pci-compliance

PCI Compliance

Master PCI DSS (Payment Card Industry Data Security Standard) compliance for secure payment processing and handling of cardholder data.

When to Use This Skill

• Building payment processing systems
• Handling credit card information
• Implementing secure payment flows
• Conducting PCI compliance audits
• Reducing PCI compliance scope
• Implementing tokenization and encryption
• Preparing for PCI DSS assessments

PCI DSS Requirements (12 Core Requirements)

Build and Maintain Secure Network

1. Install and maintain firewall configuration
2. Don't use vendor-supplied defaults for passwords

Protect Cardholder Data

3. Protect stored cardholder data
4. Encrypt transmission of cardholder data across public networks

Maintain Vulnerability Management

5. Protect systems against malware
6. Develop and maintain secure systems and applications

Implement Strong Access Control

7. Restrict access to cardholder data by business need-to-know
8. Identify and authenticate access to system components
9. Restrict physical access to cardholder data

Monitor and Test Networks

10. Track and monitor all access to network resources and cardholder data
11. Regularly test security systems and processes

Maintain Information Security Policy

12. Maintain a policy that addresses information security

Compliance Levels

Level 1: > 6 million transactions/year (annual ROC required) Level 2: 1-6 million transactions/year (annual SAQ) Level 3: 20,000-1 million e-commerce transactions/year Level 4: < 20,000 e-commerce or < 1 million total transactions

Data Minimization (Never Store)

# NEVER STORE THESE
PROHIBITED_DATA = {
    'full_track_data': 'Magnetic stripe data',
    'cvv': 'Card verification code/value',
    'pin': 'PIN or PIN block'
}
 
# CAN STORE (if encrypted)
ALLOWED_DATA

Tokenization

Using Payment Processor Tokens

import stripe
 
class TokenizedPayment:
    """Handle payments using tokens (no card data on server)."""
 
    @staticmethod
    def create_payment_method_token(card_details):

Custom Tokenization (Advanced)

import secrets
from cryptography.fernet import Fernet
 
class TokenVault:
    """Secure token vault for card data (if you must store it)."""
 
    def __init__(self, encryption_key):
        self.cipher = Fernet(encryption_key)
        self.vault =

Encryption

Data at Rest

from cryptography.hazmat.primitives.ciphers.aead import AESGCM
import os
 
class EncryptedStorage:
    """Encrypt data at rest using AES-256-GCM."""
 
    def __init__(self, encryption_key):
        """Initialize with 256-bit key."""
        self.key = encryption_key  # Must be 32 bytes
 

Data in Transit

# Always use TLS 1.2 or higher
# Flask/Django example
app.config['SESSION_COOKIE_SECURE'] = True  # HTTPS only
app.config['SESSION_COOKIE_HTTPONLY'] = True
app.config['SESSION_COOKIE_SAMESITE'] = 'Strict'
 
# Enforce HTTPS
from flask_talisman import Talisman
Talisman(app, force_https=True)

Access Control

from functools import wraps
from flask import session
 
def require_pci_access(f):
    """Decorator to restrict access to cardholder data."""
    @wraps(f)
    def decorated_function(*args, **kwargs):
        user = session.get('user'

Audit Logging

import logging
from datetime import datetime
 
class PCIAuditLogger:
    """PCI-compliant audit logging."""
 
    def __init__(self):
        self.logger = logging.getLogger('pci_audit')

Security Best Practices

Input Validation

import re
 
def validate_card_number(card_number):
    """Validate card number format (Luhn algorithm)."""
    # Remove spaces and dashes
    card_number = re.sub(r'[\s-]', '', card_number)
 
    # Check if all digits
    if not card_number.isdigit():
        return

PCI DSS SAQ (Self-Assessment Questionnaire)

SAQ A (Least Requirements)

• E-commerce using hosted payment page
• No card data on your systems
• ~20 questions

SAQ A-EP

• E-commerce with embedded payment form
• Uses JavaScript to handle card data
• ~180 questions

SAQ D (Most Requirements)

• Store, process, or transmit card data
• Full PCI DSS requirements
• ~300 questions

Compliance Checklist

PCI_COMPLIANCE_CHECKLIST = {
    'network_security': [
        'Firewall configured and maintained',
        'No vendor default passwords',
        'Network segmentation implemented'
    ],
    'data_protection': [
        'No storage of CVV, track data, or PIN',
        'PAN encrypted when stored',
        'PAN masked when displayed'

Resources

• references/data-minimization.md: Never store prohibited data
• references/tokenization.md: Tokenization strategies
• references/encryption.md: Encryption requirements
• references/access-control.md: Role-based access
• references/audit-logging.md: Comprehensive logging
• assets/pci-compliance-checklist.md: Complete checklist
• assets/encrypted-storage.py: Encryption utilities
• scripts/audit-payment-system.sh: Compliance audit script

Common Violations

1. Storing CVV: Never store card verification codes
2. Unencrypted PAN: Card numbers must be encrypted at rest
3. Weak Encryption: Use AES-256 or equivalent
4. No Access Controls: Restrict who can access cardholder data
5. Missing Audit Logs: Must log all access to payment data
6. Insecure Transmission: Always use TLS 1.2+
7. Default Passwords: Change all default credentials
8. No Security Testing: Regular penetration testing required

Reducing PCI Scope

1. Use Hosted Payments: Stripe Checkout, PayPal, etc.
2. Tokenization: Replace card data with tokens
3. Network Segmentation: Isolate cardholder data environment
4. Outsource: Use PCI-compliant payment processors
5. No Storage: Never store full card details

By minimizing systems that touch card data, you reduce compliance burden significantly.