Re: Credit Card Processing and PCI compliancy on the Power i

[DrFranken <midrange@xxxxxxxxxxxx>]

I deal with many customers who handle credit cards. Of them only 1 still 
processes those cards on IBM i and they are moving to the token model 
you describe 'with the quickness'.

In most cases now the user is redirected to an outside website to enter 
credit card information and the token is returned. The token then is the 
only important bit retained and it means nothing out of context. It 
contains absolutely nothing about the user or their card.

The issue being that by doing so the vast majority of the network and 
servers and devices are now out of scope for PCI compliance.

I'm a bit surprised it has to be a wireless device as wireless is 
'generally' less secure than wired (for example medical and dental 
offices cannot use wireless networks or even fixed wireless internet 
connectivity.

Nonetheless this IS the way of the future of PCI.

        - Larry "DrFranken" Bolhuis

www.Frankeni.com
www.iDevCloud.com - Personal Development IBM i timeshare service.
www.iInTheCloud.com - Commercial IBM i Cloud Hosting.

On 12/4/2018 10:06 PM, Steinmetz, Paul wrote:
> Anyone from the group processing credit cards on the i?
>
> Currently, we do NOT use any credit card terminal devices.
> Currently, card data is entered either via green screen application, gui application, IVR, WEB.
>
> We were informed by our processer today that going forward we need to consider having  ALL  card data entered via a wireless device connected to a separate network, (no longer from any PC device, or any device  connected to the I, or the I network)  that connects to a cloud  based authorizer, and then returns a token back to the I, which in turn is then stored in the I application,  to keep the I out of PCI scope and to remain PCI compliant.
>
> Going forward, all current credit card touch points (green screen application, gui application, IVR, WEB) would need changes to stay compliant.
>
> Have others in the group had to deal with this issue and what solutions have anyone implemented?
>
> Thank You
> _____
> Paul Steinmetz
> IBM i Systems Administrator
>
> Pencor Services, Inc.
> 462 Delaware Ave
> Palmerton Pa 18071
>
> 610-826-9117 work
> 610-826-9188 fax
> 610-349-0913 cell
> 610-377-6012 home
>
> psteinmetz@xxxxxxxxxx
> http://www.pencor.com/