3

We're currently setting up our existing web service to be PCI-DSS compliant and we're a little stumped on one of the compliance requirements.

In short, we need to ensure a credit card number is never stored anywhere in plain text. Our CC submission forms all work on SSL, we store the information in an encrypted field, everything is compliant except: IIS logs.

Our auditing team have noted that, if you type anything into the search box we provide for other features on the site, the query term is logged into the IIS logs. If a user puts their credit card number into this search box, that number gets logged to IIS in plain text.

Has anyone else dealt with this problem? I've had no look finding a solution online, especially given the other requirement in PCI DSS that we log absolutely everything possible to provide as full an audit trail as possible.

Thanks

  • I know nothing about PCI-DSS, but wonder if that specific user error is covered by the regulations. After all, you don't store a credit card number but a search term. Anyway, maybe add a bit of JavaScript that checks if the search term might be a CC number and rejects it or notifies the user. – Sven Dec 21 '16 at 9:22
  • Disclaimer: I'm not an auditor either. You may be able to mitigate by educating administrators on proper procedures, encrypting the storage system in case the server is physically taken, and occasionally searching logs and database for anything that looks like a PAN. – John Mahowald Dec 21 '16 at 19:49
  • 2
    Send the search form using POST rather than GET. POST parameters shouldn't be logged. – Barmar Dec 27 '16 at 19:19
  • 1
    Why would a user put a credit card number in the search box? Surely that's outside the scope of behavior where PCI applies? I mean, they could email it to you, or send you a postcard with it written down. Wouldn't fail PCI for that, either. – ceejayoz Mar 10 '17 at 15:29
  • "Surely that's outside the scope of behavior where PCI applies?" I've since left the company, but at the time of leaving that was the only sensible stance we could see and what we had sent back to the compliance team. Thank you all for your input – xmakina Mar 13 '17 at 9:41
-2

If you control the entry to IIS logs (I mean the exact call from your searchbox to IIS log facility), you should scan it before hand for anything that might be under PCI-DSS and mask it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.