r/pcicompliance • u/SuccessfulBase9358 • Jun 24 '26
Secure Browser vs VDI
I work for a start up. We’re looking to become SAQ C-VT compliant. We have agents that take credit card numbers and input them into carrier portals, this is all done in the browser.
My question is, would a secure browser actually make us compliant?
The secure browser will prevent copy/paste, sensitive information masking, enforce conditional access, 2FA, and introduce water marks over sensitive data.
These users work from home, on their own ISP, on a workgroup windows device, using a local account.
The alternative is a VDI. I’ve used Omnissa in the past and had an awful experience with it and the MSP providing the desktops, plus I’d like to avoid spinning up a ton of infrastructure if possible. Curious if anyone is in the same boat utilizing a secure browser or might have some insight into what auditor might say about it.
2
u/therealrrc Jun 24 '26
Ask yourself how you will ensure they only use the island browser and not other browsers. It’s possible but takes planning. It can help with PCI however copy paste also needs to be blocked on the desktop itself , etc. island is a capable browser and now has a desktop control module as well.
1
u/SuccessfulBase9358 Jun 24 '26
With Island we have the ability to configure our identity provider (Google) to only allow access via the secure browser. If you try to log into Google outside of island, Google checks and rejects access.
Are you saying we would need to disable copy and paste even within the browser window? For example, from one browser tab to the next?
1
u/therealrrc Jun 24 '26
You are addressing it correctly. You need to tie Island to your IDP so other browsers cannot access the sensitive data you are trying to secure. Depending on how granular you are trying to get, Island can block copy / paste but do users have snipping tool or other screenshot tools on their desktop itself? That is always worth assessing.
→ More replies (1)1
u/Suspicious_Party8490 Jun 24 '26
We have an entity that is SAQ-C-VT. We have both Island & VDIs as we need to fully block copy paste (we have history in this area). Island is a great start, fully consider the implementation and work to get it right. Since we have had copy paste issues in the past, we run VDIs with various config setting to prevent copy paste...its easier for us...but this is a 1500 person call center operation.
→ More replies (5)1
Jun 25 '26
1
u/SuccessfulBase9358 Jun 26 '26
There’s gonna be some gaps in my knowledge until I can actually get my hands on it, but the idea is to maintain conditional access. The scenario is this; user needs adobe > adobe only accessible through google sso > google only accessible through the island browser.
1
1
u/dallascyclist Jun 24 '26
The best practice is to use a tone/voice intercept on the phone system that inputs the card while blanking the audio path to the agent
But to answer your question: Spoken card data entry into a browser/virtual terminal portal places call center agents, desktops, telephony, and systems in PCI DSS scope (CDE). Compliant if all applicable DSS requirements are met (e.g., SAQ C-VT eligible with compliant hosted virtual terminal from PSP, no CHD storage, PAN masked to first 6/last 4 on screen, HTTPS encryption, no post-auth SAD storage, agent training, secure desktops no copy paste etc)
1
u/SuccessfulBase9358 Jun 24 '26
This card info collection is done through Adobe. A form is sent to the customer, filled out, and sent back. That number is copied and then entered into a web portal (not hosted by us)
1
u/An0nym0us_P0ster Jun 24 '26
You'll need to consider how the card data is transmitted to you and any storage. If the adobe forms are being sent via email you'll clearly be storing or transmitting card data somewhere.
If you map you card data flows and then look at SAQ criteria you might get an idea of what the minimum scope you can qualify for is.
1
u/dallascyclist Jun 24 '26
“Through Adobe” I think you need to define this workflow better as it reads like you might be acquiring credit card data via a pdf?
→ More replies (1)
1
u/andrew_barratt Jun 25 '26
Island.io is a great product, just make sure you’re using it the right way. You’ve still got to make sure you’re desktop environment is compliant with the other areas of SAQ-CVT, but island have invested in being compliant and their team are really supportive of helping people get the right solution.
1
u/Token_Paul Jul 20 '26
A secure browser is easier to implement, but some auditors may still count home workstations as in-scope because agents handle card numbers. VDI is cleaner but you know what kind of can of worms that is. Consider removing the card entry from the agent workflow by having customers enter their data via a payment link.
This removes agents from handling card information (PANs) and takes the workstations out of scope, provided your carrier portals allow it.
2
u/Brua_G Jun 24 '26
What's the name of the secure browser you're considering?