Are only trusted keys and/or certificates accepted? Observe inbound and outbound transmissions Examine keys and certificates Are security protocols implemented to use only Examine system configurations secure configurations, and to not support insecure versions or configurations? Is the proper encryption strength implemented for the Review vendor documentation encryption methodology in use (check vendor Examine system configurations recommendations/best practices)? For SSL/TLS implementations, is SSL/TLS enabled Examine system configurations whenever cardholder data is transmitted or received? For example, for browser-based implementations: appears as the browser Universal Record “HTTPS” Locator (URL) protocol, and Cardholder data is only requested if appears “HTTPS” as part of the URL. 4.1.1 Are industry best practices (for example, IEEE 802.11i) Review documented standards used to implement strong encryption for authentication Review wireless networks and transmission for wireless networks transmitting Examine system configuration cardholder data or connected to the cardholder data settings environment? Note: The use of WEP as a security control is prohibited. Are PANs rendered unreadable or secured with 4.2 Observe processes strong cryptography whenever they are sent via Review outbound transmissions messaging technologies (for example, e-mail, instant messaging, or chat)? Are policies in place that state that unprotected PANs Review policies and procedures are not to be sent via end-user messaging technologies?
Are only trusted keys and/or certificates accepted? Observe inbound and outbound transmissions Examine keys and certificates Are security protocols implemented to use only secure configurations, and to not support insecure versions or configurations? Examine system configurations Is the proper encryption strength implemented for the encryption methodology in use (check vendor recommendations/best practices)? Review vendor documentation Examine system configurations For SSL/TLS implementations, is SSL/TLS enabled whenever cardholder data is transmitted or received? For example, for browser-based implementations: “HTTPS” appears as the browser Universal Record Locator (URL) protocol, and Cardholder data is only requested if “HTTPS” appears as part of the URL. Examine system configurations 4.1.1 Are industry best practices (for example, IEEE 802.11i) used to implement strong encryption for authentication and transmission for wireless networks transmitting cardholder data or connected to the cardholder data environment? Note: The use of WEP as a security control is prohibited. Review documented standards Review wireless networks Examine system configuration settings 4.2 Are PANs rendered unreadable or secured with strong cryptography whenever they are sent via messaging technologies (for example, e-mail, instant messaging, or chat)? Observe processes Review outbound transmissions Are policies in place that state that unprotected PANs are not to be sent via end-user messaging technologies? Review policies and procedures