PCI DSS (Payment Card Industry Data Security Standard) compliant?

Hi All

Do we know if Zen Cart is PCI DSS (Payment Card Industry Data Security Standard) compliant?

I think so but would like a definitive answer from Zen Team too?

Thanks
Sarah

SarahL:

Hi All

Do we know if Zen Cart is PCI DSS (Payment Card Industry Data Security Standard) compliant?

I think so but would like a definitive answer from Zen Team too?

Thanks
Sarah

While I'm not at liberty to say 'how' I know this I can say with some authority that Zen Cart would not be where you're looking to meet PCI standards. Items that are distributed software are not subject to said standards, however your payment gateway & credit card processor are. For example, Zen Cart talking to Authorize.net is not an issue, BUT Authorize.net speaking to your payment processor, their conversation with the card issuing bank, and then back from the card issuing bank to the processor and in turn back to Authorize.net does fall under these standards.

Any legitimate Merchant Services Provider has a list of things that must be met before they will clear you for processing. Again, I can't say "how" I know the following but on that list you'll typically find a required return policy, privacy policy, DBA matching the URL and the DBA listed with your Merchant Services Provider. Now, if you are going to use your own payment form then you'll be required to have at least a 128-bit encrypted SSL secure order form. The url on the certificate must match the DBA and URL (no shared certs). Now, say you're using the payment gateways payment form then the responsibility is on them. Say for example you're using ViaKLIX then if you gather the payment information (CC Details) by using their payment form, then you don't have to worry about the SSL 'technically'.

Hope this helps!

Hi thanks so at present if we are using the spilt CC details from Zen Cart then we need to comply but if using protz or a.n.other form then not.

so I am wondering then if we use spilt cc details how we need to prove we are coomplient JUST by showing a correct SSL?

SarahL:

Hi thanks so at present if we are using the spilt CC details from Zen Cart then we need to comply but if using protz or a.n.other form then not.

so I am wondering then if we use spilt cc details how we need to prove we are coomplient JUST by showing a correct SSL?

My apologies but I'm not familer with the 'split cc' details. Are you saying that you collect maybe the name, address, phone, etc and then pass on that info to the payment form?

ahh sorry no all details are sent via email to prcessor and the credit card details are spilt have online and half in a seperate email - they are then joined and plugged into a machine at the office

so basiclaly the cc details are not with name/address details and only part are stored, part are then emailed - but without all 3 you cannot get the details you need

i'm afraid i wouldn't know how that would relate to pci compliance; is the cc data being emailed? understand that cc data is the card number, exp date, and cvv number. Also, storing the cvv number is a very serious offense so be careful how you handle the data

The problem I am worried about with Zen Cart compliance is not the transaction processing, since as you note, this is handled by a secure third party and not an issue. But PCI DSS standards also relate to data storage, which Zen Cart stores on the local server.

I would like to see some discussion of that part of the equation, because that is where the potential for liability or for non-compliance fines seems to lie.

Third party scans, which you must have conducted at least quarterly, will fail you based on ZenCart using a SQL database. This failure can be appealed, and I would be interested in hearing some discussion of what facts could be presented to the third party provider of the vulnerability scan to document that it deserves to be exempted from this requirement.

Does anyone have actual experience dealing with PCI DSS compliance and Zen Cart? It seems that just about all of the shopping cart solutions, even expensive commercial ones, dance around this issue and avoid giving a direct answer. It seems to me that since PCI DSS compliance is mandatory, and that non-compliance subjects you to huge liability as well as the potential for huge fines, that it would be a major marketing point and certainly something that is well discussed and documented.

ZC does not store everything, I believe it splits the CC number and send half of that to you by email. So it should not violate that standard.

Someone must hack ZC db, and then your email to get the info he/she can use.

This is going to sound like an excuse, but it isn't our job to make sure that your server and hosting environment is secure, we don't control it.

But PCI DSS standards also relate to data storage, which Zen Cart stores on the local server.
If you are using third party then there is NO concern about zc storing things in the DB
zen cart stores the shipping information, which is allowed

and if you are using the stock cc module then zc is storing 1/2 of the number and sending the other 1/2 which is also allowed.

and we have LOTS of sites that are scanned for compliance,
hell the only issue we have is we need to be informed WHEN the scan will take place so we can whitelist the IP otherwise our security will kill any session and block the IP

TO add my two pennies worth.

Basically if you store the information of the card i.e card number, expiry and CVV number together then you need to encrypt this data and it is not recommended to store this information permanently only temporarily as part of a batch process.

If there was a module out there that did this (ZC one), then something like AES_ENCRYPT which encrypts column info in MySQl could be used.

However PCI Compliance is also about the web host, your internal network and other security measures etc. If you look at

https://www.pcisecuritystandards.org/pdfs/pci_dss_v1-1.pdf

page 3 it shows what you can store together. Also compliance or the level of compliance that you need to get to depends on your level i.e. 1 to 4 but this level depends on if its Visa or Mastercard (they rate levels differently). A level is dependant on volumes of Credit Cards processed.

Clear as mud, but hope it helps. If your with Barclays they should have sent you something on PCI Compliance (UK), other banks not so hot off the mark.

Kim:

This is going to sound like an excuse, but it isn't our job to make sure that your server and hosting environment is secure, we don't control it.

Kim is right about the server and hosting environment. I would suggest though that there are some PCI requirements that pertain to application development, and that they do apply:

6.2 Is the software and application development process based on an industry best practice and is information security included throughout the software development life cycle (SDLC) process?

6.5 Were guidelines commonly accepted by the security community (such as Open Web Application Security Project group (https://www.owasp.org) taken into account in the development of Web applications?

6.6 When authenticating over the Internet, is the application designed to prevent malicious users from trying to determine existing user accounts?

6.7 Is sensitive cardholder data stored in cookies secured or encrypted?

6.8 Are controls implemented on the servers side to prevent SQL injection and other bypassing of client side-input controls.

Perhaps that last is more relevant to the server environment. Of course, Zen Cart is Open Source so anyone can modify it, and modifications would have to comply with the above guidelines as well.

Food for thought.

I can tell you for certain that a site running ZC WILL pass pci compliance,
so whoever said it wouldnt because of mysql is mis-informed.

Yes the biggest part of pci compliance is the server and how its setup,

Trust me I have been going through each server and verifying compliance

Hosts need to take the time to comply with the recommendations of the scanning authority

but one last time ZC is fine,

and since zc is only emailing part of the number usingthe split its fine, the other part is stored in the DB and since its not an entire number it is not required to be encrypted

Merlin,

Any thoughts on the owasp guidelines and the application development question? I don't think this one can be answered by looking at the hosting environment, as it has to do with the way the code was developed. If these weren't considered during original code development, has there been any code review done with these guidelines in mind?

Douger:

6.2 Is the software and application development process based on an industry best practice and is information security included throughout the software development life cycle (SDLC) process?Security is not an afterthought during development. It is a consideration all the way through.

Douger:

6.5 Were guidelines commonly accepted by the security community (such as Open Web Application Security Project group (https://www.owasp.org) taken into account in the development of Web applications? Is there a specific issue at stake here?

Douger:

6.6 When authenticating over the Internet, is the application designed to prevent malicious users from trying to determine existing user accounts?Yes.

Douger:

6.7 Is sensitive cardholder data stored in cookies secured or encrypted?N/A -- not stored in cookies

Douger:

6.8 Are controls implemented on the servers side to prevent SQL injection and other bypassing of client side-input controls.Yes.
Douger:

Food for thought.More food for thought is ... have you compared Zen Cart's security vs that of other web-based applications? I think you'll find that the attention given by the Zen Cart team to security issues is equal to or greater than most other applications out there.

Every one of the issues listed here can be determined by reviewing the code and simply doing a few test transactions.

DrByte:

Is there a specific issue at stake here?

Hi Doc, Sorry I didn't get back to the forum before now, I've been working on other aspects of PCI/DSS compliance.

In answer to your question, yes. The specific issue is the ability of the zen cart user to truthfully answer all of the questions in the PCI/DSS questionnaire with a "yes" or "n/a". A single "no" answer results in a failing grade on the questionnaire. Compliance isn't just about passing a penetration test. The questions I listed that start out 6.x are directly from the questionnaire. Question 6.5 is only answerable by the original developers as it pertains to the base code. Any changes made to the code by users after the fact would also need to be done with the same "industry standard guidelines" in mind.

As merchants who are required to certify PCI/DSS compliance, we are responsible for the answers we give. It is easy to assume that all development was done to these standards, but without a statement from the developers there is nothing for us to hang a "yes" answer on. For many of us we are using the base code with little or no modifications, and a code review using the OWASP guidelines is beyond our capabilities.

An FAQ entry under the Security section that specifically addresses all of the PCI/DSS questions related to software development would do it.

Thanks.

Douger:

An FAQ entry under the Security section that specifically addresses all of the PCI/DSS questions related to software development would do it.

FAQ: https://www.zen-cart.com/tutorials/index.php?article=321

as one who has been harrassed and threatened by my cc merchant, I was (up until the time I dumped them) pci compliant. It has nothing to do with zen cart and everything to do with who hosts your website.

Even though I was pci compliant, they continued to fail me due to hosting issues. We finally came to an agreement when I emailed the specifics from my hoster to the security company. Even after that I failed due to some false positives. But finally, yes finally........i passed.

Then decided it was not worth my while to use that credit card processor any more, so since they had taken the security scan money out of my account with no fore notice or warning?.......i demanded a refund. Now I just use paypal virtual terminal and yes, I am still pci compliant.

Ask your host to move you to their PCI compliant server. This was a HUGE help, which no one suggested until i was already into a month of trying to be compliant and getting NO help.

I now consider myself an expert if you need any help......ROFL :shocking:

and as a side note....even though I am a level 4 merchant....it was demanded that I take the quarterly security screenings as well as the questionnaire. I am a one person operation and they were demanding the same compliance from me as they would from a large corporation. oh, dont get me started.....got an ulcer from the three months of heck they put me through!:censored:

Moon, which cc merchant is it?

I'm using Linkpoint and they dont seem to give me that much headache(which may be good some times tho)