0

Before I arrived at my current company we obtained the services of PCI consultant who gave us some very specific, if questionable, advice on encryption requirements.

The particular piece of advice I am suspicious of is that of making sure that cardholder data is encrypted as is moves across our internal (detached) network. The method of encryption, we were told, needs to be at the Application level, and Transport level is not allowed. So, instead simply using HTTPS to move a file, we are having to encrypt the file using PGP before sending, then decrypting after it arrives.

I simply can't see in the documentation where this is a requirement. Has anyone else been told the same thing? Is there a precedence for this?

The document we are using is the May 2013 Card Production Logical Specs

Improve this question

1 Answer 1

Reset to default
2

The advice your PCI consultant gave you does not match PCI requirements. Ask them for a citation that "Application level encryption" is required across the network. Any PCI consultant has to at least tell you what DSS requirement they're citing. "Pictures or it didn't happen..."

Section 4.1 of the PCI DSS requires you to encrypt on untrusted networks; if your internal network is properly protected as per Section 1 then you are permitted to transmit unencrypted PAN data on it*. And Transport level is explicitly listed as an appropriate protection:

Use strong cryptography and security protocols (for example, SSL/TLS, IPSEC, SSH, etc.) to safeguard sensitive cardholder data during transmission over open, public networks.

When storing PAN data, you are required to protect it, which in the case of encryption section 3.4 states you should use:

Strong cryptography with associated key-management processes and procedures

Which may be where your consultant is coming up with "Application level encryption", but that's on disk, not on the wire.

*Note, even though you can go without encryption on the backend, you probably shouldn't. Among other things, DSS 8.4 requires that credentials be encrypted during transmission, and if you're sending PAN data in the clear you're probably sending credentials in the clear.

Improve this answer
4
  • An auditor that doesn't cite chapter and verse for recommendations based on the body of rules they're basing their audit off of should be avoided. Like gowenfawr, I'd ask for citation of the applicable PCI DSS reg.
    – C.J. Steele
    Apr 7, 2014 at 21:02
  • I totally agree with that! If I were there I would have asked "If this results in a finding, which section would be cited?"
    – lipidfish
    Apr 8, 2014 at 14:23
  • Are auditors required to cite a section / subsection when they produce a finding?
    – lipidfish
    Dec 18, 2014 at 15:29
  • Technically, in a PCI audit, it's not a finding unless it fails at least one requirement. So they absolutely should. I can't promise you that all ROCs (Report On Compliance) are written with the clarity they should have, though. Would love to hear, from a QSA QA or a card brand reviewer who sees a lot of ROCs, what the expectations really are.
    – gowenfawr
    Dec 18, 2014 at 15:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .