1. Home
2. Listings
3. PCI DSS Requirement 4

Category: PCI DSS Requirement 4

Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks

Strong cryptography provides significant assurance in preserving data confidentiality, integrity, and non-repudiation.

The PAN must be encrypted during transmission over untrusted and public networks as these can be easily accessed by malicious individuals. Because an entity stores, processes, or transmits cardholder data, any transmission of cardholder data over an organization’s internal network will naturally bring that network into PCI DSS scope. Any such networks must be checked against the PCI DSS requirements that are in place to ensure the protection of the underlying sensitive data.

Encrypting the data before it is transmitted, encrypting the session over which it is transmitted, or both can protect PAN transmissions. Strong cryptography should be used at both the data level and the session level, but it is not required.

In order to gain privileged access to cardholder data environments, malicious individuals continue to target wireless networks that may be misconfigured or vulnerabilities in legacy encryption and authentication protocols connected to the CDE.