PCI Requirement 4.1.1 – Ensure Wireless Network Transmitting CHD or Connected to CDE Uses Strong Encryption

by Randy Bartels / February 7, 2023

Wireless networks are a part of our everyday technology environment. It’s almost impossible to get away from it, be it your cell phone, laptop, watch, tablet, television…the list goes on and on. Wireless networks are extremely prevalent to our culture. Think about how many restaurants you go to that have table side payment. How does your payment get processed? Over a wireless network. That’s where PCI Requirement 4.1.1 comes into…

PCI Requirement 4.1 – Use Strong Cryptography and Security Protocols to Safeguard Sensitive CHD During Transmission

by Randy Bartels / February 7, 2023

If your organization transmits sensitive cardholder data over an open or public network, that data must be encrypted using strong cryptography and security protocols, according to PCI Requirement 4.1. Examples of open, public networks include the Internet, Bluetooth, cell phones/GSM, wireless Internet, etc. The purpose of this requirement is to prevent attackers from obtaining data while in transit, which is a common practice. Best practices for safeguarding sensitive cardholder data…

PCI Requirement 4 – Encrypt Transmission of Cardholder Data Across Open, Public Networks

by Randy Bartels / April 12, 2023

PCI Requirement 4 demands, “Encrypt transmission of cardholder data across open, public networks.” How will this requirement benefit your organization? Complying with PCI Requirement 4 will help prevent your organization from being a target of malicious individuals who exploit the vulnerabilities in misconfigured or weakened wireless networks. So as a safety measure, sensitive data that you transmit over open networks must be encrypted. Assessors will be evaluating whether your organization…

5 Tips for a Successful Penetration Test (Pentest)

by Sarah Harvey / December 19, 2022

Regular penetration tests are a critical line of defense when protecting your organization’s sensitive assets from malicious outsiders. Just like any test, you need to be prepared. Your organization should take steps to ensure that you pass your penetration test and will be prepared to fend off attackers. Not only are regular penetration tests required by most audit frameworks and provide real-world insight into how hackers can exploit vulnerabilities, they…

What’s The Difference Between SOC 1, SOC 2, and SOC 3?

by Joseph Kirkpatrick / February 7, 2023

When it comes to SOC (System and Organization Controls) reports, there are three different SOC report types: SOC 1, SOC 2, and SOC 3. When considering which report fits your organization’s needs, you must first understand what your clients require of you and then consider the areas of internal control over financial reporting (ICFR), the Trust Services Criteria, and restricted use. Each SOC report type fulfills a different purpose, and…