Tag Info

Hot answers tagged

8

SCP/SFTP, provided by most SSH implementations is what I use for just about all simple remote file transfer. This is available in any Linux/BSD setup either by default or very easy to setup/install and there are several options for Windows including cygwin which includes a port of the same OpenSSH clients and servers used by most Linux setups. Another ...


4

The PCI DSS 10 Common Myths (pdf) talks about fines, legal fees, and general bad things, so I think you can assume you'd be sued into oblivion if you lied on the questionnaire :)


3

To be PCI compliant you have to use a validated payment application. Once a payment app is validated, it has to stay frozen (meaning no coding changes to the application at all). Is adding javascript to the front end of your website considered a coding change to the application? I would say no, if you host the javascript yourself and you understand what ...


3

I deal more with HIPAA/HITECH compliance than PCI/DSS directly, however, HIPAA also usually necessitates compliance with PCI/DSS. Why? You never know when medical records will contain a front and back photo copy of a credit card. More often than not, they do (sadly). This usually comes from someone just using their card to settle a co-payment. Everything ...


2

Even when you assume that nobody might want to inspect your server you might fire an employee. Then that employee hates you might go to VISA and complain about your lack of following the standards.


2

Unless the page they are entering their CC info on is on a different domain (IE paypal redirect) I would always worry about PCI. Now, this does not mean you need to meet the PCI level 1 requirements (IE read only database of every transaction kind of stuff), but it does mean you should follow the requirements for level 4. See the Visa requirements as they ...


2

Based off everything you've read, is "XML Direct" the only option they could conceivably be using, or is there another method I don't know of which they could be implementing? There are more ways then XML Direct to use a third party for payment. An example of this is Authorize.net's Direct Post Method (DPM). DPM lets you host the payment form so ...


2

PCI compliance will always be an issue when dealing with credit card payments. Doing it this way only complicates things as now not only does your site have to be PCI compliant but so does the user who uses this widget. PCI compliance dictates that any website that handles credit card payments must be PCI compliant. The Payment Card Industry Data ...


2

The PCI requirements are about the devices processing the payments. If you use others people's services (and so their devices and networks) then they are going to do a lot of the work. However, once you've picked a third party to process the payments, then see what they say specifically about PCI. For example, here's what Paypal say.


2

If it is a website available on the web for normal browsers that has been made to be responsive then the device being used to access it is irrelevant. If you are creating your own payment portal then there are other mobile considerations (to make the user experience a nicer one), but if you are using 3rd party tools I know that PayPal have a mobile payments ...


2

To use Google Analytics, you have to insert a JavaScript snippet into the page that is served by Google. This gives Google the technical opportunity have this JavaScript do anything to your page or with your visitors. You certainly have to trust Google. You also have to then trust that this code isn't altered in transit. You have to trust that Google ...


1

The form of communication is more or less irrelevant. It's the security of how you handle it. If you can encrypt it from end to end then you'll probably be PCI compliant. Look into PGP for encrypting the email.


1

The more up front you are about your handling of sensitive information through your website you are, the less likely someone is able to complain (i.e. sue you) that you put there information at risk without their knowledge. It's not bulletproof protection, but you want to make sure you cover the basics so in the event of a breach or lawsuit you have as much ...


1

In general there won't be many companies that store that data for you and they will be processors. The reason is because of PCI compliance. You have to follow strict standards to store card numbers. Check out the Wikipedia article on PCI compliance, http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard. The PCI compliance website ...


1

I worked for a company that was going through the PCI compliance process and I have to say, if you are storing credit card info and are not PCI compliant you are putting your company at risk. You are right in that the Credit Card industry may never find out but why risk it. You have to remember, if you ever have a breach of security or a Card Vendor finds ...



Only top voted, non community-wiki answers of a minimum length are eligible