PCI DSS FAQ - Payment Card Industry (PCI) Data Security Standard Discussion Forum  

Go Back   PCI DSS FAQ - Payment Card Industry (PCI) Data Security Standard Discussion Forum > Payment Card Industry Data Security Standard Frequently Asked Questions (PCI DSS FAQ) > Protect Cardholder Data > [PCI-DSS] Requirement 3: Protect stored cardholder data
Reload this Page [PCI-DSS] 3.6.7 Prevention of unauthorized substitution of cryptographic keys
Register FAQ Calendar Search Today's Posts Mark Forums Read

[PCI-DSS] Requirement 3: Protect stored cardholder data Encryption is a critical component of cardholder data protection. If an intruder circumvents other network security controls and gains access to encrypted data, without the proper cryptographic keys, the data is unreadable and unusable to that person. Other effective methods of protecting stored data should be considered as potential risk mitigation opportunities. For example, methods for minimizing risk include not storing cardholder data unless absolutely necessary, truncating cardholder data if full PAN is not needed, and not sending PAN in unencrypted e-mails.

Reply
 
Thread Tools Search this Thread Display Modes
  #1  
Old 03-18-2007, 02:57 AM
admin's Avatar
admin admin is offline
Administrator
  
Join Date: Jul 2002
Posts: 229
Default [PCI-DSS] 3.6.7 Prevention of unauthorized substitution of cryptographic keys
[PCI-DSS] 3.6.7 Prevention of unauthorized substitution of cryptographic keys

3.6.7 Verify that key-management procedures are implemented to require the prevention of unauthorized substitution of keys.
Reply With Quote
Reply

Bookmarks
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
[PCI-DSS] 3.6.5 Retirement or replacement of old or suspected compromised cryptographic keys admin [PCI-DSS] Requirement 3: Protect stored cardholder data 0 03-18-2007 02:57 AM
[PCI-DSS] 3.6 Fully document and implement all key-management processes and procedures for cryptographic keys used for encryption of cardholder data, including the following: admin [PCI-DSS] Requirement 3: Protect stored cardholder data 0 03-18-2007 02:55 AM
[PCI-DSS] 3.5.2 Store cryptographic keys securely in the fewest possible locations and forms. admin [PCI-DSS] Requirement 3: Protect stored cardholder data 0 03-18-2007 02:55 AM
[PA-DSS] 2.7 Securely delete any cryptographic key material or cryptogram stored by previous versions of the payment application, in accordance with industry-accepted standards for secure deletion, as defined, for example the list of approved products maintained by the National Security Agency, or by other State or National standards or regulations. These are cryptographic keys used to encrypt or verify cardholder data admin [PA-DSS] 2. Protect stored cardholder data 0 03-18-2007 02:44 AM
[PA-DSS] 2.6 Payment application must implement key management processes and procedures for keys used for encryption of cardholder data admin [PA-DSS] 2. Protect stored cardholder data 0 03-18-2007 02:44 AM


All times are GMT -4. The time now is 04:42 AM.

Contact Us - PCI DSS FAQ - Payment Card Industry (PCI) Data Security Standard Discussion Forum - Archive - Top

All logos and trademarks in this site are property of their respective owner.
The comments are property of their posters, all the rest ©1997 - 2010 by PCIDSSFAQ.ORG, except where noted otherwise.
Powered by vBulletin, Copyright ©2000 - 2010, Jelsoft Enterprises Ltd.
PCI-DSS Forum  |  PA-DSS Forum