PCI-DSS Compliance RE: Stone Edge, Hostasurus & Miva 5.5

[Maxer]

Re: PCI-DSS Compliance RE: Stone Edge, Hostasurus & Miva 5.5

I am using Innovative Gateway by Intruit , there on board with Miva real well ,called and asked to make sure and was told as long as were using Miva ,they told us not worry ,you are compliant and will be no problen with credit card processing ,one of the reason we moved away from our old card processor was the extra charges and the letters that was telling us that we wern't compliant and not accepting anything from anybody that mattered

The credit card companies are making the rules NOT the processors. That's like your service station telling you that you are compliant with EPA on the new exhaust they just sold you.

There seems to be some myth out there that if you just talk to someone on the phone about one piece of software you are good to go. PCI/PA-DSS refers to ALL aspects NOT just your shopping cart i.e. server, wireless lan, internet connection, paper storage if any , and on and on. Any area that stores, transmits or processes credit card data.

You must also have ongoing written security protocols for things like password access and regular changing of you password....

That all said, my freaking head is going to explode!

Violation of any of the above can have Visa or MasterCard at your door after the fact with hefty fines or loss of service. I have a sneaky suspicion that if you lose your merchant account because of a PCI-DSS violation, it will be difficult to get a new one somewhere else.....

As for PayQuake. They have not threatened me yet. They simply said "60 days". They have spent over an hour on the phone with a helpful attitude paralleled only by TrustWave whom I have spent two hours speaking with. $11 a month - money damn well spent. When it is all said and don't I won't be wondering if I am compliant I'll know........

I look around and I see Authorize.net, PayQuake and TrustWave in my corner during this fight. The rest of "my people" are wandering around........

[Maxer]

Re: PCI-DSS Compliance RE: Stone Edge, Hostasurus & Miva 5.5

Now I am being told by Hostasurus that Miva 5.5 won't even be PA-DSS after July 1st!!!!

[d_host]

Re: PCI-DSS Compliance RE: Stone Edge, Hostasurus & Miva 5.5

Thanks for chiming in Remik - So you are saying that I don't have a firewall and this does not meet PCI requirements?

That may be up to interpretation of the PCI requirements, but every auditor we've ever talked to, PA-DSS auditor, and every PCI seminar we've attended (including the one run by Miva Merchant at the last conference in February) always said a firewall is required. Firewall is defined as a separate device, outside of the web server itself, with a single-task purpose (ie: the firewall is not running on the same server as the web server itself, which excludes software firewalls like iptables).

Now I am being told by Hostasurus that Miva 5.5 won't even be PA-DSS after July 1st!!!!

That may or may not be true, and I'm sure Rick will chime in soon enough. It's not that difficult of a process to get PA-DSS certified, just time consuming and a bit of a PITA to go through the process, but it can be done. We host at least 3 different shopping carts (non Miva, obviously) that have been PA-DSS certified, one as far back as early 2009. For Miva to get PA-DSS certified it's just a matter of time at this point, I suspect they are 80-90% there already.

[Maxer]

Re: PCI-DSS Compliance RE: Stone Edge, Hostasurus & Miva 5.5

For Miva to get PA-DSS certified it's just a matter of time at this point, I suspect they are 80-90% there already.

So we have 5 days before my problems get worst. I don't understand why everyone is (apparently yourself excluded) behind on this?.....It's just plain scandalous IMHO.

[d_host]

Re: PCI-DSS Compliance RE: Stone Edge, Hostasurus & Miva 5.5

I'm not sure how I'm involved in this - I am not involved in day-to-day Miva operations, PA-DSS certification process, etc. dotCOM host is not Miva. I, too, am waiting for Miva Merchant to get its PA-DSS certification, like you and everyone else.

[Maxer]

Re: PCI-DSS Compliance RE: Stone Edge, Hostasurus & Miva 5.5

I'm not sure how I'm involved in this - I am not involved in day-to-day Miva operations, PA-DSS certification process, etc. dotCOM host is not Miva. I, too, am waiting for Miva Merchant to get its PA-DSS certification, like you and everyone else.

Hence why I said "(yourself excluded)" on the surface, to the layman, you seem ahead of the curve on this, not behind....

[surveillanceguy]

Re: PCI-DSS Compliance RE: Stone Edge, Hostasurus & Miva 5.5

they must have faith in Miva is all I can say ,we use the Miva gateway to process cards on the sight ,but figured I would ask them when talking with them last week,and said no Problem they know Miva will be compliant and that I have nothing to worry about ,that was the second time I asked too ,so figure they have a lot of faith in Miva ,any how was told flat out do not worry between my host and Miva software we meet and exceed compliance for them ,no misunderstanding at all from the call

[Maxer]

Re: PCI-DSS Compliance RE: Stone Edge, Hostasurus & Miva 5.5

they must have faith in Miva is all I can say ,we use the Miva gateway to process cards on the sight ,but figured I would ask them when talking with them last week,and said no Problem they know Miva will be compliant and that I have nothing to worry about ,that was the second time I asked too ,so figure they have a lot of faith in Miva ,any how was told flat out do not worry between my host and Miva software we meet and exceed compliance for them ,no misunderstanding at all from the call

You mean like when Wesley Snipes was told by his accountants that he did not have to pay taxes........ :)

Someone is blowing smoke brother and where there is smoke, often times fire follows with a vengeance.......

[Rick Wilson]

Re: PCI-DSS Compliance RE: Stone Edge, Hostasurus & Miva 5.5

We already are certified see my Sticky thread under Company News.

[Rick Wilson]

Re: PCI-DSS Compliance RE: Stone Edge, Hostasurus & Miva 5.5

Here's the post http://extranet.mivamerchant.com/for...d.php?t=100816

We got our Validation back on the 16th but since for it to be useful required the 5.07 Engine we didn't post this info until we released all the necessary items which we did this past week.

[Maxer]

Re: PCI-DSS Compliance RE: Stone Edge, Hostasurus & Miva 5.5

We already are certified see my Sticky thread under Company News.

See, this is exactly what I am talking about. David tells me this behind the scenes (instead of just posting here)- then you contradict.

I then post back to David your rebuttal expecting another retort sending me back here to post again for clarification.....quite a game.



Are existing 5.5 installs included in this Rick

Thanks for posting........standing by to give you a big wet kiss should this bear out :)

[surveillanceguy]

Re: PCI-DSS Compliance RE: Stone Edge, Hostasurus & Miva 5.5

Not to worried about compliance
RT @mivamerchant: In case you missed it, we're officially PA-DSS Validated http://extranet.mivamerchant.com/for...d.php?t=100816

3 calls now to my card process or still says were are compliant too,so doubt anybody
blowing smoke up my behind but thanks for the na sayers

Thanks anyhow
You mean like when Wesley Snipes was told by his accountants that he did not have to pay taxes........ :)

Someone is blowing smoke brother and where there is smoke, often times fire follows with a vengeance.......

Max

www.MaxairEngineering.com

[d_host]

Re: PCI-DSS Compliance RE: Stone Edge, Hostasurus & Miva 5.5

Hence why I said "(yourself excluded)" on the surface, to the layman, you seem ahead of the curve on this, not behind....

Thanks, but the choice to have firewalls in place was not driven by PCI or PA-DSS at all. It's just the right thing to do, which is why we've had firewalls in place since day one.

[d_host]

Re: PCI-DSS Compliance RE: Stone Edge, Hostasurus & Miva 5.5

3 calls now to my card process or still says were are compliant too,so doubt anybody blowing smoke up my behind but thanks for the na sayers

I don't think you are getting the point.... Just because your payment gateway is certified, and just because Miva Merchant is certified, does not make YOUR web site automatically certified. You still need to go through the PCI security audit and the SAQ. You can still fail that. If you fail the PCI audit, you can still lose your merchant account. When your merchant account provider requests proof of your compliance they don't care to see your payment gateway or shopping cart certifications, they want to see YOUR web site certification. Your payment gateway certification is not indemnification for your own business and how you process credit card transactions.

[Maxer]

Re: PCI-DSS Compliance RE: Stone Edge, Hostasurus & Miva 5.5

Not to worried about compliance
RT @mivamerchant: In case you missed it, we're officially PA-DSS Validated http://extranet.mivamerchant.com/for...d.php?t=100816

3 calls now to my card process or still says were are compliant too,so doubt anybody
blowing smoke up my behind but thanks for the na sayers

Thanks anyhow

I did see that. Thank you. Two of us have tried to explain that it is not just about one software or shopping cart. I don't care what you do about this or what you choose to believe. Its not my place....I am just trying to get the facts in this thread for others who are confused about what PCI/PA-DSS is and how to comply. Myth vs Fact......

Having your payment acquirer say over the phone that you are GTG does not in any way put you in compliance. You may get by with that but getting by and full compliance are two different matters.......

For me PCI-DSS compliance is a moral (and contractual) obligation to my customers, not just a wink wink nod nod......

I do wish you all the best luck and smooth sailing.......

***EDIT: Posted at the same time as Remik -did not mean to gang up on you..........