PCI Compliance Over Telephone for Credit Cards- how?
I'm planning on an IVR to accept credit card information for signing up and renewal of my services. Regarding fraud, I'm going to require at minimum a recording of name, who they are, or something or an actual live call. But for PCI compliance.. this says https://www.pcisecuritystandards.org/documents/protecting_telephone-based_pa... on page 9: Call centers will need to ensure that transmission of cardholder data
across public networks is encrypted. This is part of PCI DSS Requirement 4 and includes:
- ...
- *Voice or data streams over Voice over IP (VoIP) telephone systems, whenever sent over an open or public network. Note that only those consumer or enterprise VoIP systems that provide strong cryptography should be used. *
- Requiring agents to use analog telephone lines when a VoIP telephone system does not provide strong cryptography.
I'm doing dtmf, not voice, but I can't imagine that's LESS strict.
I haven't really heard of any end-to-end encrypted origination lines. Is this guideline ignored? How do people deal with this? Does someone have T1 lines and offers encryption for origination...? -Avi Marcus
Hi, Your questin is quite difficult to answer because depend on your country laws. About public network, I think you are concern about TDM service (PSTN). Well, as always, some stuff are not considered by the people who made some laws. Well, in my country customer are encouraged to deploy cross-systems. For example, PIN number is set by internet (where you can implement all crypting available). By phone in TDM no crypting, ( and by VoIP you have to implement SIPS and SRTP, TLS at least) then very strong set of questions/answer to do a positive verification of the caller. Of course, where you have to put encryption and security is inside of your systems, and deploy a good system control to control and manage your sensible data. Take a look this links: http://wiki.linuxwall.info/doku.php/en:ressources:dossiers:voip:tls_sips_rtp... and http://www.vadese.org/files/upload/Best_practices_VoIP_en_v20.pdf I hope this helps On 12/19/2011 7:22 AM, Avi Marcus wrote:
I'm planning on an IVR to accept credit card information for signing up and renewal of my services. Regarding fraud, I'm going to require at minimum a recording of name, who they are, or something or an actual live call.
But for PCI compliance.. this says https://www.pcisecuritystandards.org/documents/protecting_telephone-based_pa... on page 9:
Call centers will need to ensure that transmission of cardholder data across public networks is encrypted. This is part of PCI DSS Requirement 4 and includes:
* ...
* *Voice or data streams over Voice over IP (VoIP) telephone systems, whenever sent over an open or public network. Note that only those consumer or enterprise VoIP systems that provide strong cryptography should be used. *
* Requiring agents to use analog telephone lines when a VoIP telephone system does not provide strong cryptography.
I'm doing dtmf, not voice, but I can't imagine that's LESS strict.
I haven't really heard of any end-to-end encrypted origination lines. Is this guideline ignored? How do people deal with this? Does someone have T1 lines and offers encryption for origination...?
-Avi Marcus
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
No virus found in this message. Checked by AVG - www.avg.com <http://www.avg.com> Version: 2012.0.1890 / Virus Database: 2108/4684 - Release Date: 12/16/11
-- Atentamente, *Dario García* Consultor. CCCT, Nivel C2, Sector Yarey, Mz, Ofc. MZ03a. Caracas-Venezuela. Teléfono: +58 212 9081842 Cel: +58 412 2221515 dgarcia@anew.com.ve http://www.anew.com.ve
Well, I have worked a lot with PCI compliance in the past and I don't think you can meet the requirements of encryption if you're not doing encoding yourself because most voip service providers aren't encrypting the calls. Also dtmf has the same for requirements and for T1 not being encrypted this is true but because the network is considered secured(funny)/private it's doesn't need to be - now if you would encapsulate t1 traffic to send it over the internet without encrypting it this would be unsecured. From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Avi Marcus Sent: Monday, December 19, 2011 5:52 AM To: FreeSWITCH Users Help Subject: [Freeswitch-users] PCI Compliance Over Telephone for Credit Cards- how? I'm planning on an IVR to accept credit card information for signing up and renewal of my services. Regarding fraud, I'm going to require at minimum a recording of name, who they are, or something or an actual live call. But for PCI compliance.. this says https://www.pcisecuritystandards.org/documents/protecting_telephone-based_pa... on page 9: Call centers will need to ensure that transmission of cardholder data across public networks is encrypted. This is part of PCI DSS Requirement 4 and includes: * ... * Voice or data streams over Voice over IP (VoIP) telephone systems, whenever sent over an open or public network. Note that only those consumer or enterprise VoIP systems that provide strong cryptography should be used. * Requiring agents to use analog telephone lines when a VoIP telephone system does not provide strong cryptography. I'm doing dtmf, not voice, but I can't imagine that's LESS strict. I haven't really heard of any end-to-end encrypted origination lines. Is this guideline ignored? How do people deal with this? Does someone have T1 lines and offers encryption for origination...? -Avi Marcus
So is there a provider for USA who takes T1 and encrypts it, so I can buy origination from them? -Avi On Mon, Dec 19, 2011 at 7:39 PM, Elliott Vogel <elliott@zoogmedia.com>wrote:
Well, I have worked a lot with PCI compliance in the past and I don’t think you can meet the requirements of encryption if you’re not doing encoding yourself because most voip service providers aren’t encrypting the calls. Also dtmf has the same for requirements and for T1 not being encrypted this is true but because the network is considered secured(funny)/private it’s doesn’t need to be – now if you would encapsulate t1 traffic to send it over the internet without encrypting it this would be unsecured.****
** **
*From:* freeswitch-users-bounces@lists.freeswitch.org [mailto: freeswitch-users-bounces@lists.freeswitch.org] *On Behalf Of *Avi Marcus *Sent:* Monday, December 19, 2011 5:52 AM *To:* FreeSWITCH Users Help *Subject:* [Freeswitch-users] PCI Compliance Over Telephone for Credit Cards- how?****
** **
I'm planning on an IVR to accept credit card information for signing up and renewal of my services.****
Regarding fraud, I'm going to require at minimum a recording of name, who they are, or something or an actual live call.****
** **
But for PCI compliance.. this says https://www.pcisecuritystandards.org/documents/protecting_telephone-based_pa... on page 9:****
Call centers will need to ensure that transmission of cardholder data across public networks is encrypted. This is part of PCI DSS Requirement 4 and includes:****
- ...****
- *Voice or data streams over Voice over IP (VoIP) telephone systems, whenever sent over an open or public network. Note that only those consumer or enterprise VoIP systems that provide strong cryptography should be used. *****
- Requiring agents to use analog telephone lines when a VoIP telephone system does not provide strong cryptography.****
I'm doing dtmf, not voice, but I can't imagine that's LESS strict.****
** **
I haven't really heard of any end-to-end encrypted origination lines. Is this guideline ignored? How do people deal with this? Does someone have T1 lines and offers encryption for origination...?****
****
-Avi Marcus****
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I haven't seen a company yet and I have searched - none of the big origination providers do and many of the smaller ones use the big providers - we are force to do our own encoding From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Avi Marcus Sent: Monday, December 19, 2011 12:03 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] PCI Compliance Over Telephone for Credit Cards- how? So is there a provider for USA who takes T1 and encrypts it, so I can buy origination from them? -Avi On Mon, Dec 19, 2011 at 7:39 PM, Elliott Vogel <elliott@zoogmedia.com<mailto:elliott@zoogmedia.com>> wrote: Well, I have worked a lot with PCI compliance in the past and I don't think you can meet the requirements of encryption if you're not doing encoding yourself because most voip service providers aren't encrypting the calls. Also dtmf has the same for requirements and for T1 not being encrypted this is true but because the network is considered secured(funny)/private it's doesn't need to be - now if you would encapsulate t1 traffic to send it over the internet without encrypting it this would be unsecured. From: freeswitch-users-bounces@lists.freeswitch.org<mailto:freeswitch-users-bounces@lists.freeswitch.org> [mailto:freeswitch-users-bounces@lists.freeswitch.org<mailto:freeswitch-users-bounces@lists.freeswitch.org>] On Behalf Of Avi Marcus Sent: Monday, December 19, 2011 5:52 AM To: FreeSWITCH Users Help Subject: [Freeswitch-users] PCI Compliance Over Telephone for Credit Cards- how? I'm planning on an IVR to accept credit card information for signing up and renewal of my services. Regarding fraud, I'm going to require at minimum a recording of name, who they are, or something or an actual live call. But for PCI compliance.. this says https://www.pcisecuritystandards.org/documents/protecting_telephone-based_pa... on page 9: Call centers will need to ensure that transmission of cardholder data across public networks is encrypted. This is part of PCI DSS Requirement 4 and includes: * ... * Voice or data streams over Voice over IP (VoIP) telephone systems, whenever sent over an open or public network. Note that only those consumer or enterprise VoIP systems that provide strong cryptography should be used. * Requiring agents to use analog telephone lines when a VoIP telephone system does not provide strong cryptography. I'm doing dtmf, not voice, but I can't imagine that's LESS strict. I haven't really heard of any end-to-end encrypted origination lines. Is this guideline ignored? How do people deal with this? Does someone have T1 lines and offers encryption for origination...? -Avi Marcus _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Encrypting yourself only helps if you have a T1/BRI whatever private link to the telco. I don't.. what are my options? -Avi On Mon, Dec 19, 2011 at 9:28 PM, Elliott Vogel <elliott@zoogmedia.com>wrote:
I haven’t seen a company yet and I have searched – none of the big origination providers do and many of the smaller ones use the big providers – we are force to do our own encoding****
** **
*From:* freeswitch-users-bounces@lists.freeswitch.org [mailto: freeswitch-users-bounces@lists.freeswitch.org] *On Behalf Of *Avi Marcus *Sent:* Monday, December 19, 2011 12:03 PM *To:* FreeSWITCH Users Help *Subject:* Re: [Freeswitch-users] PCI Compliance Over Telephone for Credit Cards- how?****
** **
So is there a provider for USA who takes T1 and encrypts it, so I can buy origination from them?****
****
-Avi****
** **
On Mon, Dec 19, 2011 at 7:39 PM, Elliott Vogel <elliott@zoogmedia.com> wrote:****
Well, I have worked a lot with PCI compliance in the past and I don’t think you can meet the requirements of encryption if you’re not doing encoding yourself because most voip service providers aren’t encrypting the calls. Also dtmf has the same for requirements and for T1 not being encrypted this is true but because the network is considered secured(funny)/private it’s doesn’t need to be – now if you would encapsulate t1 traffic to send it over the internet without encrypting it this would be unsecured.****
****
*From:* freeswitch-users-bounces@lists.freeswitch.org [mailto: freeswitch-users-bounces@lists.freeswitch.org] *On Behalf Of *Avi Marcus *Sent:* Monday, December 19, 2011 5:52 AM *To:* FreeSWITCH Users Help *Subject:* [Freeswitch-users] PCI Compliance Over Telephone for Credit Cards- how?****
****
I'm planning on an IVR to accept credit card information for signing up and renewal of my services.****
Regarding fraud, I'm going to require at minimum a recording of name, who they are, or something or an actual live call.****
****
But for PCI compliance.. this says https://www.pcisecuritystandards.org/documents/protecting_telephone-based_pa... on page 9:****
Call centers will need to ensure that transmission of cardholder data across public networks is encrypted. This is part of PCI DSS Requirement 4 and includes:****
- ...****
- *Voice or data streams over Voice over IP (VoIP) telephone systems, whenever sent over an open or public network. Note that only those consumer or enterprise VoIP systems that provide strong cryptography should be used. *****
- Requiring agents to use analog telephone lines when a VoIP telephone system does not provide strong cryptography.****
I'm doing dtmf, not voice, but I can't imagine that's LESS strict.****
****
I haven't really heard of any end-to-end encrypted origination lines. Is this guideline ignored? How do people deal with this? Does someone have T1 lines and offers encryption for origination...?****
****
-Avi Marcus****
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org****
** **
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
None of the major PSTN gateway providers will do SRTP or whatever. We ran into this several months ago. Funny part about all of this is that the LECs send calls across data networks mixed with other traffic regularly, so the compliance issue involves a man behind the curtain in the first place. The only option that I know of that is PCI compliant is to have your own line from Ma Bell. On Monday 19 December 2011 14:34:08 Avi Marcus wrote:
Encrypting yourself only helps if you have a T1/BRI whatever private link to the telco. I don't.. what are my options? -Avi
On Mon, Dec 19, 2011 at 9:28 PM, Elliott Vogel <elliott@zoogmedia.com>wrote:
I haven’t seen a company yet and I have searched – none of the big origination providers do and many of the smaller ones use the big providers – we are force to do our own encoding****
** **
*From:* freeswitch-users-bounces@lists.freeswitch.org [mailto: freeswitch-users-bounces@lists.freeswitch.org] *On Behalf Of *Avi Marcus *Sent:* Monday, December 19, 2011 12:03 PM *To:* FreeSWITCH Users Help *Subject:* Re: [Freeswitch-users] PCI Compliance Over Telephone for Credit Cards- how?****
** **
So is there a provider for USA who takes T1 and encrypts it, so I can buy origination from them?****
****
-Avi****
** **
On Mon, Dec 19, 2011 at 7:39 PM, Elliott Vogel <elliott@zoogmedia.com> wrote:****
Well, I have worked a lot with PCI compliance in the past and I don’t think you can meet the requirements of encryption if you’re not doing encoding yourself because most voip service providers aren’t encrypting the calls. Also dtmf has the same for requirements and for T1 not being encrypted this is true but because the network is considered secured(funny)/private it’s doesn’t need to be – now if you would encapsulate t1 traffic to send it over the internet without encrypting it this would be unsecured.****
****
*From:* freeswitch-users-bounces@lists.freeswitch.org [mailto: freeswitch-users-bounces@lists.freeswitch.org] *On Behalf Of *Avi Marcus *Sent:* Monday, December 19, 2011 5:52 AM *To:* FreeSWITCH Users Help *Subject:* [Freeswitch-users] PCI Compliance Over Telephone for Credit Cards- how?****
****
I'm planning on an IVR to accept credit card information for signing up and renewal of my services.****
Regarding fraud, I'm going to require at minimum a recording of name, who they are, or something or an actual live call.****
****
But for PCI compliance.. this says https://www.pcisecuritystandards.org/documents/protecting_telephone-based_pa... on page 9:****
Call centers will need to ensure that transmission of cardholder data across public networks is encrypted. This is part of PCI DSS Requirement 4 and includes:****
- ...****
- *Voice or data streams over Voice over IP (VoIP) telephone systems, whenever sent over an open or public network. Note that only those consumer or enterprise VoIP systems that provide strong cryptography should be used. *****
- Requiring agents to use analog telephone lines when a VoIP telephone system does not provide strong cryptography.****
I'm doing dtmf, not voice, but I can't imagine that's LESS strict.****
****
I haven't really heard of any end-to-end encrypted origination lines. Is this guideline ignored? How do people deal with this? Does someone have T1 lines and offers encryption for origination...?****
****
-Avi Marcus****
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org****
** **
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Avi, You have not many options. Firtst, tell us about your architecture. Second, about TDM, there is some options but it when you use T1/E1 to transmit data; but for voice, perhaps, the only option is: no encryption. For voice, like mobile and fix phones, the technology used, it does not offer a way to do it. Exist mechanism to use tuneling and some security between sites when a private link between premises are used but it is basically use a T1/E1 data to transport voice, and it depend on equipments and providers. Third, if you have a VoIP provider, there is some options like as mention before: TLS, SRTP and SIPS. Fourth, You have to worried when you have the call in your control, "surfing" in your IVR and start to manage sensible data (PIN, account numbers, login, passwords, etc). How to encrypt/decrypt them as long the call exist: you need to use sensible data with other systems inside and outside of your organization. On 12/19/2011 3:04 PM, Avi Marcus wrote:
Encrypting yourself only helps if you have a T1/BRI whatever private link to the telco. I don't.. what are my options? -Avi
On Mon, Dec 19, 2011 at 9:28 PM, Elliott Vogel <elliott@zoogmedia.com <mailto:elliott@zoogmedia.com>> wrote:
I haven’t seen a company yet and I have searched – none of the big origination providers do and many of the smaller ones use the big providers – we are force to do our own encoding
*From:*freeswitch-users-bounces@lists.freeswitch.org <mailto:freeswitch-users-bounces@lists.freeswitch.org> [mailto:freeswitch-users-bounces@lists.freeswitch.org <mailto:freeswitch-users-bounces@lists.freeswitch.org>] *On Behalf Of *Avi Marcus *Sent:* Monday, December 19, 2011 12:03 PM *To:* FreeSWITCH Users Help *Subject:* Re: [Freeswitch-users] PCI Compliance Over Telephone for Credit Cards- how?
So is there a provider for USA who takes T1 and encrypts it, so I can buy origination from them?
-Avi
On Mon, Dec 19, 2011 at 7:39 PM, Elliott Vogel <elliott@zoogmedia.com <mailto:elliott@zoogmedia.com>> wrote:
Well, I have worked a lot with PCI compliance in the past and I don’t think you can meet the requirements of encryption if you’re not doing encoding yourself because most voip service providers aren’t encrypting the calls. Also dtmf has the same for requirements and for T1 not being encrypted this is true but because the network is considered secured(funny)/private it’s doesn’t need to be – now if you would encapsulate t1 traffic to send it over the internet without encrypting it this would be unsecured.
*From:*freeswitch-users-bounces@lists.freeswitch.org <mailto:freeswitch-users-bounces@lists.freeswitch.org> [mailto:freeswitch-users-bounces@lists.freeswitch.org <mailto:freeswitch-users-bounces@lists.freeswitch.org>] *On Behalf Of *Avi Marcus *Sent:* Monday, December 19, 2011 5:52 AM *To:* FreeSWITCH Users Help *Subject:* [Freeswitch-users] PCI Compliance Over Telephone for Credit Cards- how?
I'm planning on an IVR to accept credit card information for signing up and renewal of my services.
Regarding fraud, I'm going to require at minimum a recording of name, who they are, or something or an actual live call.
But for PCI compliance.. this says https://www.pcisecuritystandards.org/documents/protecting_telephone-based_pa... on page 9:
Call centers will need to ensure that transmission of cardholder data across public networks is encrypted. This is part of PCI DSS Requirement 4 and includes:
* ...
* *Voice or data streams over Voice over IP (VoIP) telephone systems, whenever sent over an open or public network. Note that only those consumer or enterprise VoIP systems that provide strong cryptography should be used. *
* Requiring agents to use analog telephone lines when a VoIP telephone system does not provide strong cryptography.
I'm doing dtmf, not voice, but I can't imagine that's LESS strict.
I haven't really heard of any end-to-end encrypted origination lines. Is this guideline ignored? How do people deal with this? Does someone have T1 lines and offers encryption for origination...?
-Avi Marcus
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
No virus found in this message. Checked by AVG - www.avg.com <http://www.avg.com> Version: 2012.0.1890 / Virus Database: 2108/4690 - Release Date: 12/19/11
-- Atentamente, *Dario García* Consultor. CCCT, Nivel C2, Sector Yarey, Mz, Ofc. MZ03a. Caracas-Venezuela. Teléfono: +58 212 9081842 Cel: +58 412 2221515 dgarcia@anew.com.ve http://www.anew.com.ve
I think if you could get a mpls line from one of the big three and have them termite voice over it that would be PCI compliant but I bet this will cost more than getting a PRI. Another option would be seeing if someone would be will to encoding traffic and would sell you a few channels but I bet the cost per channel could be high - we estimate our cost to be around 39.00 per channel per month plus the per minute rate of .007 local and .035 for 800. I may be able to help you, email me off line. From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Avi Marcus Sent: Monday, December 19, 2011 1:34 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] PCI Compliance Over Telephone for Credit Cards- how? Encrypting yourself only helps if you have a T1/BRI whatever private link to the telco. I don't.. what are my options? -Avi On Mon, Dec 19, 2011 at 9:28 PM, Elliott Vogel <elliott@zoogmedia.com<mailto:elliott@zoogmedia.com>> wrote: I haven't seen a company yet and I have searched - none of the big origination providers do and many of the smaller ones use the big providers - we are force to do our own encoding From: freeswitch-users-bounces@lists.freeswitch.org<mailto:freeswitch-users-bounces@lists.freeswitch.org> [mailto:freeswitch-users-bounces@lists.freeswitch.org<mailto:freeswitch-users-bounces@lists.freeswitch.org>] On Behalf Of Avi Marcus Sent: Monday, December 19, 2011 12:03 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] PCI Compliance Over Telephone for Credit Cards- how? So is there a provider for USA who takes T1 and encrypts it, so I can buy origination from them? -Avi On Mon, Dec 19, 2011 at 7:39 PM, Elliott Vogel <elliott@zoogmedia.com<mailto:elliott@zoogmedia.com>> wrote: Well, I have worked a lot with PCI compliance in the past and I don't think you can meet the requirements of encryption if you're not doing encoding yourself because most voip service providers aren't encrypting the calls. Also dtmf has the same for requirements and for T1 not being encrypted this is true but because the network is considered secured(funny)/private it's doesn't need to be - now if you would encapsulate t1 traffic to send it over the internet without encrypting it this would be unsecured. From: freeswitch-users-bounces@lists.freeswitch.org<mailto:freeswitch-users-bounces@lists.freeswitch.org> [mailto:freeswitch-users-bounces@lists.freeswitch.org<mailto:freeswitch-users-bounces@lists.freeswitch.org>] On Behalf Of Avi Marcus Sent: Monday, December 19, 2011 5:52 AM To: FreeSWITCH Users Help Subject: [Freeswitch-users] PCI Compliance Over Telephone for Credit Cards- how? I'm planning on an IVR to accept credit card information for signing up and renewal of my services. Regarding fraud, I'm going to require at minimum a recording of name, who they are, or something or an actual live call. But for PCI compliance.. this says https://www.pcisecuritystandards.org/documents/protecting_telephone-based_pa... on page 9: Call centers will need to ensure that transmission of cardholder data across public networks is encrypted. This is part of PCI DSS Requirement 4 and includes: * ... * Voice or data streams over Voice over IP (VoIP) telephone systems, whenever sent over an open or public network. Note that only those consumer or enterprise VoIP systems that provide strong cryptography should be used. * Requiring agents to use analog telephone lines when a VoIP telephone system does not provide strong cryptography. I'm doing dtmf, not voice, but I can't imagine that's LESS strict. I haven't really heard of any end-to-end encrypted origination lines. Is this guideline ignored? How do people deal with this? Does someone have T1 lines and offers encryption for origination...? -Avi Marcus _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (4)
-
Avi Marcus
-
Elliott Vogel
-
Rob Hutton
-
Saugort Dario Garcia Tovar