PCI SSCPCI DSSEncryptionEASYFree question
What is the PCI DSS position on SSL and early TLS?
- A.SSL and early TLS (1.0, 1.1) are no longer considered strong cryptography and must not be used for protecting cardholder data
- B.Legacy SSL and TLS 1.0 (1.1 excluded) remain acceptable on internal links, and Requirement 4 prohibits them just on internet-facing web servers
- C.Early TLS (1.0, 1.1) and SSL are permitted if a compensating control is documented, and a risk analysis covers each remaining endpoint
- D.SSL (3.0) and TLS 1.2 (RFC 5246) are both deprecated, and must be replaced by IPsec for card data
Why A is correct
SSL and early TLS versions have known vulnerabilities and are no longer considered secure. PCI DSS requires TLS 1.2 or higher.
Know someone studying for PCI DSS? Send them this one.