PCI 4:
Requirement 4: Encrypt transmission of cardholder data and sensitive information across public networks.
- Note that this does not apply to those employees and other parties with a specific need to see full credit card numbers.
- PCI-4.1 Use strong cryptography and encryption techniques (at least 128 bit) such as Secure Sockets Layer (SSL), Point-to-Point Tunneling Protocol (PPTP), Internet Protocol Security (IPSEC) to safeguard sensitive cardholder data during transmission over public networks.
- Verify the use of encryption (e.g., SSL) wherever cardholder data is transmitted or received over the Internet by performing the following:
- Verify the use of encryption (e.g., SSL) wherever cardholder data is transmitted or received over the Internet by performing the following:
- Verify that at least 128 bit encryption is used during data transmission.
- For SSL implementations, verify that HTTPS appears as a part of the browser Universal Record Locator (URL), and that no cardholder data was required when HTTPS did not appear in the URL.
- Select a sample of transactions as they are received and observe transactions as they occur to verify that cardholder data is encrypted during transit.
- Verify that only trusted SSL keys/certificates are accepted.
- Verify that, for the encryption methodology in use, the proper encryption strength is implemented. For example:
- Verify that, for the encryption methodology in use, the proper encryption strength is implemented. For example:
- 3DES: 128 bits
- Advanced Encryption Standard (AES): 256 bits
- RSA: 1024 bits
- Check vendor recommendations and best practices for other encryption methodologies.
- Maintain a Vulnerability Management Program.
Use this illustration to determine what and where card data is permitted by PCI DSS.
--Mdpeters 08:33, 7 July 2006 (EDT)