RE: sensitive data

Actually, a very good option in some cases.... We have an application which uses a web-based credit card management service. Credit card details are passed up with the authorization, and they pass back TranID and AuthToken values that we use for all following transactions (settlement / credit). We never store the actual card details. Works great, and no compliance issues...

Eric

-----Original Message-----
From: rpg400-l-bounces@xxxxxxxxxxxx
[mailto:rpg400-l-bounces@xxxxxxxxxxxx]On Behalf Of SJL
Sent: Thursday, October 25, 2007 3:34 PM
To: RPG programming on the AS400 / iSeries
Subject: Re: sensitive data


Or NOT stored...that's always an option...
- sjl

----- Original Message -----
From: "Alan Shore" <AlanShore@xxxxxxxx>
To: "RPG programming on the AS400 / iSeries" <rpg400-l@xxxxxxxxxxxx>
Sent: Thursday, October 25, 2007 2:28 PM
Subject: RE: sensitive data


Hi Richard
Unfortunately with PCI compliance having to be in effect on January 1,
2008, even the idea of using logical files is NOT good enough. The credit
card number (and other fields of its ilk) HAS to be encrypted.



Alan Shore

NBTY, Inc
(631) 244-2000 ext. 5019
AShore@xxxxxxxx
"If you're going through Hell, keep going" - Winston Churchill

rpg400-l-bounces@xxxxxxxxxxxx wrote on 10/25/2007 03:14:06 PM:

Lim,

Do you have 2 sets of users that need to view the data? Those that
should see the sensitive info and those that should not?

I remember way back when IBM was telling us all about this new-fangled
relational database thing, they suggested this new gadget called a
logical file. I recall them saying you could create a logical view with
only the fields you wanted someone to see and give them access to that
view only.

Is that still an option?

Rick Weber

-----Original Message-----
From: rpg400-l-bounces@xxxxxxxxxxxx
[mailto:rpg400-l-bounces@xxxxxxxxxxxx] On Behalf Of Lim Hock-Chai
Sent: Thursday, October 25, 2007 2:24 PM
To: RPG programming on the AS400 / iSeries
Subject: sensitive data

Just want to know how other handle file that contains both sensitive and
non-sensitive data field. For example, Customer-Billing-Info Master
file might have Billing Address fields (Non-Sensitive Data) and Credit
Card field (Sensitive data). Do you create special Service Program to
access those field, using field level auth...?




--
This is the RPG programming on the AS400 / iSeries (RPG400-L) mailing
list
To post a message email: RPG400-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/rpg400-l.


This message and any attached documents contain information which
may be confidential, subject to privilege or exempt from disclosure
under applicable law. These materials are intended only for the use
of the intended recipient. If you are not the intended recipient of
this transmission you are hereby notified that any distribution,
disclosure, printing, copying, storage, modification or the taking
of any action in reliance upon this transmission is strictly
prohibited. Delivery of this message to any person other than the
intended recipient shall not compromise or waive such
confidentiality, privilege or exemption from disclosure as to this
communication. If you have received this communication in error,
please immediately notify the sender and delete the message from your

system.

--
This is the RPG programming on the AS400 / iSeries (RPG400-L) mailing

list

To post a message email: RPG400-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/rpg400-l.