1

Does storing temporarily a non-encrypted file containing some PANs violate pci requirements? (for example because it is being processed by an application, or to open it on a file editor)

2

Yes, it's a violation of PCI-DSS Requirements, specifically requirement 3.4:

Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using any of the following approaches:

  • One-way hashes based on strong cryptography (hash must be of the entire PAN)
  • Truncation (hashing cannot be used to replace the truncated segment of PAN)
  • Index tokens and pads (pads must be securely stored)
  • Strong cryptography with associated key-management processes and procedures
| improve this answer | |
  • Is it considered "storing" loading PANs into RAM on systems in which the RAM might at some point temporarily be written on a pagefile? – mic.sca Jul 30 '14 at 7:19
  • I would say yes - it seems to be a gray area, but many would regard this as a risk. – esqew Jul 30 '14 at 16:34
0

Yes, you can't write out unencrypted PAN. If someone could force a crash while that file is being worked on, it would leave it sitting around on the server for anyone to access and the file could potentially be read by other processes.

There is no such thing as a "temporary" file. There are only permanent files you intend to get rid of soon.

Also, why do you need to open it in a file editor to begin with? That sounds like it is asking for a whole set of PCI problems all by itself.

| improve this answer | |
  • For example if something goes wrong with a file being processed due to some bug and a developer has to inspect it. This makes me think the only solution is to encrypt the disk in this case. But which software to use and how to manage the keys(windows encryption is not compliant,right?) – mic.sca Jul 26 '14 at 0:06
  • Is it considered "storing" loading PANs into RAM on systems in which the RAM might at some point temporarily be written on a pagefile? – mic.sca Jul 30 '14 at 7:19
  • @mic.sca - good question. I think technically it probably wouldn't be, but I'm not sure that a lot of people consider that risk. It is at least slightly harder to access in a virtual memory file since it is more buried than if it is in a temp file, but technically it could still be compromised by dumping the virtual memory file. – AJ Henderson Jul 30 '14 at 13:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.