Re: PCI audit and 3rd Party hosted software.

["Jim Franz" <franz400@xxxxxxxxxxxx>]

I beleive it has to be secure from the point of entry, not just the 
transmission point to the 3rd party for auth & settle.
With such a wide variety of entry styles that leaves a lot of open room - a 
wireless card reader or keyboard, or a hijacked pc can be just as 
vulnerable.
I beleive there is specific audit language about pc's connected to lan/wan's 
for other purposes that also are used to transmit card info. Whether it 
makes it to the pc disk or local server is another separate audit point. 
(it's been a while since last pre-audit review, i can't point to the docs 
right now).
Jim Franz

----- Original Message ----- 
From: "Tom Jedrzejewicz" <tomjedrz@xxxxxxxxxxxxxx>
To: "PC Technical Discussion for iSeries Users" <pctech@xxxxxxxxxxxx>
Sent: Thursday, December 17, 2009 11:43 PM
Subject: Re: [PCTECH] PCI audit and 3rd Party hosted software.


> On Thu, Dec 17, 2009 at 6:52 PM, Jim Franz <franz400@xxxxxxxxxxxx> wrote:
>
> > Tom - are you sure the "Y" (A) does not need to have their network 
> > audited
> > if their local pc's are used to take the card information and the 
> > keyboard,
> > a possible swipe, and local pc's are used to communicate to "C".
> > I was sure the PCI audit covers more than the storage of data, but also 
> > the
> > entry points of that data.
> > Jim Franz
>
> No, I am not sure.  My take is that if the destination web site uses SSL
> then the client is (theoretically) insulated, unless they store info other
> places, such as on scanned payment forms.  But as I said, getting an 
> auditor
> to agree will be tough.
>
> ---------
> Tom Jedrzejewicz
> tomjedrz@xxxxxxxxxxxxxx
> --
> This is the PC Technical Discussion for iSeries Users (PcTech) mailing 
> list
> To post a message email: PcTech@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/pctech
> or email: PcTech-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/pctech.