PCI DSS and Memcached

Question

If I store cardholder details (PAN, Expiry etc.) in a Memcached data bucket, is that something to worry about in terms of PCI DSS compliance?

Our database is in a data center and is encrypted. Our web server is also in this data center. If I cache cardholder details on a Memcached server node which is running on the same box as the web server, or on a different machine on the same subnet as the web server, do I need to obfuscate or encrypt this cached data?

My initial thought is 'no' because we aren't persisting the data; it's all temporary storage.

edit: our current architecture is PCI-DSS compliant; we were deemed compliant a few months ago. Now it's a matter of remaining that way.

Answer 1

It's persistent enough to be retrieved. There's no reason to keep any personally identifiable data unencrypted. If you can access it without a key so can an intruder.

Make it secure, and it will be compliant. Don't try and make it compliant by adding security later.

Being compliant (by passing your ROC) doesn't mean much to be honest. Companies that perform that activity are of varying skill, and often are selected based on the subject companies likelihood to get a pass. That is not how you protect your companies brand.

If you want ammo for the highers up, what about Massachusetts privacy law? How are you complying with your data requirements there? What about the EU http://en.wikipedia.org/wiki/Data_Protection_Directive and the third party transfer clause?

Encrypt PII/PAN data whenever it's sitting, setup appropriate key management, and use proven crypto-systems to do it. Be smart about protecting your customers data and your companies brand image and you will be compliant.

Answer 2

The relevant PCI-DSS section says:

3.4 Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using any of the following approaches:
* One-way hashes based on strong cryptography (hash must be of the entire PAN)
* Truncation (hashing cannot be used to replace the truncated segment of PAN)
* Index tokens and pads (pads must be securely stored)
* Strong cryptography with associated key-management processes and procedures

https://www.pcisecuritystandards.org/documents/pci_dss_v2.pdf

The anywhere it is stored part seems pretty clear - there's no exception for storing unencrypted PAN data in a RAM based database.

You said your architecture was deemed compliant - If you had a QSA evaluate your environment, this would be a good question to ask him.