S1 PCI and sensitive data
Needs: Supporter
What may be stored and what never, masking and truncation, test data, and the PCI standards in a developer's words.
This is a supporter feature. Create a free account, then try every supporter feature free for 7 days.
What this module covers
You will be able to
- Know what may be stored and what never
- Mask and truncate
- Keep live data out of test systems and logs
- Place PCI DSS, PIN, PTS, P2PE and SSF
The lesson
- Why it matters
- The concept
- In the real world
- Common mistakes
- What to test
In the module
- The lesson, with diagrams, common mistakes and what to test
- A worked example you can change: What a log may show
- Practice: 2 kinds of generated exercise, each with a step-by-step solution
- A quiz of 8 questions
Key terms
- Cardholder data (CHD)
- The PAN, plus the cardholder's name, expiry date and service code when kept with it.
- Masking
- Hiding digits of a PAN on display or in logs, typically showing at most the first 6 and last 4 digits.
- P2PE (Point-to-point encryption)
- Encrypting card data in the PIN pad and decrypting it only at the host or processor, which shrinks the merchant's PCI scope.
- PCI DSS
- The PCI Data Security Standard for anyone who stores, processes or transmits cardholder data.
- PCI PIN
- The PCI security requirements for handling PINs and their keys: devices, key management, PIN translation.
- PCI PTS
- The PCI requirements and lab approvals for PIN entry devices and HSMs.
- PCI scope
- The systems that store, process or transmit card data, and those connected to them, which must meet PCI DSS.
- Sensitive authentication data (SAD)
- Full track data, CVV2 and PIN or PIN blocks. Never stored after authorisation, even encrypted.
- Truncation
- Removing digits of the PAN permanently before storing it.
The lesson, worked example, practice and quiz open with a supporter pass, which you can try free for 7 days.