Timeline for Is it allowed to store 8-digit BINs outside of CDE
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 30, 2020 at 23:12 | comment | added | Dan Oak | Although this article states otherwise. But it does mention that storing with different truncations increases vulnerability pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/…. I guess first-8 is still a truncation. | |
| Jan 30, 2020 at 22:59 | comment | added | eckes | The place where you store PANs is the CDE and you can only store them encrypted, hashed or truncated. It is best to not se them at all. | |
| Jan 30, 2020 at 22:55 | comment | added | Dan Oak | Wait, so even truncated PAN has to be stored in CDE? | |
| Jan 30, 2020 at 22:54 | comment | added | eckes | It is BTW not clear why PCI does not allow to show the last two digits for a 8 digit BIN in PANs - but all their truncation rules specifically call for leading 6 digits only. Maybe it is for security to never risk exposing for 6 digit BINs | |
| Jan 30, 2020 at 22:49 | comment | added | eckes | It is the other way around, everywhere you store the PAN it's a CDE. And they discourage multiple truncations. However it can be argued that storing BINs with no link to PANs is not a (truncated) PAN and does not weaken truncation | |
| Jan 30, 2020 at 22:47 | comment | added | Dan Oak | Sorry, I might mislead by question. Reformulated. So basically if I store truncated PANs I fall under DSS, but does it mean I must store it in CDE and what if I store same PANs applying multiple truncation methods separately? Like in my example: first-8 & first-6-last-4. | |
| Jan 30, 2020 at 21:40 | history | answered | eckes | CC BY-SA 4.0 |