Re: PCI audit and 3rd Party hosted software.

I beleive it has to be secure from the point of entry, not just the transmission point to the 3rd party for auth & settle.
With such a wide variety of entry styles that leaves a lot of open room - a wireless card reader or keyboard, or a hijacked pc can be just as vulnerable.
I beleive there is specific audit language about pc's connected to lan/wan's for other purposes that also are used to transmit card info. Whether it makes it to the pc disk or local server is another separate audit point. (it's been a while since last pre-audit review, i can't point to the docs right now).
Jim Franz

----- Original Message ----- From: "Tom Jedrzejewicz" <tomjedrz@xxxxxxxxxxxxxx>
To: "PC Technical Discussion for iSeries Users" <pctech@xxxxxxxxxxxx>
Sent: Thursday, December 17, 2009 11:43 PM
Subject: Re: [PCTECH] PCI audit and 3rd Party hosted software.

On Thu, Dec 17, 2009 at 6:52 PM, Jim Franz <franz400@xxxxxxxxxxxx> wrote:

Tom - are you sure the "Y" (A) does not need to have their network audited
if their local pc's are used to take the card information and the keyboard,
a possible swipe, and local pc's are used to communicate to "C".
I was sure the PCI audit covers more than the storage of data, but also the
entry points of that data.
Jim Franz

No, I am not sure. My take is that if the destination web site uses SSL
then the client is (theoretically) insulated, unless they store info other
places, such as on scanned payment forms. But as I said, getting an auditor
to agree will be tough.

---------
Tom Jedrzejewicz
tomjedrz@xxxxxxxxxxxxxx
--
This is the PC Technical Discussion for iSeries Users (PcTech) mailing list
To post a message email: PcTech@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/pctech
or email: PcTech-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/pctech.