Pci Compliance

1---
2name: pci-compliance
3description: Implement PCI DSS compliance requirements for secure handling of payment card data and payment systems. Use when securing payment processing, achieving PCI compliance, or implementing payment card security measures.
4---
5 
6# PCI Compliance
7 
8Master PCI DSS (Payment Card Industry Data Security Standard) compliance for secure payment processing and handling of cardholder data.
9 
10## Do not use this skill when
11 
12- The task is unrelated to pci compliance
13- You need a different domain or tool outside this scope
14 
15## Instructions
16 
17- Clarify goals, constraints, and required inputs.
18- Apply relevant best practices and validate outcomes.
19- Provide actionable steps and verification.
20- If detailed examples are required, open `resources/implementation-playbook.md`.
21 
22## Use this skill when
23 
24- Building payment processing systems
25- Handling credit card information
26- Implementing secure payment flows
27- Conducting PCI compliance audits
28- Reducing PCI compliance scope
29- Implementing tokenization and encryption
30- Preparing for PCI DSS assessments
31 
32## PCI DSS Requirements (12 Core Requirements)
33 
34### Build and Maintain Secure Network
351. Install and maintain firewall configuration
362. Don't use vendor-supplied defaults for passwords
37 
38### Protect Cardholder Data
393. Protect stored cardholder data
404. Encrypt transmission of cardholder data across public networks
41 
42### Maintain Vulnerability Management
435. Protect systems against malware
446. Develop and maintain secure systems and applications
45 
46### Implement Strong Access Control
477. Restrict access to cardholder data by business need-to-know
488. Identify and authenticate access to system components
499. Restrict physical access to cardholder data
50 
51### Monitor and Test Networks
5210. Track and monitor all access to network resources and cardholder data
5311. Regularly test security systems and processes
54 
55### Maintain Information Security Policy
5612. Maintain a policy that addresses information security
57 
58## Compliance Levels
59 
60**Level 1**: > 6 million transactions/year (annual ROC required)
61**Level 2**: 1-6 million transactions/year (annual SAQ)
62**Level 3**: 20,000-1 million e-commerce transactions/year
63**Level 4**: < 20,000 e-commerce or < 1 million total transactions
64 
65## Data Minimization (Never Store)
66 
67```python
68# NEVER STORE THESE
69PROHIBITED_DATA = {
70    'full_track_data': 'Magnetic stripe data',
71    'cvv': 'Card verification code/value',
72    'pin': 'PIN or PIN block'
73}
74 
75# CAN STORE (if encrypted)
76ALLOWED_DATA = {
77    'pan': 'Primary Account Number (card number)',
78    'cardholder_name': 'Name on card',
79    'expiration_date': 'Card expiration',
80    'service_code': 'Service code'
81}
82 
83class PaymentData:
84    """Safe payment data handling."""
85 
86    def __init__(self):
87        self.prohibited_fields = ['cvv', 'cvv2', 'cvc', 'pin']
88 
89    def sanitize_log(self, data):
90        """Remove sensitive data from logs."""
91        sanitized = data.copy()
92 
93        # Mask PAN
94        if 'card_number' in sanitized:
95            card = sanitized['card_number']
96            sanitized['card_number'] = f"{card[:6]}{'*' * (len(card) - 10)}{card[-4:]}"
97 
98        # Remove prohibited data
99        for field in self.prohibited_fields:
100            sanitized.pop(field, None)
101 
102        return sanitized
103 
104    def validate_no_prohibited_storage(self, data):
105        """Ensure no prohibited data is being stored."""
106        for field in self.prohibited_fields:
107            if field in data:
108                raise SecurityError(f"Attempting to store prohibited field: {field}")
109```
110 
111## Tokenization
112 
113### Using Payment Processor Tokens
114```python
115import stripe
116 
117class TokenizedPayment:
118    """Handle payments using tokens (no card data on server)."""
119 
120    @staticmethod
121    def create_payment_method_token(card_details):
122        """Create token from card details (client-side only)."""
123        # THIS SHOULD ONLY BE DONE CLIENT-SIDE WITH STRIPE.JS
124        # NEVER send card details to your server
125 
126        """
127        // Frontend JavaScript
128        const stripe = Stripe('pk_...');
129 
130        const {token, error} = await stripe.createToken({
131            card: {
132                number: '4242424242424242',
133                exp_month: 12,
134                exp_year: 2024,
135                cvc: '123'
136            }
137        });
138 
139        // Send token.id to server (NOT card details)
140        """
141        pass
142 
143    @staticmethod
144    def charge_with_token(token_id, amount):
145        """Charge using token (server-side)."""
146        # Your server only sees the token, never the card number
147        stripe.api_key = "sk_..."
148 
149        charge = stripe.Charge.create(
150            amount=amount,
151            currency="usd",
152            source=token_id,  # Token instead of card details
153            description="Payment"
154        )
155 
156        return charge
157 
158    @staticmethod
159    def store_payment_method(customer_id, payment_method_token):
160        """Store payment method as token for future use."""
161        stripe.Customer.modify(
162            customer_id,
163            source=payment_method_token
164        )
165 
166        # Store only customer_id and payment_method_id in your database
167        # NEVER store actual card details
168        return {
169            'customer_id': customer_id,
170            'has_payment_method': True
171            # DO NOT store: card number, CVV, etc.
172        }
173```
174 
175### Custom Tokenization (Advanced)
176```python
177import secrets
178from cryptography.fernet import Fernet
179 
180class TokenVault:
181    """Secure token vault for card data (if you must store it)."""
182 
183    def __init__(self, encryption_key):
184        self.cipher = Fernet(encryption_key)
185        self.vault = {}  # In production: use encrypted database
186 
187    def tokenize(self, card_data):
188        """Convert card data to token."""
189        # Generate secure random token
190        token = secrets.token_urlsafe(32)
191 
192        # Encrypt card data
193        encrypted = self.cipher.encrypt(json.dumps(card_data).encode())
194 
195        # Store token -> encrypted data mapping
196        self.vault[token] = encrypted
197 
198        return token
199 
200    def detokenize(self, token):
201        """Retrieve card data from token."""
202        encrypted = self.vault.get(token)
203        if not encrypted:
204            raise ValueError("Token not found")
205 
206        # Decrypt
207        decrypted = self.cipher.decrypt(encrypted)
208        return json.loads(decrypted.decode())
209 
210    def delete_token(self, token):
211        """Remove token from vault."""
212        self.vault.pop(token, None)
213```
214 
215## Encryption
216 
217### Data at Rest
218```python
219from cryptography.hazmat.primitives.ciphers.aead import AESGCM
220import os
221 
222class EncryptedStorage:
223    """Encrypt data at rest using AES-256-GCM."""
224 
225    def __init__(self, encryption_key):
226        """Initialize with 256-bit key."""
227        self.key = encryption_key  # Must be 32 bytes
228 
229    def encrypt(self, plaintext):
230        """Encrypt data."""
231        # Generate random nonce
232        nonce = os.urandom(12)
233 
234        # Encrypt
235        aesgcm = AESGCM(self.key)
236        ciphertext = aesgcm.encrypt(nonce, plaintext.encode(), None)
237 
238        # Return nonce + ciphertext
239        return nonce + ciphertext
240 
241    def decrypt(self, encrypted_data):
242        """Decrypt data."""
243        # Extract nonce and ciphertext
244        nonce = encrypted_data[:12]
245        ciphertext = encrypted_data[12:]
246 
247        # Decrypt
248        aesgcm = AESGCM(self.key)
249        plaintext = aesgcm.decrypt(nonce, ciphertext, None)
250 
251        return plaintext.decode()
252 
253# Usage
254storage = EncryptedStorage(os.urandom(32))
255encrypted_pan = storage.encrypt("4242424242424242")
256# Store encrypted_pan in database
257```
258 
259### Data in Transit
260```python
261# Always use TLS 1.2 or higher
262# Flask/Django example
263app.config['SESSION_COOKIE_SECURE'] = True  # HTTPS only
264app.config['SESSION_COOKIE_HTTPONLY'] = True
265app.config['SESSION_COOKIE_SAMESITE'] = 'Strict'
266 
267# Enforce HTTPS
268from flask_talisman import Talisman
269Talisman(app, force_https=True)
270```
271 
272## Access Control
273 
274```python
275from functools import wraps
276from flask import session
277 
278def require_pci_access(f):
279    """Decorator to restrict access to cardholder data."""
280    @wraps(f)
281    def decorated_function(*args, **kwargs):
282        user = session.get('user')
283 
284        # Check if user has PCI access role
285        if not user or 'pci_access' not in user.get('roles', []):
286            return {'error': 'Unauthorized access to cardholder data'}, 403
287 
288        # Log access attempt
289        audit_log(
290            user=user['id'],
291            action='access_cardholder_data',
292            resource=f.__name__
293        )
294 
295        return f(*args, **kwargs)
296 
297    return decorated_function
298 
299@app.route('/api/payment-methods')
300@require_pci_access
301def get_payment_methods():
302    """Retrieve payment methods (restricted access)."""
303    # Only accessible to users with pci_access role
304    pass
305```
306 
307## Audit Logging
308 
309```python
310import logging
311from datetime import datetime
312 
313class PCIAuditLogger:
314    """PCI-compliant audit logging."""
315 
316    def __init__(self):
317        self.logger = logging.getLogger('pci_audit')
318        # Configure to write to secure, append-only log
319 
320    def log_access(self, user_id, resource, action, result):
321        """Log access to cardholder data."""
322        entry = {
323            'timestamp': datetime.utcnow().isoformat(),
324            'user_id': user_id,
325            'resource': resource,
326            'action': action,
327            'result': result,
328            'ip_address': request.remote_addr
329        }
330 
331        self.logger.info(json.dumps(entry))
332 
333    def log_authentication(self, user_id, success, method):
334        """Log authentication attempt."""
335        entry = {
336            'timestamp': datetime.utcnow().isoformat(),
337            'user_id': user_id,
338            'event': 'authentication',
339            'success': success,
340            'method': method,
341            'ip_address': request.remote_addr
342        }
343 
344        self.logger.info(json.dumps(entry))
345 
346# Usage
347audit = PCIAuditLogger()
348audit.log_access(user_id=123, resource='payment_methods', action='read', result='success')
349```
350 
351## Security Best Practices
352 
353### Input Validation
354```python
355import re
356 
357def validate_card_number(card_number):
358    """Validate card number format (Luhn algorithm)."""
359    # Remove spaces and dashes
360    card_number = re.sub(r'[\s-]', '', card_number)
361 
362    # Check if all digits
363    if not card_number.isdigit():
364        return False
365 
366    # Luhn algorithm
367    def luhn_checksum(card_num):
368        def digits_of(n):
369            return [int(d) for d in str(n)]
370 
371        digits = digits_of(card_num)
372        odd_digits = digits[-1::-2]
373        even_digits = digits[-2::-2]
374        checksum = sum(odd_digits)
375        for d in even_digits:
376            checksum += sum(digits_of(d * 2))
377        return checksum % 10
378 
379    return luhn_checksum(card_number) == 0
380 
381def sanitize_input(user_input):
382    """Sanitize user input to prevent injection."""
383    # Remove special characters
384    # Validate against expected format
385    # Escape for database queries
386    pass
387```
388 
389## PCI DSS SAQ (Self-Assessment Questionnaire)
390 
391### SAQ A (Least Requirements)
392- E-commerce using hosted payment page
393- No card data on your systems
394- ~20 questions
395 
396### SAQ A-EP
397- E-commerce with embedded payment form
398- Uses JavaScript to handle card data
399- ~180 questions
400 
401### SAQ D (Most Requirements)
402- Store, process, or transmit card data
403- Full PCI DSS requirements
404- ~300 questions
405 
406## Compliance Checklist
407 
408```python
409PCI_COMPLIANCE_CHECKLIST = {
410    'network_security': [
411        'Firewall configured and maintained',
412        'No vendor default passwords',
413        'Network segmentation implemented'
414    ],
415    'data_protection': [
416        'No storage of CVV, track data, or PIN',
417        'PAN encrypted when stored',
418        'PAN masked when displayed',
419        'Encryption keys properly managed'
420    ],
421    'vulnerability_management': [
422        'Anti-virus installed and updated',
423        'Secure development practices',
424        'Regular security patches',
425        'Vulnerability scanning performed'
426    ],
427    'access_control': [
428        'Access restricted by role',
429        'Unique IDs for all users',
430        'Multi-factor authentication',
431        'Physical security measures'
432    ],
433    'monitoring': [
434        'Audit logs enabled',
435        'Log review process',
436        'File integrity monitoring',
437        'Regular security testing'
438    ],
439    'policy': [
440        'Security policy documented',
441        'Risk assessment performed',
442        'Security awareness training',
443        'Incident response plan'
444    ]
445}
446```
447 
448## Resources
449 
450- **references/data-minimization.md**: Never store prohibited data
451- **references/tokenization.md**: Tokenization strategies
452- **references/encryption.md**: Encryption requirements
453- **references/access-control.md**: Role-based access
454- **references/audit-logging.md**: Comprehensive logging
455- **assets/pci-compliance-checklist.md**: Complete checklist
456- **assets/encrypted-storage.py**: Encryption utilities
457- **scripts/audit-payment-system.sh**: Compliance audit script
458 
459## Common Violations
460 
4611. **Storing CVV**: Never store card verification codes
4622. **Unencrypted PAN**: Card numbers must be encrypted at rest
4633. **Weak Encryption**: Use AES-256 or equivalent
4644. **No Access Controls**: Restrict who can access cardholder data
4655. **Missing Audit Logs**: Must log all access to payment data
4666. **Insecure Transmission**: Always use TLS 1.2+
4677. **Default Passwords**: Change all default credentials
4688. **No Security Testing**: Regular penetration testing required
469 
470## Reducing PCI Scope
471 
4721. **Use Hosted Payments**: Stripe Checkout, PayPal, etc.
4732. **Tokenization**: Replace card data with tokens
4743. **Network Segmentation**: Isolate cardholder data environment
4754. **Outsource**: Use PCI-compliant payment processors
4765. **No Storage**: Never store full card details
477 
478By minimizing systems that touch card data, you reduce compliance burden significantly.
479