qsa Flashcards
developers attend secure coding class 6.5
1 year - anually
characters for a password
7 characters
lock out attempts 8.1
6 attempts then locked out for 30 min or administrator unlocks it.
idle timeout 8.1
15 minutes
Log Reviews, Security Events, Critical System Security Patches 10.1
Check Every Day
Service Provider
Processing, Storage, or transmission of cardholder data on behalf on another entity. I managed firewall company or something along those line can be one too
scoping
trust buy verify
3 types of evidence when scoping
Documentation - Policy Procedures, Interviews, Observations
pci dss 6 things
- build and maintain secure network
- protect cardholder data
- maintain a vulnerability management program
- implement strong access control measures.
- regularly monitor and test network
- maintain an infosec policy
review firewall rules 1.1
every 6 months
data retention policy
limit data storage to minimums which is required for legal, regulatory or biz requirements.
install critical security patches 6.2
critical patches within 1 month other patches within an appropriate time frame
custom code changes 6.3.2
reviewed by individuals other than the author according to secure coding guidelines
vulnerability assesments of public facing websites 6.6
every year or if there is a change
users terminated in the past 6 months 8.1
verify id’s have been deactivated or removed & physical auth methods removed.
inactive accounts 8.1
disable within 90 days
audit trail 10.7
3 months online and 1 year retention
Vulnerability Scans 11.2
quarterly or if significant change
penetration scans 11.3
annually or if there is significant change
risk assessment 12.2
at least annually or significant change
information security policy 12.2
reviewed annually or significant change
camera data 9.11
3 months
media inventories 9.7.1
anually
SAQ A
intended for merchants that accept only card-not-present transactions (that is, e-commerce, mail order or telephone order), and that outsource all their cardholder data functions to PCI DSS compliant service providers. For e-commerce merchants, this means that all elements of the payment page (or payment pages) that are delivered to the consumer’s browser must originate only and directly from a PCI DSS validated third-party service provider. SAQ A is not applicable to face-to-face payment channels.
SAQ A-EP
developed for e-commerce merchants with a website that does not itself receive cardholder data, but that directly affects the security of the payment transaction. To be eligible for this SAQ, each element of every payment page delivered to the consumer’s browser must originate from either the merchant’s website or from a PCI DSS validated service provider.
SAQ B
merchants who process cardholder data using only imprint machines or using only dial-out terminals.
SAQ B-IP
developed for merchants who process cardholder data only via standalone, PTS-approved point-of-interaction devices that have an IP connection to the payment processor. To be eligible for this SAQ, the payment terminal must be listed on the PCI SSC website as an approved device. Merchants using the Secure Card Reader (SCR) category of devices are not eligible for SAQ B-IP.
SAQ C
merchants with dedicated payment application systems segmented from all other systems, and connected to the Internet for the purposes of transaction processing. SAQ C is not applicable to e-commerce payment channels
SAQ C-VT
for merchants using only web-based virtual payment terminals, where cardholder data is manually entered into a secure website from a single system.
SAQ-D
all other SAQ-eligible merchants that do not fall into any of the other SAQ categories, and for any service providers defined by a payment brand as eligible to complete the SAQ.
Service providers only use this one if they do a SAQ
SAQ-P2PE
merchants using a validated P2PE solution that is listed on the PCI SSC website.
minimum password age
1 day
change password
90 days
track data
79 character limit track 1 - format code seperator PAN suffix sirname service code cvv cvc reserved for card issuers
40 track 2 PAN
Typical Location of Track Data
Database files, Flat Files, Log files, debug files
Systems that commonly store track data
POS systems. POS servers. Authorization Servers
Typical location of card verification value or code
Paper, Databases, Log Files, Flat files, Debug files.
Systems that commonly store card verification value or code data
Authorization servers. Web Servers. Kiosk
maximum masked characters in PAN
first 6 last 4
MOD-10 (The Luhn Formula)
Step 1: Double the value of alternate digits of the primary account number beginning with the second digit from the right. For any Resulting value >=10, subtract 9.
Step 2: Add calculated values as well as the values skipped in Step 1 together.
Step 3: The total obtained in Step 2 must be divisible by 10.
