X-Cart Payments:PCI DSS implementation guide - Revision history

X-cart: /* Audit trails */

2015-09-07T15:55:29Z

‎Audit trails

2015-09-07T15:39:06Z

‎No cardholder data storage

2015-09-07T15:36:19Z

‎Audit trails

2015-09-04T14:18:51Z

‎Introduction

2015-09-04T14:15:58Z

‎Enabling SSL (Secure Socket Layer)

2015-02-16T08:58:18Z

‎Remote access

2015-02-16T08:57:52Z

‎Wireless communications

2015-02-16T08:56:42Z

‎Encrypting network traffic

2015-02-16T08:55:59Z

‎Enabling SSL (Secure Socket Layer)

2014-09-29T07:58:58Z

‎Introduction

@@ Line 164: / Line 164: @@
 ===Audit trails===
-Audit trails are automatically enabled with the default installation of X-Cart Payments. In order to save hosting space audit trails (logs) older than 90 days are removed to free up space for new logs. There is no option to disable audit logging. The log files are created in the <u>var/log/</u> directory. Make sure you restrict access to the log files by business need-to-know.
+Audit trails are automatically enabled with the default installation of X-Cart Payments. In order to save hosting space audit trails (logs) older than 90 days (as configured by default, can be increased) are removed to free up space for new logs. There is no option to disable audit logging, removing old audit trails can be disabled. The log files are created in the <u>var/log/</u> directory. Make sure you restrict access to the log files by business need-to-know.
 The following types of activity are logged:

@@ Line 69: / Line 69: @@
 '''X-Cart Payments''' can not be configured to store in the database the following types of data:
-* unmasked PAN
+* unmasked full PAN (by default it masks PAN to display first 6 and last 4 digits of PAN along with "Expiration date").
 * PIN
 * CVV

@@ Line 164: / Line 164: @@
 ===Audit trails===
-Audit trails are automatically enabled with the default installation of X-Cart Payments. There is no option to disable audit logging. The log files are created in the <u>var/log/</u> directory. Make sure you restrict access to the log files by business need-to-know.
+Audit trails are automatically enabled with the default installation of X-Cart Payments. In order to save hosting space audit trails (logs) older than 90 days are removed to free up space for new logs. There is no option to disable audit logging. The log files are created in the <u>var/log/</u> directory. Make sure you restrict access to the log files by business need-to-know.
 The following types of activity are logged:

@@ Line 1: / Line 1: @@
 ==  Introduction ==
-This guide covers '''X-Cart Payments''' 1.0, 2.0, 2.1 and is intended for merchants and integrators who wish to implement the application in accordance with guidelines set by the PCI Data Security Standard (PCI DSS).
+This guide covers '''X-Cart Payments''' 1.0, 2.0, 2.1, 2.2 and is intended for merchants and integrators who wish to implement the application in accordance with guidelines set by the PCI Data Security Standard (PCI DSS).
 == PCI DSS ==

@@ Line 116: / Line 116: @@
 SSL protects data that is transmitted between a browser and your web server. It is critical that you have SSL enabled on your web server, and this should be among the first steps taken after installation.
-* Your web server must be configured to use TLS v1 protocols with strong encryption (128-bit or longer key is required)
+* Your web server must be configured to use TLS v1.2 protocols with strong encryption (128-bit or longer key is required)
 * You will need to have a certificate issued for your web domain. Read [http://help.qtmsoft.com/index.php?title=Instant_SSL_certificate guidelines on installing Comodo's Instant SSL certificates].

@@ Line 225: / Line 225: @@
 X-Cart Payments provides web-based access using two-factor authentication based on one-time PIN codes. Detailed information can be found at [[X-Payments:Managing_PIN-codes | Managing PIN-codes]] page.
-If you enable remote access to your network and the cardholder data environment, you must implement two-factor authentication. Use technologies such as remote authentication and dial-in service (RADIUS) or terminal access controller access control system (TACACS) with tokens; or VPN (based on SSL/TLS or IPSEC) with individual certificates. You should make sure that any remote access software is securely configured by keeping in mind the following:
+If you enable remote access to your network and the cardholder data environment, you must implement two-factor authentication. Use technologies such as remote authentication and dial-in service (RADIUS) or terminal access controller access control system (TACACS) with tokens; or VPN (based on TLS or IPSEC) with individual certificates. You should make sure that any remote access software is securely configured by keeping in mind the following:
 * Change default settings in the remote access software (for example, change default passwords and use unique passwords for each customer)

@@ Line 212: / Line 212: @@
 * Personal firewall software should be installed on any mobile and employee-owned computers that have direct access to the internet and are also used to access your network.
 * Change wireless vendor defaults, including but not limited to, wired equivalent privacy (WEP) keys, default service set identifier (SSID), passwords and SNMP community strings. Disable SSID broadcasts. Enable WiFi protected access (WPA and WPA2) technology for encryption and authentication when WPA-capable.
-* Encrypt wireless transmissions by using WiFi protected access (WPA or WPA2) technology, IPSEC VPN, or SSL/TLS.
+* Encrypt wireless transmissions by using WiFi protected access (WPA or WPA2) technology, IPSEC VPN, or TLS.
 * Never rely exclusively on wired equivalent privacy (WEP) to protect confidentiality and access to a wireless LAN. If WEP is used, do the following:
 * Use with a minimum 104-bit encryption key and 24 bit-initialization value
-* Use ONLY in conjunction with WiFi protected access (WPA or WPA2) technology, VPN, or SSL/TLS
+* Use ONLY in conjunction with WiFi protected access (WPA or WPA2) technology, VPN, or TLS
 * Rotate shared WEP keys quarterly (or automatically if the technology permits)
 * Rotate shared WEP keys whenever there are changes in personnel with access to keys

@@ Line 197: / Line 197: @@
 ===Encrypting network traffic===
-X-Cart Payments uses encryption, such as SSL/TLS or IPSEC, for:
+X-Cart Payments uses encryption, such as TLS or IPSEC, for:
 * transmission of cardholder data over public networks, per PCI DSS requirement 4.1.
 * providing remote web-based access to the application
-If you use tools to remotely access the application, you should encrypt all communication using technologies such as SSL/TLS or IPSEC.
+If you use tools to remotely access the application, you should encrypt all communication using technologies such as TLS or IPSEC.
 As per PCI DSS requirement 4.2, cardholder data should never be sent unencrypted by e-mail, and X-Cart Payments does meet this requirement '''never''' sending cardholder data by e-mail or by IMs. Merchants and/or developers implementing X-Cart Payments should not attempt to customize this as a feature unless an encryption solution is also implemented.