Demo: shrinking Larkspur's PCI DSS scope with a hosted payment page
On This Lesson 3 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
worked scope-reduction session; prepares ARC-029-LAB1.
Draft outline details
Step by step
- List the current web shop's card flows: form posts to the web server, saved cards in the database, call-center notes with card numbers.
- Mark every system that touches card data; this is the scope.
- Redesign: hosted payment fields for web and app; provider-hosted terminal flow for call center; tokens for saved cards.
- Planned mistake: assume the iframe or hosted fields make the whole web app out of scope. Fix: the page that embeds the fields and its scripts still need controls; confirm the scope category with the assessor or acquirer.
- Confirm no card data reaches logs, analytics, or order notes; add detection (pattern scan of logs).
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.