What should the assessor verify when testing that cardholder data Is protected whenever It Is sent over open public networks?
Requirement for Secure Transmission:
PCI DSS Requirement 4.1 mandates that cardholder data sent over open public networks must be protected with strong cryptographic protocols. Accepting only trusted keys ensures data integrity and prevents unauthorized access.
Key Validation Practices:
Trusted keys and certificates are verified to ensure authenticity. Using untrusted keys compromises the security of the encrypted communication.
Prohibited Practices:
A/D: Configuring protocols to accept all certificates or lower encryption strength violates PCI DSS encryption guidelines.
B: Proprietary protocols are not inherently compliant unless they meet strong cryptographic standards.
Testing and Verification:
Assessors verify the implementation of trusted keys by examining encryption settings, reviewing certificate chains, and conducting tests to confirm only trusted connections are accepted.
Which statement about PAN is true?
PAN Transmission Protection
PCI DSS Requirement 4.1 mandates strong cryptography for PAN during transmission over both public and private wireless networks to prevent unauthorized interception.
Incorrect Options
Options B and D: PAN protection is not required for private wired networks.
Option C: PAN must be protected during transmission over public wireless networks.
A retail merchant has a server room containing systems that store encrypted PAN dat
a. The merchant has Implemented a badge access-control system that Identifies who entered and exited the room, on what date, and at what time. There are no video cameras located in the server room. Based on this information, which statement is true regarding PCI DSS physical security requirements?
Physical Security Requirements:
PCI DSS Requirement 9.1.1 mandates that physical access control systems (like badge readers) must be protected against tampering or disabling to ensure continuous security.
Current Implementation:
The merchant's badge access-control system provides essential logging of access events but must also be protected against tampering to comply with PCI DSS.
Invalid Options:
B: Video cameras are recommended but not explicitly required if access controls effectively ensure security.
C: Secure deletion of access-control logs is not a PCI DSS requirement; logs must be retained as per retention policies.
D: Motion-sensing alarms are not mandatory under PCI DSS physical security requirements.
Which systems must have anti-malware solutions?
Scope of Anti-Malware Requirements
PCI DSS Requirement 5 mandates the use of anti-malware solutions on all in-scope systems unless the system is specifically documented as not being at risk from malware.
Examples of systems not at risk include those using operating systems that do not support anti-malware tools, provided proper justifications and alternative controls are implemented.
Assessment Considerations
QSAs must verify and document why a system is considered 'not at risk.'
Systems storing, processing, or transmitting cardholder data or that could impact the CDE are generally in-scope for anti-malware.
Incorrect Options
Option A: While CDE systems and connected systems require protection, the requirement applies specifically to systems at risk from malware.
Option B: Portable electronic storage is not explicitly called out for universal anti-malware but must be controlled in line with overall security policies.
Option C: Systems storing PAN are only a subset of in-scope systems.
An entity wants to know if the Software Security Framework can be leveraged during their assessment. Which of the following software types would this apply to?
Software Security Framework Overview
PCI SSC's Software Security Framework (SSF) encompasses Secure Software Standard and Secure Software Lifecycle (Secure SLC) Standard.
Software developed under the Secure SLC Standard adheres to security-by-design principles and can leverage the SSF during PCI DSS assessments.
Applicability
The framework is primarily for software developed by entities or third parties adhering to PCI SSC standards.
It does not apply to legacy payment software listed under PA-DSS unless migrated to SSF.
Incorrect Options
Option A: Not all payment software qualifies; it must align with SSF requirements.
Option B: PCI PTS devices are subject to different security requirements.
Option C: PA-DSS-listed software does not automatically meet SSF standards without reassessment.
