Amazon Confirms EC2/S3 Not PCI Level 1 Compliant

Re:Amazon Confirms EC2/S3 Not PCI Level 1 Compliant by mahmud on Monday August 17, 2009 @04:03AM (#767588)

It's clearly specified in the requirements that you need a dedicated host, and if you want to do Sarbanes Oxley or HIPAA compliance you will need your server to be in a certified data center.

No VPS account can every qualify, and that's the reason why we're on a $500+ standalone host at some fed-approved data center instead of getting the bigggest bang for our buck and getting a slice or a linode account.

[ Parent | on HN ]

Re:Amazon Confirms EC2/S3 Not PCI Level 1 Compliant by mseebach on Monday August 17, 2009 @06:13AM (#767765)

Wouldn't it be pretty simple to provide this as a service? Even if you want amazon-like "we stored your creditcard data" service, just have a third party store them, and give you a handle for each card, that can only be used with a specific merchant ID. That handle is worthless in the hands of a hacker.

If this doesn't exist, I smell an opportunity.

[ Parent | on HN ]

Re:Amazon Confirms EC2/S3 Not PCI Level 1 Compliant by mahmud on Monday August 17, 2009 @06:31AM (#767779)

If this doesn't exist, I smell an opportunity.

You smell right.

http://news.ycombinator.com/item?id=767509 http://news.ycombinator.com/item?id=765950

Hello mseebach and welcome to the club, I am one of your would-be competition ;-)

I do it for healthcare records, credit card records will require a change in our press releases ;-)

[ Parent | on HN ]

Re:Amazon Confirms EC2/S3 Not PCI Level 1 Compliant by mseebach on Monday August 17, 2009 @07:27AM (#767840)

Sounds interesting.. I don't understand, however, how would your health record services compete with a credit card processing service? Short of something costing an arm and a leg? :)

But to recap the idea -- people become PCI certified because they need to store a creditcard number for recurring charges. There are service for subscription type recurring charges, eg. same amount every X period, but no service where a credit card number can be stored and then charged an arbitrary amount non-periodically? E.g. toll-roads with an RFID in the car, AWS usage-dependant charges or Amazon-like "store-your-creditcard" webshops ..

Are there any other reasons to become PCI certified, short of actually being in the CC business? I guess people are comfortable enough being redirected to a payment window on a third party website, so transmitting is not an issue.

[ Parent | on HN ]

Re:Amazon Confirms EC2/S3 Not PCI Level 1 Compliant by tjriley82 on Monday August 17, 2009 @09:26AM (#768040)

If you have a "continuous authority" facility enabled on your merchant account you can make arbitrary charges on card numbers authorised and stored by your payment processor. CA doesn't seem too hard to acquire, at least here in the UK it was easier than we expected at worldonahanger.com. The downside with this approach is that in the event that you want to switch payment processors, you have to ask your customers to resubmit their card details for reauthorisation (as far as I can tell).

[ Parent | on HN ]

Re:Amazon Confirms EC2/S3 Not PCI Level 1 Compliant by mseebach on Monday August 17, 2009 @12:13PM (#768388)

Yeah, that sounds about right. There's apparently also something called "pre-registered card". So, no business idea here :)

EDIT: http://www.braintreepaymentsolutions.com/credit-card-storage...

[ Parent | on HN ]