mirror of
https://github.com/wshobson/agents.git
synced 2026-03-18 09:37:15 +00:00
style: format all files with prettier
This commit is contained in:
@@ -20,27 +20,33 @@ Master PCI DSS (Payment Card Industry Data Security Standard) compliance for sec
|
||||
## PCI DSS Requirements (12 Core Requirements)
|
||||
|
||||
### Build and Maintain Secure Network
|
||||
|
||||
1. Install and maintain firewall configuration
|
||||
2. Don't use vendor-supplied defaults for passwords
|
||||
|
||||
### Protect Cardholder Data
|
||||
|
||||
3. Protect stored cardholder data
|
||||
4. Encrypt transmission of cardholder data across public networks
|
||||
|
||||
### Maintain Vulnerability Management
|
||||
|
||||
5. Protect systems against malware
|
||||
6. Develop and maintain secure systems and applications
|
||||
|
||||
### Implement Strong Access Control
|
||||
|
||||
7. Restrict access to cardholder data by business need-to-know
|
||||
8. Identify and authenticate access to system components
|
||||
9. Restrict physical access to cardholder data
|
||||
|
||||
### Monitor and Test Networks
|
||||
|
||||
10. Track and monitor all access to network resources and cardholder data
|
||||
11. Regularly test security systems and processes
|
||||
|
||||
### Maintain Information Security Policy
|
||||
|
||||
12. Maintain a policy that addresses information security
|
||||
|
||||
## Compliance Levels
|
||||
@@ -99,6 +105,7 @@ class PaymentData:
|
||||
## Tokenization
|
||||
|
||||
### Using Payment Processor Tokens
|
||||
|
||||
```python
|
||||
import stripe
|
||||
|
||||
@@ -161,6 +168,7 @@ class TokenizedPayment:
|
||||
```
|
||||
|
||||
### Custom Tokenization (Advanced)
|
||||
|
||||
```python
|
||||
import secrets
|
||||
from cryptography.fernet import Fernet
|
||||
@@ -203,6 +211,7 @@ class TokenVault:
|
||||
## Encryption
|
||||
|
||||
### Data at Rest
|
||||
|
||||
```python
|
||||
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
|
||||
import os
|
||||
@@ -245,6 +254,7 @@ encrypted_pan = storage.encrypt("4242424242424242")
|
||||
```
|
||||
|
||||
### Data in Transit
|
||||
|
||||
```python
|
||||
# Always use TLS 1.2 or higher
|
||||
# Flask/Django example
|
||||
@@ -339,6 +349,7 @@ audit.log_access(user_id=123, resource='payment_methods', action='read', result=
|
||||
## Security Best Practices
|
||||
|
||||
### Input Validation
|
||||
|
||||
```python
|
||||
import re
|
||||
|
||||
@@ -377,16 +388,19 @@ def sanitize_input(user_input):
|
||||
## PCI DSS SAQ (Self-Assessment Questionnaire)
|
||||
|
||||
### SAQ A (Least Requirements)
|
||||
|
||||
- E-commerce using hosted payment page
|
||||
- No card data on your systems
|
||||
- ~20 questions
|
||||
|
||||
### SAQ A-EP
|
||||
|
||||
- E-commerce with embedded payment form
|
||||
- Uses JavaScript to handle card data
|
||||
- ~180 questions
|
||||
|
||||
### SAQ D (Most Requirements)
|
||||
|
||||
- Store, process, or transmit card data
|
||||
- Full PCI DSS requirements
|
||||
- ~300 questions
|
||||
|
||||
Reference in New Issue
Block a user