Requirement 4 - All about Encryption

Requirement 4: Encrypt transmission of cardholder data across open, public networks


4.1 Use strong cryptography and security protocols such as secure sockets layer (SSL) / transport layer security (TLS) and Internet protocol security (IPSEC) to safeguard sensitive cardholder data during transmission over open, public networks. Examples of open, public networks that are in scope of the PCI DSS are the Internet, WiFi (IEEE 802.11x), global system for mobile communications (GSM), and general packet radio service (GPRS).

•4.1.1 For wireless networks transmitting cardholder data, encrypt the transmissions by using WiFi protected access (WPA or WPA2) technology, IPSEC VPN, or SSL/TLS. Never rely exclusively on wired equivalent privacy (WEP) to protect confidentiality and access to a wireless LAN. If WEP is used, do the following:
• Use with a minimum 104-bit encryption key and 24 bit-initialization value
• Use ONLY in conjunction with WiFi protected access (WPA or WPA2) technology, VPN, or SSL/TLS
• Rotate shared WEP keys quarterly (or automatically if the technology permits)
• Rotate shared WEP keys whenever there are changes in personnel with access to keys TNT allows organizations to terminate access to ALL environments in seconds, even if the employee has access to an organization owned machine
• Restrict access based on media access code (MAC) address. TNT is more comprehensive than this. MAC addresses can be spoofed. Multiple serial numbers from multiple hardware attributes combined with authenticated user data cannot.
•4.2 Never send unencrypted PANs by e-mail.