Demystifying Encryption For PCI DSS

Roger Nebel writes for SearchSecurity.com about the encryption requirements to comply with the Payment Card Industry Data Security Standard - PCI DSS. "Requirement 3.4 stats that merchants must render [the Primary Account Number], at minimum, unreadable anywhere it is stored (including data on portable digital media, backup media, in logs, and data received from or stored by wireless networks)." Nebel's a fan of using a hashing approach to protect card information - pointing out that hash functions are "readily available to programmers as this is the normal way passwords are stored and used in modern operating systems."