So, I was doing my normal business as usual. I'm in an area that does not show 5G coverage. To my surprise, I saw a 5G icon appear. Stayed for about 15 seconds then I lost it. I'm not sure if they are testing, but if they do officially turn it on this would be the furthest north in this area it has gone. The closest area to me with 5G coverage is Westmoreland county. Fingers crossed!

Since SAQ-C and C-VT can be out-of-the box software/web applications doesn't it need to meet PA-PCI DSS rather than just PCI-DSS. Have I misunderstood what PA-PCI DSS?

Hello PCI Fans,

I'm currently working on my company's Software Development Life cycle document for PA-DSS. Does anyone have good examples of a fully or partially compliant SDLC I could use to measure against my work?

My Google-Fu seems to be leaving me short on this one.

My company uses an internally developed Point of Sale software application in our retail stores. We have not certified the application with a QSA because under previous PA-DSS guidelines if "the application is not sold, distributed, or licensed to third parties" it is not subject to PA-DSS scoping requirements. (see: https://www.pcisecuritystandards.org/documents/which_applications_eligible_for_pa-dss_validation.pdf) We are integrated with TSYS's transit SDK and have received certification in the past from their dev team without a PA-DSS certificate.

Now, we are currently in the midst of trying to get EMV integration built into our software and are running into a roadblock with TSYS, who is suddenly claiming that we have to have a PA-DSS cert to get certified for EMV on the transit portal.

Can anyone tell me, does EMV change the PA-DSS exclusion requirements or are they incorrect? We are only certifying for Chip-and-Signature at this time if that makes a difference.

Thanks in advance

Hey /r/ecommerce!

I’m a sr. account executive trying to understand PCI compliance and PA-DSS compliance and I feel like I’ve gotten in over my head. I just need help with a few answers from people who know more about this- so thank you in advance for reading!

The client my company is working with is building an ecommerce platform using Magento Community Edition. They are classified as a level 4 merchant with less than 20,000 transactions per year. For payment processing, they have an account through First Data. We're using a Magento extension with an API connection to First Data's Global Gateway e4 Web Service to process all CC payments. http://www.magentocommerce.com/magento-connect/magento-firstdata-api-payment-module-originally-linkpoint.html

During the check-out, a user enters their information through Magento's front-end page, and once they hit 'purchase' the information is sent through an encrypted SSL connection to First Data for payment processing.

So I have a few questions on how we can help our client pass compliance testing and ensure our systems are up to the industry standards for a level 4 merchant.

• As a level 4 merchant, do we need to be PCI compliant?
• What kind of security do we need to put in place to pass compliance testing?
• What is the difference between PCI compliance and PA-DSS compliance?
• As a level 4 merchant, does Magento and the API extension need to be PA-DSS compliant?
• How do other merchants get approved using the Magento Community Edition?

Thank you so much if you can offer any insight!

-Rebecca

Lots of goodies in there. Finally allowing wildcards for versions. A description of what is required for new 'delta assessments'. And a completely new definition of Low Impact changes.

These address some of the biggest pain points with my customers; I'm liking it so far.

https://www.pcisecuritystandards.org/documents/PA-DSS_Program_Guide_v3.pdf

I know C796 has changed in the last year or so and that most of the samples you can find are from the old version with a template. The following generally applies to any PA that does not have a template for those who aren't this far yet. Here's what I did to finish it out:

TASK 1 - Start out by getting the Rubric for Task 2 and Task 3. Determine what you think you will do your project on then go through the rubrics and make sure you can hit all of those points with it. It will save you some back and forth and might keep you from making things too complicated. I started with just changing some existing code to comply with PCI DSS requirement but once I saw there were artifacts required for Task 3 I then added in a portion to also make up procedures and a log for physical security. I did not necessarily need that but it made it easier to hit the artifact requirement and also added some length overall to the papers.

TASK 2 - This is the biggest paper as it covers the most. Start with a cover page and table of contents. Then copy each Aspect Title out of the Rubric and put them in as Heading1 or Heading2 (depending on if they are a main topic A or a subtopic A1). There will be a couple at the end named like references and professional communication that you can leave off as they are more judged by the whole paper. Leave the others there when you turn it in as that will show the person reading it what to expect in that section and let you know where to make changes if it comes back for revision. This becomes your template. Start putting all of your info for each section under the heading. Mine was 15 double space pages including the Table of Contents and References pages (16 including the title page). Yes, I have 20 years in IT with much of that writing garbage for other IT people so I an brief as I can be on these. I had to revise mine twice to pass. First time was because I did not repeat info properly in sections to explain things relating to that particular section. Second was because I pulled a full duh and didn't make sure I checked the whole feedback before submitting.

TASK 3 - Same as Task 2. Make a template from the Rubric and follow it. For the Artifacts, leave that Artifact heading in there and make your artifacts in Word/Excel/Visio/Whatever and just put the files there or copy in the tables/drawings/images. Mine was one Word doc of procedures and log samples so I just inserted the whole docx file. My Task 3 Passed on the fi

I don't want to step on anybody's toes here, but the amount of non-dad jokes here in this subreddit really annoys me. First of all, dad jokes CAN be NSFW, it clearly says so in the sub rules. Secondly, it doesn't automatically make it a dad joke if it's from a conversation between you and your child. Most importantly, the jokes that your CHILDREN tell YOU are not dad jokes. The point of a dad joke is that it's so cheesy only a dad who's trying to be funny would make such a joke. That's it. They are stupid plays on words, lame puns and so on. There has to be a clever pun or wordplay for it to be considered a dad joke.

Again, to all the fellow dads, I apologise if I'm sounding too harsh. But I just needed to get it off my chest.

Do your worst!

TL;DR at the bottom

DD has now been covered on Randall Cornett's channel on YouTube link

Good afternoon, Apes

Something very important is currently going on with $AMC that, if you aren't aware, could have a substantial effect on the MOASS, and we can all have a direct impact.

If you have not heard, u/einfachman pointed out in this post that Adam Aron's recent decision to announce a public Q&A presents us with an opportunity to publicly count our shares.

This is made possible through "Say Technologies", a company that facilitates retail investor Q&A sessions during earnings calls for small cap companies. Typically, it has not been feasible or necessary for large companies like AMC to host a Q&A for retail investors; however, due to the massive interest from retail investors in AMC, it would seem they found a reason.

Why are we even taking a vote twice? Why does it matter?

Many apes do not realize that "Proxyvoting" services like through DF King & Co., are not allowed to make public statements regarding overvoting, which would otherwise be legal proof of naked shorting. This is due to SEC rulings and laws surrounding insider trading and making unsubstantiated claims of fraud which could land AMC and its executive staff in hot water with the law--especially if those figures are subject to an ongoing investigation by the SEC.

As a result, even though there may absolutely be naked shorts, and even though Adam Aron and his staff may know that the number of votes they received during the shareholder meeting were sketchy as hell, they are legally bound to keep their mouths shut. In my opinion, this only further cements the fraudulence of our markets, but nevertheless, there is a loophole.

If AMC investors connected through a legitimate organization (such as Say Technologies) which was capable of verifying legitimate shares of the company, and the following applies ...

1. This company does not materially benefit nor does it possess any conflict of interest in regards to the number of votes collected
2. The company does not receive nor disseminate substantial, non-public information through its services
3. The company publicly provided the number of shares/votes cast to discuss any non-specific issue regardless of outcome
4. The company does not hold any stake or i

I'm surprised it hasn't decade.

Doesn't factor in how clutch it is so it's based on how good the play is

Best Shot Ever IMO Honorable Mention

Best Block Ever IMO Honorable Mention

Best Rebound Ever IMO Honorable Mention

Best Steal Ever IMO I can't think of an honorable mention

Best Pass Ever IMO Honorable Mention

Best Dunk Ever IMO Honorable Mention Honorable Mention 2

Best Handles Ever IMO Honorable Mention

What do you think about my list?

Cyber security, much like the military, has turned everything into an acronym. Then assumes the entire world knows their niche acronym for no apparent reason.

This is where our cyber security guide here will come in handy.

The list (alphabetised):

(2FA): Two-factor authentication

Used to manage devices – compliant or non-compliant – that contain minimal to moderately sensitive data.

AMP: Advanced Malware Protection

software is designed to prevent, detect, and help remove threats in an efficient manner from computer systems. Threats can take the form of software viruses and other malware such as ransomware, worms, Trojans, spyware, adware, and file-less malware.

CASB: A Cloud Access Security Broker

is an on-premises or cloud-based security policy enforcement point that is placed between cloud service consumers and cloud service providers to combine and interject enterprise security policies as cloud-based resources are accessed.

CI/CD:

Is a method for distributing to clients frequently using automation stages of application development. The main items which are attributed to the CI / CD are continuous integration, continuous distribution and continuous implementation.

CIS:

The Center for Internet Security publishes the CIS Critical Security Controls (CSC) to help organizations better defend against known attacks by distilling key security concepts into actionable controls to achieve greater overall cybersecurity defense.

CMMC: Cybersecurity Maturity Model Certification

is a unifying standard for the implementation of cybersecurity across the Defense Industrial Base (DIB)

CSF:

The Cybersecurity Framework was created by The National Institute of Standards and Technology (NIST) as a voluntary cybersecurity framework based on existing standards, guidelines, and practices for organizations to better manage and reduce cybersecurity risk.

CUI:

Controlled Unclassified Information is an umbrella term that encompasses many different markings to identify information that is not classified but which should be protected.

DPI:  Deep packet inspection

or packet sniffing is an advanced method of examining and managing network traffic.

EDR: Endpoint Detection and Response

is an integrated

For context I'm a Refuse Driver (Garbage man) & today I was on food waste. After I'd tipped I was checking the wagon for any defects when I spotted a lone pea balanced on the lifts.

I said "hey look, an escaPEA"

No one near me but it didn't half make me laugh for a good hour or so!

Edit: I can't believe how much this has blown up. Thank you everyone I've had a blast reading through the replies 😂

It really does, I swear!

Because she wanted to see the task manager.

Heard they've been doing some shady business.

but then I remembered it was ground this morning.

Edit: Thank you guys for the awards, they're much nicer than the cardboard sleeve I've been using and reassures me that my jokes aren't stale

Edit 2: I have already been made aware that Men In Black 3 has told a version of this joke before. If the joke is not new to you, please enjoy any of the single origin puns in the comments

BamBOO!

They’re on standbi

Pilot on me!!

A play on words.

Christopher Walken

Nothing, he was gladiator.

Or would that be too forward thinking?

Hey /r/techsupport! Not sure if this its ok to post a question about pci compliance in this subreddit...

I’m a sr. account executive trying to understand PCI compliance and PA-DSS compliance and I feel like I’ve gotten in over my head. I just need help with a few answers from people who know more about this- so thank you in advance for reading!

The client my company is working with is building an ecommerce platform using Magento Community Edition. They are classified as a level 4 merchant with less than 20,000 transactions per year. For payment processing, they have an account through First Data. We're using a Magento extension with an API connection to First Data's Global Gateway e4 Web Service to process all CC payments. http://www.magentocommerce.com/magento-connect/magento-firstdata-api-payment-module-originally-linkpoint.html

During the check-out, a user enters their information through Magento's front-end page, and once they hit 'purchase' the information is sent through an encrypted SSL connection to First Data for payment processing.

So I have a few questions on how we can help our client pass compliance testing and ensure our systems are up to the industry standards for a level 4 merchant.

• As a level 4 merchant, do we need to be PCI compliant?
• What kind of security do we need to put in place to pass compliance testing?
• What is the difference between PCI compliance and PA-DSS compliance?
• As a level 4 merchant, does Magento and the API extension need to be PA-DSS compliant?
• How do other merchants get approved using the Magento Community Edition?

Thank you so much if you can offer any insight!

-Rebecca