0

I would like to know if storing credit cardholder data using RC2 encryption requires to be compliant with PCI DSS. Currently the 16 digit PAN number and expiry date is stored in the database. The PAN number is encrypted before storing and the site uses SSL to transmit the data to the payment gateway. Do we still need to comply with PCI DSS Requirements if we store encrypted cardholder data???

  • Your question is confusing. If you're supposed to comply with PCI DSS then I would say that you currently are not. I believe RC2 has viable attacks. If you're not required to comply with PCI DSS then I'm not sure what your question is. – RoraΖ Nov 17 '14 at 19:01
  • We have to comply with PCI DSS but the PCI DSS requirements also says that if the PAN number is encrypted and it is transmitted over a SSL network then the requirements of CardHolder data storage does not apply. Is it true?? – Nancy Nov 17 '14 at 22:22
1

Yes, if you receive, transmit, or store cardholder data in any form, you are required to comply with PCI-DSS. In fact, one of the things that you're required to do under PCI-DSS is encrypt that data using strong encryption. Though I am not a PCI auditor, I would suspect that RC2 would not, if fact, be considered strong encryption, so not only are you subject to PCI-DSS, you may be violating it as well.

  • Thanks for the reply, I am pretty much sure that they are not using Strong Cryptograpy. Is it possible that I meet the PCI DSS if we stop storing the card data in the database. Also my other question is that if we are not storing the PAN number in the database, we still transmit to the payment gateway as a plain text but with SSL(https). Do I still need to meet PCI DSS compliance if I only transmit the data and don't store them. – Nancy Nov 17 '14 at 22:29
  • Well if you don't store any data at any point. This means also in your logs and possible crashdumps! If you just transmit it the payment gateway, I suspect you might still need to be compliant. However one strategy might be to use a "redirect to" payment gateway so that the customer needn't input his CC details on your website, but on that of the payment gateway. – Lucas Kauffman Nov 23 '14 at 16:26
0

Risky Behavior

A survey of businesses in the U.S. and Europe reveals activities that may put cardholder data at risk.

81% store payment card numbers

73% store payment card expiration dates

71% store payment card verification codes

57% store customer data from the payment card magnetic stripe

16% store other personal data

Source: Forrester Consulting: The State of PCI Compliance (commissioned by RSA/EMC)

DON'T DO IT

https://www.pcisecuritystandards.org/pdfs/pci_ssc_quick_guide.pdf

Requirement 3: Protect stored cardholder data

In general, no cardholder data should ever be stored unless it’s necessary to meet the needs of the business. Sensitive data on the magnetic stripe or chip must never be stored.

If your organization stores PAN, it is crucial to render it unreadable (see 3.4 ).

3.4 Render PAN, at minimum, unreadable anywhere it is stored – including on portable digital media, backup media, in logs, and data received from or stored by wireless networks. Technology solutions for this requirement may include strong one-way hash functions, truncation, index tokens, securely stored pads, or strong cryptography. (See PCI DSS Glossary for definition of strong cryptography.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.