PCI compliance on shared server?

Recently, while still working on my WPP implementation, I've started worrying about meeting the PCI compliance requirements. I sent a quick note to my hosting company, who responded:

"Because these are shared servers they will never be 100% PCI compliant. You would need a dedicated server for that."

I pushed a bit, saying that I realized that a security scan would likely identify some potential vulnerabilities, but would they be serious enough that we would not receive a passing report? I also asked whether they were aware of any other clients on their shared hosting plan that had achieved PCI compliance. The answer:

"We have told them if they need PCI compliance to go with a dedicated server that is PCI compliant."

Obviously, this does not inspire confidence, though I haven't actually submitted the site to a scan yet and so can't say for sure what the results might be. (By the way, is Paypal going to ask me for a copy of the scan result?)

So I guess my question is whether anybody has successfully implemented WPP and achieved the required PCI compliance in a shared hosting environment. (If so, and if this isn't against forum rules, I'd also be curious to know the name of the hosting company.)

You would not necessarily need a dedicated server - just a dedicated IP and Security certificate.

Before getting too worried about it- you might ask PayPal if they are going to require a PCI scan.

dkoehler,

their statement is false,
we have many clients that are PCI Compliant on shared servers

I took Kim's advice and spoke to somebody at Paypal, who told me that he didn't expect Paypal to ask for a PCI scan, and that if I was asked it would be by one of the credit card companies.

So I guess that doesn't entirely solve my problem, but at least postpones it for a while. Good to hear that it's possible to achieve PCI compliance on a shared server. Seems that the worst case scenario is that I'll have to switch to a hosting company that is more prepared to help its clients with this issue.

Dkoehler

I have been using WPP on a few sites for a while, i have not been asked to acheive PCI DSS as of yet and have been accepting payments for about 6 months, my host is PCI DSS Compliant, if you require the hostname send me a pm and i will let you know, i wouldn't worry too much though as it is unlikly a CC company will need to PCI scan you.

Rob

It's usually the Banks that ask for PCI compliancy, when you have an Internet Merchant ID with them. Only some Banks will ask for PCI compliance., and even then they will only usually require it of sites which sell high-value high-tech items in large quantities.

As to whether a shared server can be made to be PCI compliant depends upon whether or not the Bank asking for the scan requires you to use a specific scaning company and what the scanning company requirements are. Mc Afee Security Scan have recently changed their requirements to such an extent that it cannot be achieved on a shared server without causing inconvenience to all other customers.

I find this rich coming from McAfee, as their Virus Scanning software lets through so many viruses that we dumped them years ago.

Vger

vger,

we have several folks using mcafee with no issues and no hardships.

You may want to wait until they have their next scheduled McAfee Security Scan before saying that.

We had no problems either, until a scheduled security scan came around and failed (where previously it had passed).

But it may depend on your server setup as to whether their new conditions are a problem for your customers.

Rather than go into detail here I'll send you a PM.

Vger

Merlinpa1969:

vger,

we have several folks using mcafee with no issues and no hardships.

thats kool,
we just passed one like 3 days ago

i, also have issues with the PCI scans... according to the scan, the PHP version isn't the one our host uses. could Zencart override the host settings when they scan our site? then, how do i get certified when Zencart is running an "unsecure" php version?
can you private me w/answer if that would be safer?

zencart has nothing to do with the version of php

thats ALL your host

you can see what version they are running by going to your ZC -> admin -> tools -> server settings

thanks. this is SOOOO frustrating. how do they expect small start ups to get this done :censored: PHP versions, open ports, "you need a dedicated server... heck, i ain't a millionair to pay 200 a month for the server, 50+for CC gateway, and, and, and... and then, they charge you anouther 150+ a year just for that damn compliance. and "you either comply or we charge you even more... we're sooo *ucking ducky for the right to pay everyone....

you dont need a dedicated ssl for PCI Compliance, and anyone that tells you so is full of crap.....

we have alot of folks ( on shared servers ) that are PCI Compliant,

how do I know this,

cause Im the schmuck that gets to deal with

Macfee
Comodo
Security Metrics
etc.....

its a little more intense to setup a shared server to be pci compliant... the thing is that the servers themselves need to be compliant before you worry about an account

Like Merlin said shared or dedicated can be PCI compliant and as said in the thread previously only Banks or processing companies will ask for PCI not PayPal. But if you use PayPal Pro merchant service it is possible you will be asked to meet the PCI compliance standards not for personal or every day use like most use.

PCI can go many ways there is false positives that are often reported which means the server is up todate but the PCI scanner is not able to read the updated boards from the upgrade due to the scanner is not updated itself.

We deal with hundreds of these as well and shared and dedicated ssls can be used even though sometimes it is not required but ssl maybe required by the Merchant such as authorize.net requires it and a few others but as far as I know we have never been asked to put ssl up for PCI compliance as a requirement for a customer.

To find out truly what is required it is best to contact the company scanning or offering the service what is required so you can get your host up to date what needs done where the work load is not as heavy on the hosts and yourself.

I need to resurrect this 6 month old post due to some bad information.

It is true that you don't need a dedicated server to be truly PCI compliant. You need multiple dedicated servers. :shocking:

A remote scan of your website is a tiny, tiny sliver of what PCI compliance requires. A "clean" scan does not mean you are compliant.

Each server must have one primary role -- you can't pile Apache, MySQL, DNS, and a mail server all on one box. You must have a web application firewall. Credit card information must be encrypted. You must have a documented security policy for employees and contractors. If you use a commercial ecommerce application, it must be PCI PA-DSS certified. If you built your own, you must have rigorous security testing policies, and separation of dev/test/stage/production environments. You must have agreements in place with any service providers who handle your credit card data -- they must be PCI compliant as well.

That's a subset of the requirements from https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml

And 100% of this is required for all merchants who accept credit cards, large and small.

magnafix:

And 100% of this is required for all merchants who accept credit cards, large and small.

I think you meant to say "and 100% of this is required for all merchants who store credit card information, large and small."

Actually there's a whole lot more that is just plain wrong in the statement by Magnafix.

Vger

stevesh:

I think you meant to say "and 100% of this is required for all merchants who store credit card information, large and small."

"Store, process, or transmit" is the phrase used.

With PCI you need to work hard to restrict your 'cardholder data environment' to as few machines as possible. Anything that stores, processes, or transmits is in scope.

If your cart does not directly accept cards, but instead links offsite to paypal, that helps a lot, since you are not storing, processing, or transmitting. But if the cart software accepts the card and THEN transmits it, your webserver is in scope and must be compliant.

I'm not arguing, but your (magnafix) post is an excellent example of the FUD being perpetrated on the Internet about PCI.

The idea that even a site (like most Zencart sites) which just passes the CC information to another party requires the security measures you described is (must be) wrong.

If that were true, Camelot's shared hosting couldn't be PCI compliant, and it seems to be.

Also, while the federal government doesn't seem to mind putting hundreds or thousands of small Internet sellers out of business (http://online.wsj.com/article/SB123189645948879745.html), my guess would be that the credit card issuers would, unless they think they can survive with only the big Web retailers.

stevesh:

I'm not arguing, but your (magnafix) post is an excellent example of the FUD being perpetrated on the Internet about PCI.

The idea that even a site (like most Zencart sites) which just passes the CC information to another party requires the security measures you described is (must be) wrong.

If that were true, Camelot's shared hosting couldn't be PCI compliant, and it seems to be.

Also, while the federal government doesn't seem to mind putting hundreds or thousands of small Internet sellers out of business (http://online.wsj.com/article/SB123189645948879745.html), my guess would be that the credit card issuers would, unless they think they can survive with only the big Web retailers.

I'm not trying to argue either, just giving my best understanding of the PCI documentation. I work at a hosting company and we have been studying this for a couple years, off and on, and gradually working towards compliance.

Certainly, if you store card information, all 12 sections apply. If your site has a form which collects card information, and then instantaneously transmits it to a remote processor and doesn't store anything, most if it still applies.

For hosting companies -- you also have to comply with Appendix A.

I agree that the requirements appear horrendously onerous to the average "Laura's E-Shop" type small ecommerce sites out there, and even small businesses without dedicated IT/security teams. I further agree that if the card industry really enforced PCI DSS, they would put millions of small businesses out of business, and crush the economy. So that's not going to happen.

But that doesn't stop the processors/merchant account providers from tacking on a non-compliance fee of whatever they please.

And now there is a large and growing scanning/compliance/consulting industry to which PCI DSS gives a tremendous boost. Vested interests.

Our merchant account provider is emailing us weekly urging us to sign up with SecurityMetrics for our quarterly scans. No point in scans if we can't say YES to 100% of the questions on the form though. A single NO, with regards to your cardholder data environment, means you're non-compliant.

If someone can point to documentation that indicates I have misinterpreted something, I am all ears.