Card data discovery is an important part of payment data security and complying with PCI DSS requirement 3. If you are going to store credit card data, you’ll need to know where it is captured, where it is stored, where it is transmitted, and where it is received.
Yes. Although it is best to avoid storing unencrypted card data in the first place, PCI DSS requirement 3 gives guidelines on how to protect unencrypted payment card data.
Card data discovery is an important part of payment data security and complying with PCI DSS requirement 3. If you are going to store credit card data, you’ll need to know where it is captured, where it is stored, where it is transmitted, and where it is received. The process for visually mapping out these data flows is done through a card data flow diagram.
A card data flow diagram visually shows where PAN enters, leaves, and is stored, and can help identify the scope of the card data environment (i.e., the area that needs to be secured and follow the PCI DSS). The card data flow diagram is also helpful in identifying whether credit card data is found in unexpected locations which may not be represented in a card flow diagram. You can walk through the card data flow diagram and ask questions at each point in the process to confirm that credit card information isn’t leaking or stored where it shouldn’t be.
For example, if you receive credit card information on a form over fax, you can ask “is that form also saved on a fax server or sent over email?” If you capture credit card information on a hosted payment page then you could ask “could credit card information have been errantly entered into the name field or even the zip code field?” Combining a data flow diagram with employee interviews and periodic system scans for PAN data can be a valuable way to confirm that processes for handling credit card data are accurately understood and documented.
Since 2010, SecurityMetrics PANscan® has discovered about 2.9 billion unencrypted primary account numbers (PAN) on business networks. Storage of unencrypted payment card data increases your organization's risk and liability in the event of a data breach.
Storing any unencrypted card data, especially track data, is a violation of the Payment Card Industry Data Security Standard (PCI DSS) and makes it easier for a criminal to steal data.
COMMON PAYMENT CARD DATA HIDING PLACES
Due to poor processes and/or misconfigured software, payment card data can leak into networks, even those that shouldn't store sensitive data. Here are common places to look for hiding payment card data:
.svg)
