Requirement 3.3 is a bit of a strange one.
It's concerned with people seeing primary account numbers or PANs,
that's the 15- or 16-digit number; we all think of the card number,
the big number on the front of the card,
and the requirement is that unless there's a legitimate business need,
when a PAN is displayed or printed,
it is masked so that the person looking at the screen or
the printout can only see a maximum of the first six and
last four digits of the PAN.
Let's look at what this means.
Firstly, let's look at a situation where the PAN isn't masked.
The PAN is stored in the database in full; when it needs to be shown to a user,
the entire PAN is displayed.
And actually what's interesting to note here is that this
computer that's controlling the display of the PAN is now in
scope with PCI DSS requirements, because it's now processing that PAN,
which is cardholder data.
Now let's look at what happens when a PAN is masked.
The database still stores the full PAN,
but rather than display the entire card number,
some of it's obscured by asterisks when it's displayed,
quite frequently just the four last digits are shown,
but the standard actually does allow for the display of the
first six digits and the last four digits,
and systems displaying masked cardholder data do not process cardholder data
so they can remain out of scope of PCI DSS's requirements.
That's as long as the masking is done on the way to the display and
actually not done in the display where the display's actually got the
whole PAN hiding behind the masked number.
Now the really important thing to remember in this requirement is
that it only applies where personnel do not have a legitimate
business need to see the card number in full.
You know,
in some of those places where this is legitimate can include merchant receipts,
e-commerce websites,
and where people are entering card details in contact centers.
This somewhere I've seen some really stupid interpretations of the PCI
DSS that actually have really harmed the business.
I'm going to discuss these with Jacob in our
conversation at the end of this module.
I must emphasize that it's the responsibility of the merchant to
determine where there's a legitimate business need.
This isn't the role of the QSA; however,
the QSA is responsible for checking the documentation that
defines where there's a legitimate business need for a card
number to be displayed or printed,
and then checking all the places where card numbers are displayed to
make sure they are masked when they need to be.