PCI 4:: Difference between revisions

From HORSE - Holistic Operational Readiness Security Evaluation.
Jump to navigation Jump to search
No edit summary
No edit summary
Line 1: Line 1:
== Requirement 4: Encrypt transmission of cardholder data and sensitive information across public networks. ==
<br>
----
<br>
<br>
* Note that this does not apply to those employees and other parties with a specific need to see full credit card numbers.
* Note that this does not apply to those employees and other parties with a specific need to see full credit card numbers.

Revision as of 16:35, 7 July 2006

Requirement 4: Encrypt transmission of cardholder data and sensitive information across public networks.




  • Note that this does not apply to those employees and other parties with a specific need to see full credit card numbers.




PCI-4.1 Use strong cryptography and encryption techniques (at least 128 bit) such as Secure Sockets Layer (SSL), Point-to-Point Tunneling Protocol (PPTP), Internet Protocol Security (IPSEC) to safeguard sensitive cardholder data during transmission over public networks.


PCI-4.1.1 For wireless networks transmitting cardholder data, encrypt the transmissions by using Wi-Fi Protected Access (WPA) technology if WPA capable, or VPN or SSL at 128-bit. Never rely exclusively on WEP to protect confidentiality and access to a wireless LAN. Use one of the above methodologies in conjunction with WEP at 128 bit, and rotate shared WEP keys quarterly and whenever there are personnel changes.




PCI-4.2 Never send cardholder information via unencrypted e-mail.


  • Maintain a Vulnerability Management Program.


--Mdpeters 08:33, 7 July 2006 (EDT)