3

We're currently setting up our existing web service to be PCI-DSS compliant and we're a little stumped on one of the compliance requirements.

In short, we need to ensure a credit card number is never stored anywhere in plain text. Our CC submission forms all work on SSL, we store the information in an encrypted field, everything is compliant except: IIS logs.

Our auditing team have noted that, if you type anything into the search box we provide for other features on the site, the query term is logged into the IIS logs. If a user puts their credit card number into this search box, that number gets logged to IIS in plain text.

Has anyone else dealt with this problem? I've had no look finding a solution online, especially given the other requirement in PCI DSS that we log absolutely everything possible to provide as full an audit trail as possible.

Thanks

Improve this question
5
  • I know nothing about PCI-DSS, but wonder if that specific user error is covered by the regulations. After all, you don't store a credit card number but a search term. Anyway, maybe add a bit of JavaScript that checks if the search term might be a CC number and rejects it or notifies the user.
    – Sven
    Dec 21, 2016 at 9:22
  • Disclaimer: I'm not an auditor either. You may be able to mitigate by educating administrators on proper procedures, encrypting the storage system in case the server is physically taken, and occasionally searching logs and database for anything that looks like a PAN.
    – John Mahowald
    Dec 21, 2016 at 19:49
  • 2
    Send the search form using POST rather than GET. POST parameters shouldn't be logged.
    – Barmar
    Dec 27, 2016 at 19:19
  • 1
    Why would a user put a credit card number in the search box? Surely that's outside the scope of behavior where PCI applies? I mean, they could email it to you, or send you a postcard with it written down. Wouldn't fail PCI for that, either.
    – ceejayoz
    Mar 10, 2017 at 15:29
  • "Surely that's outside the scope of behavior where PCI applies?" I've since left the company, but at the time of leaving that was the only sensible stance we could see and what we had sent back to the compliance team. Thank you all for your input
    – xmakina
    Mar 13, 2017 at 9:41

1 Answer 1

Reset to default
-2

If you control the entry to IIS logs (I mean the exact call from your searchbox to IIS log facility), you should scan it before hand for anything that might be under PCI-DSS and mask it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .