PCI Compliance

Oct 10, 2007

One of our clients (a UKBF member) required a company to perform a PCI scan on one of our web servers for his on-line credit/debit card processing via Barclays. The scan was completed a few days ago and it has failed.

Some of the requirements it requires are just totally stupid and not feasible in a shared hosting environment IMO. Well they are but it's going to cause disruption/complaints from other clients.

We have hundreds of other customers running ProtX/WorldPay/HSBC etc and they've never required a PCI scan. Even for our own credit/debit card processing we didn't need one; is this PCI stuff now a new requirement?

Astaroth · Oct 10, 2007

PCI is not new but the rigour they are being enforced with is growing.

The understanding I got on the topic (it was a while ago and I wasnt overly interested in that aspect of the presentation when I went) was that they were effectively created as "blue sky" type thinking in issolation of what anyone was doing and then cascaded it out.

Initially even the card schemes werent compliant so the likes of Visa etc decided to fix themselves before demanding the card issuers and merchant services were. Thats done so now the banks/ likes of Streamline are making themselves compliant and as they do so they start cascading it out further to their clients.

Probably a more articulate look into the topic is http://www.pcicomplianceguide.org

awebapart.com · Oct 10, 2007

Carl-CSNM said:
One of our clients (a UKBF member) required a company to perform a PCI scan on one of our web servers for his on-line credit/debit card processing via Barclays.

I'm guessing this is because your client has decided to capture customer credit cards on their own site, hosted on your web server.

Can you not recommend that your client sends their customers off to their payment processor website, like Protx or WorldPay, so that it is those sites where the customers have to enter their credit cards. This does have other advantages for small businesses, since new customers are more likely to enter credit card details on an established site they know and trust, rather than on some small business site they have just discovered on google.

Optegris · Oct 10, 2007

Just out of curiosity Carl, what did it fail on?

Oct 10, 2007

openmind said:
Just out of curiosity Carl, what did it fail on?

Running SMTP on a non-standard port, the fact we offer a control panel, also we allow external access to MySQL (have to be authenticated before customers can use it). And a few other silly things.

awebapart.com - we take credit/debit card over our site and several of our other customers do we have never been asked to do a PCI scan before. IMO I think it looks more professional to take the payment directly on the site you are buying from but have the logo/details of your payment providers i.e. "powered by WorldPay".

Optegris · Oct 10, 2007

Carl-CSNM said:
Running SMTP on a non-standard port, the fact we offer a control panel, also we allow external access to MySQL (have to be authenticated before customers can use it). And a few other silly things.

SMTP - Weird, running on alternate port makes it more secure IMHO not less

Control Panel - Hmm I can see why on this one as customers would have the ability to change their serer set-up to some degree. Daft thing is that it wouldn't compromise server security...

MySQL - As does pretty much every hosting company in the world...

Astaroth · Oct 10, 2007

openmind said:
MySQL - As does pretty much every hosting company in the world...

No, many dont allow remote connections to dbs only internal - we lost a job because their current host said you should never allow remote connections to any databases and refused to open a secure connection for us to be able to create a sister site on our server but share some resources on their existing db (original site was PHP and we develop in .Net)

The issue of cause is that the store can hold the card number in the DB which is all well and good as it is collected over a SSL connection however the store owner can then download all the card numbers etc (obviously not CCV as you are not allowed to store these) from the db over an open (but username and password protected) connection and this can be intercepted etc

Carlmax · Oct 19, 2007

Achieving PCI compliance is very easy using PCI-GENERAL/Security-GENERAL from packet general networks (packetgeneral dot com) . We have used it to secure our couple of servers and it provides encryption to mysql data and backups, and secures to the operating environment of MySQL.

Search

Search

PCI Compliance

Astaroth

awebapart.com

Optegris

Optegris

Astaroth

Carlmax

Similar threads

Latest Articles