by Randy Bartels / July 28th, 2017
PCI Requirement 3 states, “Protect stored cardholder data.” We’ve discussed encryption, truncation, masking, and hashing – all methods that can be used to protect…
by Randy Bartels / July 28th, 2017
Someone in your organization needs to be responsible for managing the encryption of your environment and accept the importance of this role. This is…
by Randy Bartels / July 28th, 2017
Your organization must have the appropriate controls in place to prevent unauthorized key substitution. PCI Requirement 3.6.7 requires, “Prevention of unauthorized substitution of cryptographic…
by Randy Bartels / July 28th, 2017
PCI Requirement 3.6.6 is one requirement that both assessors and clients struggle to understand. PCI Requirement 3.6.6 states, “If manual clear-text cryptographic key-management operations…
by Randy Bartels / July 28th, 2017
PCI Requirement 3.6.5 requires, “Retirement or replacement (for example, archiving, destruction, and/or revocation) of keys as deemed necessary when the integrity of the key…
