1

I am working at a company that is PCI compliant, but I believe they have interpreted some of the requirements incorrectly. Because of this, they are laboring to create work-arounds which I suspect are not necessary.

Specifically, I am wondering about the definition of "Transmission", in the context of PCI requirement 4.2 b "All secret and confidential data must be encrypted at all times during transmission and storage".

The company has taken this to mean that any time a file is copied WITHIN THE INTERNAL NETWORK, that this constitutes transmission, and because of that the file needs to first be encrypted.

I believe, though, that transmission seems to imply transfer through the internet - where of course you would need to have that encrypted.

Can anyone help settle the argument?

  • I'm not fond of the concept of "trusted network" even if it's an already encrypted VPN. I'd run all transmissions over SSL, even within the internal network ensuring end-point authentication. – CodesInChaos Mar 27 '14 at 10:42
4

Instead of trying to toe some ill-defined line, think about your security, and your responsibility to your customers. If a hacker was in your network, what would happen?

Even if PCI didn't technically require it, if this data is in my network, I would require it. That said, our QSA's interpretation is that it always needs to be encrypted internally.

  • Good answer. I agree with your approach 100%. If its sensitive data and should be protected, it should be protected everywhere. Strictly speaking, letter of the law-PCI DSS, you don't have to encrypt internally, unless its over a wireless network. Wireless is always considered public for PCI. But best practice and common sense would tell you to always encrypt. you never know who is watching. – Timee Mar 27 '14 at 18:32
  • I love this approach. You're right about going for what you'd want your environment to look like. – lipidfish Mar 29 '14 at 21:23
  • @Timee - Can you point to a authoritative reference that explicitly states that you don't have to protect it internally? – Motivated Apr 12 '16 at 8:51
  • 1
    @Motivated, pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf . Section 3 talks about stored data: section 3.4 it says that stored data must be protected. Section 4 talks about network data, it says "Sensitive information must be encrypted during transmission over networks that are easily accessed by malicious individuals." It lists examples of "easily accessed" networks in 4.1. By implication, encryption is not required on "not-easily accessed" networks. That doesn't mean internal encryption is prohibited, or even a bad idea, just that it's not required. – John Deters Apr 12 '16 at 15:18
3

The language/summary that addresses your question is requirement 4: "Encrypt transmission of cardholder data across open, public networks"

Here is a couple links (with additional references) that give an overview of the requirements. I'll leave this as a community wiki in case someone can find a better link.

That being said, sensitive information needs to be stored encrypted regardless of location, so in general, it should be easy to leave encrypted within your network until said data reaches point of use. Also, if your company uses dedicated network links supplied by external vendors i.e. metro links between buildings, campuses, that you would normally consider your own network (and it is, for most conversations) data should be encrypted across those links as well. Not technically required, but if a MITM attack happens on your telco provided metro link and your data wasn't encrypted, that won't end well for you.

1

PCI requirement 4.2b states : "Never send unprotected PANs by enduser messaging technologies (for example, email, instant messaging, SMS, chat, etc.)."

The guidance for this requirement describes : "E-mail, instant messaging, and chat can be easily intercepted by packet-sniffing during delivery across internal and public networks. Do not utilize these messaging tools to send PAN unless they are configured to provide strong encryption"

This does not mean "All secret and confidential data must be encrypted at all times during transmission and storage" as you wrote but it means dont sent credit card number (PAN) using unprotected PANs by end user messaging technologies.

For example you can send using encrypted email but not regular mail \ chat

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.