Re: PCI compliance question

[Michael Sana <msana () HPU EDU>]

Interesting question that brings up a few ideas:


*         You are using your "one card" system (heartland ?), but are the cards tied into the bank or not?  I suspect 
if they are not, then they can be perceived to be just a smart card or a swipe card that only holds a "purse" so not 
within scope of PCI.  However, in regards to  the "recharging" mechanism or process, if students have the ability to 
add more money to their "one card" via credit card, that device/process has to be PCI compliant.

I am not a PCI expert, so take it for what its worth... :)

mike.sana.

Michael C. Sana MSIA, CISSP, CISM, CISA
Information Security Officer
Information Technology Services Division

Hawai`i Pacific University
1132 Bishop St. Suite 307
Honolulu, Hawai`i 96813
Telephone: (808) 687-7034
Fax: (808) 544-1404
Email: msana () hpu edu<mailto:msana () hpu edu>

"Quis custodiet ipsos custodes?"

From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Barrera, 
Connie
Sent: Thursday, July 08, 2010 8:51 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] PCI compliance question

It is my understanding that vending machines are definitely part of your in-scope devices, especially based on the fact 
that they are connected to your LAN.

Good luck with this.


Connie Barrera, MCSE, CCNA, CCM, CISSP
University of Miami
Director of Information Security and Compliance
Gables One Tower 11th Floor, Suite 1100F
1320 S Dixie Hwy
Coral Gables, FL 33146-2500
O&F:  305-284-2773
connie () miami edu<mailto:connie () miami edu>



From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Smith, 
Bob
Sent: Thursday, July 08, 2010 2:47 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] PCI compliance question

We are struggling with a PCI compliance issue and have been asked to query this list.  We have vending machines (drink, 
snack, laundry, etc.) on our network that are being setup for use with our university "one card" system.  The readers 
on these machines will transmit and process our cards just fine.  However, when someone uses a CC it is transmitted to 
the card system/server, but the system ignores it and does not process the transaction.

The big question:  are the vending machines considered in-scope for PCI?  If so, that means a lot of other things will 
be too.

Thanks.

Bob Smith
AVP IITS & Information Security Officer
Longwood University