Download

Sensitive cardholder authentication data is not to be stored after authorization hastaken place.The PAN should be masked whenever it is displayed.The PAN (at the very minimum) needs to be rendered unreadable wherever it isstored.This can be accomplished by encryption, one-way hashes, and othermethods.PCI DSS outlines several specific requirements for how encryption keys used forencryption of cardholder data must be managed.Frequently Asked QuestionsProtect Cardholder Data • Chapter 9 301The following Frequently Asked Questions, answered by the authors of this book, aredesigned to both measure your understanding of the concepts presented inthis chapter and to assist you with real-life implementation of these concepts. To haveyour questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form.Q: What happens when I have my environment assessed for compliance?A: An audit for PCI DSS compliance is very similar to other kinds of process audits. Makesure you have your processes and procedures documented. An assessor would check yourenvironment to make sure that you follow the procedures you have documented, andthat sensitive data is being secured properly.Q: Is there any way to prepare for assessment and make sure I’ve covered everything?A: In addition to being thoroughly familiar with the PCI DSS documentation, the PCISecurity Standards Council also provides a handy Self Assessment Questionnaire to assistorganizations in their overall review of the environment. It can be downloaded fromhttps://www.pcisecuritystandards.org/pdfs/pci_saq_v1-0.pdf.Q: Are problems with PCI DSS Requirements 3 and 4 a common cause of PCI standardscompliance failures?A: Yes, failure to properly secure sensitive data at rest, and failure to properly encrypt andsecure it during transmission, are the most common sources of failure in compliance toPCI DSS standards. In November of 2006, Visa USA Cardholder Information SecurityProgram (CISP) issued a bulletin which underscored this fact, specifically focusing onimproperly installed and maintained point-of-sale (POS) systems.