PCI compliance simple questions

Question

For now I read PCI compliance document and I don't understand any things.

I have a program, which takes sensitive and cardholder data as input (some of them are in encrypted form) and then returned back (some of them are in encrypted form).

I have 2 simple questions:

1. What elements need to be encrypted as input and output? For now - how I understand it - only PIN, PAN, track2data and CVV code need to be encrypted.

2. What elements need to be masked and how should I do it? For now I was saving in the log files only the last 4 digits of the PAN (for example - ***1234), CVV code is completely masked (for example - **), track2data is completely masked and and PIN is completely masked.

Answer 1

Hi @VladislavLysov Welcome.

I am afraid you will need to a bit more specific; there seems to be a slight difference between storing and transmitting details. Some data should never be stored, even in the encrypted form, such as item 3.2.3, which says: "Do not store the personal identification number (PIN) or the encrypted PIN block."

Going back a step, Requirement 3: Protect stored cardholder data

3.1 - Keep cardholder data storage to a minimum by implementing data retention and disposal policies, procedures and processes, as follows.

3.2 - Do not store snsitive authentication data after authorization (even if encrypted).

Sensitive data in this context are:

• Card Verification Value
• PIN or the encrypted PIN Block

• The full contents of the Magnetic Stripe

  Regarding the Magnetic Stripe, PCI itself says that in "the normal course of business, the following data elements from the magnetic stripe may need to be retained:

  1. Cardholder Name
  2. Primary Account Number (PAN)
  3. Expiration Date
  4. Service Code"

Finally,

 3.3 - Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed).

So to sum up and (hopefully) answer your questions, 1) In my view, the whole communication should be done in an encrypted manner 2) none of the items of the three bullet points should ever be stored, neither encrypted, nor masked. What you mentioned about masking concerns the storage of the PANs, which should not be visible to anyone else apart from the very few users who have the right to see it in order to carry on their jobs. In cases where the PAN is displayed, say, to the user, then that's when you need to mask it as not to show the whole number. CVVs, PINs should never be stored anywhere, including the logs you mentioned. You may store (for not longer than necessary) some of the magnetic stripe contents, and that should be encrypted. You may also store PANs, but again they need to be masked out in the general logs and when presenting it to users.