PCI SSCPCI DSSEncryptionEASYFree question
What encryption does PCI DSS require for wireless networks transmitting cardholder data?
- A.Open authentication with MAC filtering (SSID hiding) is acceptable for card traffic; WEP and WPA are accepted as long as the passphrase is rotated yearly
- B.Captive portals (HTTPS login) satisfy the rule on guest networks; WPA2 and WEP are both accepted so long as the scanner runs quarterly
- C.Strong encryption such as WPA2 (AES/CCMP) or WPA3 must be used; WEP and WPA with TKIP are not considered strong cryptography
- D.A site VPN (IPsec) must be used; WPA2 and WPA3 are not valid as transport protection
Why C is correct
PCI DSS requires strong wireless encryption like WPA2-AES or WPA3. WEP and WPA-TKIP have known vulnerabilities and are not acceptable.
Know someone studying for PCI DSS? Send them this one.