PCI DSS - mask PAN and log individual access to PAN

Question

How do you re-conciliate two PCI DSS requirements in applications: 3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only personnel with a legitimate business need can see the full PAN. 10.2.1 Log all individual user accesses to cardholder data

To be more specific, application search screen (based on users search) lists multiple results in table format where among others is PAN, cardholder name, merchant ID etc. We always mask PAN on such result table and if user has business need to see the PAN, he/she can click on the masked PAN in order to see full PAN. This click triggers logging mechanism and we can see which user accessed certain PAN (therefore, complying with PCI DSS req 10.2.1). Of course, we get complaints from users, that this is not user friendly because they cannot immediately identify PAN which they require.

My questions would be - what would be your approach to this? Any suggestions to improve?

Answer 1

I think you have a good approach. I find it interesting that users would complain about not being able to immediately identify card numbers when they can view the first six AND last four in your results table--it is unlikely that there would be two results with the same masked number.

The way you currently have it implemented is good because it has very detailed logging of access to cardholder data. However, if the user has a business need to be able to view any of the card numbers on file (the ones presented in the masked results table) there is no stopping you from displaying the full card numbers in the results table instead of the masked results.

I agree that the wording on the requirement is a little confusing:

Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only personnel with a legitimate business need can see the full PAN

My rewording of the requirement would be this:

Mask PAN when displayed for user without a business need to see the full PAN

If the user has a business need, there is no restrictions on how much of the data you show them at a time. The only difficulty for you would be implementing logging on which card numbers actually got displayed to the user. While this isn't as straight forward as the single card approach, there are a number of technical solutions you can use to address it either in the database or the application.

Answer 2

PCI DSS PAN Data (Personal Account Number) should following these principals when storing:

1. Encrypt PAN number upon creation in database (typically with HSM device)
2. Only decrypt PAN number when billing action occurs (reoccurring billing, use stored number to buy an item, etc.)
3. Store, in separate column (or preferably separate dB) only last 4-digits of PAN, encrypted if possible
4. Only display last 4-digits to customer, never offer "reveal full card number"

Your exposure is increased when you decrypt the entire PAN value, push it to the application server, and then only display a portion of it. Why expose your customers data (in memory) when it is not actually being used for its intended purpose?

To answer your core question: You reconcile the two requirements by having strict protocol over how that sensitive data is used/stored, and thus the problem you propose has been removed.