a web server that needs to pass a PCI compiance scan by ControlScan. Everything is good except for a scan they did of the PHP version. I believe I have the latest version that CentOS ...
1
vote
2answers
151 views

trustwave pci scan: dns amplification denial of service, Bind 9.8.1-P1, doesn't seem like it

In our last TW PCI scan, one of our flags was "DNS Amplification Denial of Service". Right now, the DNS server is running Bind 9.8.1-P1. It seems like the CVEs are for a much older version: ...
0
votes
2answers
568 views

How do I get a friendly error page to replace the asp.net error page for url “WEB-INF./web.xml”?

This url is part of a pci compliance scan and it is flagging the very sparse asp.net error page returned, which on the live site is a 500 status code and the text Server Error in '/' Application. ...
0
votes
2answers
110 views

Ubuntu CVE-2013-1635 PCI DSS

I'm trying to get PCI compliant and the PCI scanning company is flagging our Ubuntu 12.04.3 (PHP 5.3.10-1ubuntu3.8) for CVE-2013-1635 [1] which says "we do not support the use of open_basedir". What ...
0
votes
1answer
72 views

Remote MySQL PCI Compliance

Using Stripe to process credit card payments and storing client payments and information in a mysql database. Only storing the id of the transaction, and the client ID. Stripe takes on a majoring of ...
0
votes
1answer
264 views

Bastion host for PCI compliance

A client in the retail industry has a network with point-of-sale (POS) terminals that connect to a POS Server. Additionally, most of the Windows workstations in non-sales areas also connect to the ...
0
votes
1answer
118 views

Are using ssh keys PCI compliant?

From PCI-DSS point of view, are using SSH keys for passwordless authentication secure enough? TIA, Vitaly
0
votes
2answers
313 views

How to determine SSL Cipher strength

I have updated my ssl.conf file on my Apache2 configuration to use the following SSLCipherSuite SSLProtocol all -SSLv2 SSLCipherSuite HIGH:MEDIUM:!ADH However the PCI scan seems to detect that WEAK ...
0
votes
1answer
145 views

Remotely Detect Windows Server Service Pack Level

One of our web servers just failed PCI-DSS compliance because the vulnerability scan detected the OS was Windows Server 2003 Service Pack 1 (obviously very outdated!). My question is how did the ...
13
votes
1answer
649 views

Domain Administrators account policy (After PCI audit)

One of our clients is a Tier 1 PCI company, and their auditors have made a suggestion with regards to us as System Administrators and our access rights. We administer their entirely Windows based ...
0
votes
1answer
63 views

PCI Compliance Network Scan Issue - HTTP response code was an expected 401

We take Credit card over internet connected comupter, and we have to pass PCI compliance network scan. When I run network scan , I have the following error. How can i fix this error. Any help ...
2
votes
1answer
579 views

Are CVE-2010-4478 and CVE-2011-0539 fixed in OpenSSH 5.3?

I'm running OpenSSH 5.3p1-81.el6_3, which according to my server is the latest stable version. My PCI scan is showing CVE-2010-4478 and CVE-2011-0539 exploits as being present due to my OpenSSH ...
0
votes
0answers
437 views

How to configure DD-WRT routing table when creating an isolated network segment for PCI C VT compliance

I'm the volunteer support and system admin person at a small private school. We need to setup a PCI compliant Windows PC as a virtual terminal for credit card processing. I've read questionnaire SAQ ...
4
votes
1answer
548 views

How to maintain PCI compliance on a LAMP server when repositories don't keep up with versions

We run Ubuntu Lucid 10.0.4 as the foundation of our LAMP environment. We are trying to become PCI compliant so that we can pass CC info through our server. We have run some third-party scans on our ...
0
votes
2answers
251 views

IIS log management

Is it possible to prevent IIS to log specified type of data(i.e credit card data)? I mean can I say to IIS; -If a credit card number is searched, do not log this, or do not log all credit card ...
1
vote
1answer
371 views

Disabling SSL Renegotiation

We need to stop using (insecure) SSL renegotiation for a series of e-commerce sites we provide due to PCI regulations. Does anyone know of the implications of doing so assuming that we don't enable ...
1
vote
2answers
2k views

Disable all but RC4 in apache

Our PCI compliance vendor requires that we disable all but RC4 encryption on our web server. Currently our apache config file looks like this: SSLHonorCipherOrder On SSLCipherSuite ...
1
vote
1answer
1k views

PCI scan failure for SSL Certificate with Wrong Hostname?

A client had a PCI scan completed by SecurityMetrics, and it now says they failed due to the SSL certificate for the SMTP port 25 (and POP3s/IMAPS) not matching the domain scanned. Specifically: ...
2
votes
1answer
272 views

Why would a PCI scan fail because of components that are not even installed?

Recently a PCI scan was run against a web server and the result was a failure. Some of the issues could be fixed, however others simply make no sense to me. The machine was a clean install, there are ...
0
votes
1answer
82 views

pci scanning failing

PCI scanning reports the below issue for my Joomla site. "It is possible to retrieve file backups from the remote web server" I've checked it manually by accessing ...
4
votes
2answers
2k views

How to Disable SSLv2 for Apache httpd

I just tested my site on https://www.ssllabs.com/ and it said SSLv2 is insecure and I should disable that along with weak Cipher Suites. How can I disable that? I tried the following but it isn’t ...
-2
votes
1answer
785 views

ISAKMP Allows Weak IPsec Encryption Settings (PCI compliance)

I am working on a client's PCI compliance. One of the failing items is: 3.1.5. ISAKMP Allows Weak IPsec Encryption Settings (ipsecweakencryptionsettings) The solution given is: "Modify the ISAKMP ...
2
votes
1answer
422 views

Blind SQL Injection PCI failure

I am working on a client's PCI compliance. One of the failing items is: 3.1.4. Blind SQL Injection (httpgenericscriptblindsqlinjection) The offered solutions is simply: "Ensure that the Web ...
1
vote
0answers
16 views

HTTPonly & Secure flags for OWA cookies [duplicate]

Possible Duplicate: Setting the secure flag on cookies from Outlook Web Access I am working on a client's PCI compliance. Two of the failing items are: 3.2.6. Missing HttpOnly Flag From ...
1
vote
1answer
55 views

Fix CVE-2009-0796 Ubuntu Hardy

I have a server running Ubuntu 8.04 which is currently PCI-DSS compliant. The latest security scan has brought up issue CVE-2009-0796 This requires installing a version of libapache2-mod-perl2 ...
4
votes
4answers
5k views

Disable SMTP AUTH on Port 25

Due to PCI-DSS, we are required to disable plaintext authentication. We've achieved this by encapsulating communications between our mail server and clients with TLS on port 465. The problem lies in ...
-1
votes
4answers
220 views

PCI Compliance Scans [closed]

I'm hoping to find a piece of software to assist me in catching PCI compliance failures in advance of the actual ASV scans. I would much prefer to run the scans against myself before I request another ...
5
votes
2answers
490 views

Options for PCI-DSS on AWS - file integrity monitoring and intrusion detection

I need to deploy some file integrity monitoring and intrusion detections software on AWS instances. I really wanted to use OSSEC, however it does not work well in an environment where servers can ...
1
vote
1answer
959 views

Way to speed up load-balanced ssl using nginx?

So the setup for our website is 4 nodes running rails 3 and nginx 1 that all use the same GoDaddy certificate. Because we are a paid site, we have to maintain PCI-DSS compliance and thus have to use ...
0
votes
1answer
260 views

PCI Compliance Apache Shiro fail

On a CentOS LAMP box, a PCI compliance scan is failing on: Apache Shiro URI Path Security Traversal Information Disclosure http/80 As far as I can tell the server doesn't have Shiro installed, ...
0
votes
1answer
548 views

PCI Compliance SSL Certificate Cannot Be Trusted fail

The server is a CentOS box with the default LAMP stack running. A PCI scan lists this as a fail: SSL Certificate Cannot Be Trusted https (443/tcp) Severity: Medium Notes: none We don't actually ...
5
votes
2answers
2k views

SSL/TLS Cipher Priority

I am working on trying to make sense of what is required for both PCI DSS compliance as well as FIPS compliance in relation to SSL/TLS cipher suites. I have been reading the guide here and here. ...
1
vote
1answer
259 views

Failed PCI compliance - 403 (Forbidden)

Due to a recent upgrade in the scanning done by our PCI compliance testers, we recently failed a PCI, and the suggested solution is as follows: Configure the HTTP server to specify the same error ...
2
votes
2answers
340 views

Auditing changes to the audit log

I have configured auditd for PCI compliance reasons PCI states that existing logs cannot be changed without generating an alert This article ...
4
votes
1answer
335 views

PCI DSS compliance on a virtualized server running Xen

I have a server running xen with HVM and would like to make one VM PCI compliant. I've read the PCI virtualization guide and it says that I need to make sure there is no information leakage between ...
3
votes
1answer
428 views

HAProxy and Stunnel PCI Compliance

I am setting up HAProxy to load balance between two web servers. Some of the pages on the site require SSL. Stunnel is handling the https connections and passing them off to haproxy (Stunnel ...
2
votes
4answers
2k views

Updating OpenSSH to latest stable version via yum

I am running CentOS 5.7 and need to upgrade OpenSSH to the latest stable version (PCI compliance issues). However, the most recent version available via the CentOS yum repository is 4.3p2. How can I ...
1
vote
1answer
2k views

Filter incoming traffic to UDP port for pci compliance

It had been recommended for PCI compliance that I filter incoming traffic to UDP port 5353 please can someone advise what are the steps to do this? I am currently using Centos 5.7 64 bit.
8
votes
5answers
732 views

How to check that a known Windows Vulnerability has been patched?

Is there a way in Windows to check that say Security Bulletin MS**-*** or CVE-****-***** has been patched? e.g. something akin to RedHat's rpm -q --changelog service Windows 2008 R2 SP1
3
votes
1answer
147 views

Staff using login details that do not belong to them, is it legal in a PCI compliant system? [closed]

I've got a current problem at work (i'm an IT manager) whereby users are logging into some of our systems using an account which is actually someone elses. We have to be PCI compliant (you should ...
4
votes
2answers
232 views

Making our small business network PCI-DSS Compliant [closed]

We're required to become PCI-DSS compliant so we can process client payments via our website and in the office. Our network is made up of a single SBS 2008 server and 10 workstations, all connected to ...
-1
votes
1answer
270 views

Win XP Pro, IIS 5.1, PCI Compliance

I have a client that was scanned and determined not to be PCI Compliant. I looked and they had IIS setup to allow a program from central office to push/pull info from their server. Many of the reasons ...
0
votes
3answers
309 views

PCI Scan failed on a VPS

I'm new to PCI, we just paid for the Trustkeeper PCI Scan and here are some of the results (just the vulnerability names): DB Accesibility SSLv2 Supported A lot of BIND (patches) related ...
1
vote
2answers
3k views

How do I properly disable cgi scripts e.g. guestbook.cgi on WHM

After a PCI scan identified guestbook.cgi as a risk, I want to disable the cgi-scripts installed by WHM (v11, running on CentOS5). I would like to do this "properly" using the WHM Web interface if ...
2
votes
1answer
169 views

Need guidance on network design in multi-building campus

How can we create a secured, segmented network among multiple buildings when all the data has to go through a single cable? Background: I work for a non-profit organization that has 5 buildings on ...