pci-compliance

PCI Compliance

Master PCI DSS (Payment Card Industry Data Security Standard) compliance for secure payment processing and handling of cardholder data.

Do not use this skill when

Instructions

Use this skill when

PCI DSS Requirements (12 Core Requirements)

Build and Maintain Secure Network

Protect Cardholder Data

Maintain Vulnerability Management

Implement Strong Access Control

Monitor and Test Networks

Maintain Information Security Policy

Compliance Levels

Level 1: > 6 million transactions/year (annual ROC required)
Level 2: 1-6 million transactions/year (annual SAQ)
Level 3: 20,000-1 million e-commerce transactions/year
Level 4: < 20,000 e-commerce or < 1 million total transactions

Data Minimization (Never Store)

# NEVER STORE THESE
PROHIBITED_DATA = {
    'full_track_data': 'Magnetic stripe data',
    'cvv': 'Card verification code/value',
    'pin': 'PIN or PIN block'
}
CAN STORE (if encrypted)

ALLOWED_DATA = {
    'pan': 'Primary Account Number (card number)',
    'cardholder_name': 'Name on card',
    'expiration_date': 'Card expiration',
    'service_code': 'Service code'
}
class PaymentData:
    """Safe payment data handling."""
    def __init__(self):
        self.prohibited_fields = ['cvv', 'cvv2', 'cvc', 'pin']
    def sanitize_log(self, data):
        """Remove sensitive data from logs."""
        sanitized = data.copy()
        # Mask PAN
        if 'card_number' in sanitized:
            card = sanitized['card_number']
            sanitized['card_number'] = f"{card[:6]}{''  (len(card) - 10)}{card[-4:]}"
        # Remove prohibited data
        for field in self.prohibited_fields:
            sanitized.pop(field, None)
        return sanitized
    def validate_no_prohibited_storage(self, data):
        """Ensure no prohibited data is being stored."""
        for field in self.prohibited_fields:
            if field in data:
                raise SecurityError(f"Attempting to store prohibited field: {field}")

Tokenization

Using Payment Processor Tokens

import stripe
class TokenizedPayment:
    """Handle payments using tokens (no card data on server)."""
    @staticmethod
    def create_payment_method_token(card_details):
        """Create token from card details (client-side only)."""
        # THIS SHOULD ONLY BE DONE CLIENT-SIDE WITH STRIPE.JS
        # NEVER send card details to your server
        """
        // Frontend JavaScript
        const stripe = Stripe('pk_...');
        const {token, error} = await stripe.createToken({
            card: {
                number: '4242424242424242',
                exp_month: 12,
                exp_year: 2024,
                cvc: '123'
            }
        });
        // Send token.id to server (NOT card details)
        """
        pass
    @staticmethod
    def charge_with_token(token_id, amount):
        """Charge using token (server-side)."""
        # Your server only sees the token, never the card number
        stripe.api_key = "sk_..."
        charge = stripe.Charge.create(
            amount=amount,
            currency="usd",
            source=token_id,  # Token instead of card details
            description="Payment"
        )
        return charge
    @staticmethod
    def store_payment_method(customer_id, payment_method_token):
        """Store payment method as token for future use."""
        stripe.Customer.modify(
            customer_id,
            source=payment_method_token
        )
        # Store only customer_id and payment_method_id in your database
        # NEVER store actual card details
        return {
            'customer_id': customer_id,
            'has_payment_method': True
            # DO NOT store: card number, CVV, etc.
        }

Custom Tokenization (Advanced)

import secrets
from cryptography.fernet import Fernet
class TokenVault:
    """Secure token vault for card data (if you must store it)."""
    def __init__(self, encryption_key):
        self.cipher = Fernet(encryption_key)
        self.vault = {}  # In production: use encrypted database
    def tokenize(self, card_data):
        """Convert card data to token."""
        # Generate secure random token
        token = secrets.token_urlsafe(32)
        # Encrypt card data
        encrypted = self.cipher.encrypt(json.dumps(card_data).encode())
        # Store token -> encrypted data mapping
        self.vault[token] = encrypted
        return token
    def detokenize(self, token):
        """Retrieve card data from token."""
        encrypted = self.vault.get(token)
        if not encrypted:
            raise ValueError("Token not found")
        # Decrypt
        decrypted = self.cipher.decrypt(encrypted)
        return json.loads(decrypted.decode())
    def delete_token(self, token):
        """Remove token from vault."""
        self.vault.pop(token, None)

Encryption

Data at Rest

from cryptography.hazmat.primitives.ciphers.aead import AESGCM
import os
class EncryptedStorage:
    """Encrypt data at rest using AES-256-GCM."""
    def __init__(self, encryption_key):
        """Initialize with 256-bit key."""
        self.key = encryption_key  # Must be 32 bytes
    def encrypt(self, plaintext):
        """Encrypt data."""
        # Generate random nonce
        nonce = os.urandom(12)
        # Encrypt
        aesgcm = AESGCM(self.key)
        ciphertext = aesgcm.encrypt(nonce, plaintext.encode(), None)
        # Return nonce + ciphertext
        return nonce + ciphertext
    def decrypt(self, encrypted_data):
        """Decrypt data."""
        # Extract nonce and ciphertext
        nonce = encrypted_data[:12]
        ciphertext = encrypted_data[12:]
        # Decrypt
        aesgcm = AESGCM(self.key)
        plaintext = aesgcm.decrypt(nonce, ciphertext, None)
        return plaintext.decode()
Usage

storage = EncryptedStorage(os.urandom(32))
encrypted_pan = storage.encrypt("4242424242424242")
Store encrypted_pan in database

Data in Transit

# Always use TLS 1.2 or higher
Flask/Django example

app.config['SESSION_COOKIE_SECURE'] = True  # HTTPS only
app.config['SESSION_COOKIE_HTTPONLY'] = True
app.config['SESSION_COOKIE_SAMESITE'] = 'Strict'
Enforce HTTPS

from flask_talisman import Talisman
Talisman(app, force_https=True)

Access Control

from functools import wraps
from flask import session
def require_pci_access(f):
    """Decorator to restrict access to cardholder data."""
    @wraps(f)
    def decorated_function(args, kwargs):
        user = session.get('user')
        # Check if user has PCI access role
        if not user or 'pci_access' not in user.get('roles', []):
            return {'error': 'Unauthorized access to cardholder data'}, 403
        # Log access attempt
        audit_log(
            user=user['id'],
            action='access_cardholder_data',
            resource=f.__name__
        )
        return f(args, *kwargs)
    return decorated_function
@app.route('/api/payment-methods')
@require_pci_access
def get_payment_methods():
    """Retrieve payment methods (restricted access)."""
    # Only accessible to users with pci_access role
    pass

Audit Logging

import logging
from datetime import datetime
class PCIAuditLogger:
    """PCI-compliant audit logging."""
    def __init__(self):
        self.logger = logging.getLogger('pci_audit')
        # Configure to write to secure, append-only log
    def log_access(self, user_id, resource, action, result):
        """Log access to cardholder data."""
        entry = {
            'timestamp': datetime.utcnow().isoformat(),
            'user_id': user_id,
            'resource': resource,
            'action': action,
            'result': result,
            'ip_address': request.remote_addr
        }
        self.logger.info(json.dumps(entry))
    def log_authentication(self, user_id, success, method):
        """Log authentication attempt."""
        entry = {
            'timestamp': datetime.utcnow().isoformat(),
            'user_id': user_id,
            'event': 'authentication',
            'success': success,
            'method': method,
            'ip_address': request.remote_addr
        }
        self.logger.info(json.dumps(entry))
Usage

audit = PCIAuditLogger()
audit.log_access(user_id=123, resource='payment_methods', action='read', result='success')

Security Best Practices

Input Validation

import re
def validate_card_number(card_number):
    """Validate card number format (Luhn algorithm)."""
    # Remove spaces and dashes
    card_number = re.sub(r'[\s-]', '', card_number)
    # Check if all digits
    if not card_number.isdigit():
        return False
    # Luhn algorithm
    def luhn_checksum(card_num):
        def digits_of(n):
            return [int(d) for d in str(n)]
        digits = digits_of(card_num)
        odd_digits = digits[-1::-2]
        even_digits = digits[-2::-2]
        checksum = sum(odd_digits)
        for d in even_digits:
            checksum += sum(digits_of(d  2))
        return checksum % 10
    return luhn_checksum(card_number) == 0
def sanitize_input(user_input):
    """Sanitize user input to prevent injection."""
    # Remove special characters
    # Validate against expected format
    # Escape for database queries
    pass

PCI DSS SAQ (Self-Assessment Questionnaire)

SAQ A (Least Requirements)

SAQ A-EP

SAQ D (Most Requirements)

Compliance Checklist

PCI_COMPLIANCE_CHECKLIST = {
    'network_security': [
        'Firewall configured and maintained',
        'No vendor default passwords',
        'Network segmentation implemented'
    ],
    'data_protection': [
        'No storage of CVV, track data, or PIN',
        'PAN encrypted when stored',
        'PAN masked when displayed',
        'Encryption keys properly managed'
    ],
    'vulnerability_management': [
        'Anti-virus installed and updated',
        'Secure development practices',
        'Regular security patches',
        'Vulnerability scanning performed'
    ],
    'access_control': [
        'Access restricted by role',
        'Unique IDs for all users',
        'Multi-factor authentication',
        'Physical security measures'
    ],
    'monitoring': [
        'Audit logs enabled',
        'Log review process',
        'File integrity monitoring',
        'Regular security testing'
    ],
    'policy': [
        'Security policy documented',
        'Risk assessment performed',
        'Security awareness training',
        'Incident response plan'
    ]
}

Resources

Common Violations

Reducing PCI Scope

By minimizing systems that touch card data, you reduce compliance burden significantly.