We should talk about what it doesn't say in 4.1 or 4.2.
We should.
The one that said 4.3 that's not in the standard; no, actually 4.3 is.
It is now.
But there should be something in there that says
encryption of data over internal networks.
Yes.
Because the standard doesn't require you to do that.
It doesn't.
So as an assessor you can't assist on that.
I cannot.
Would you recommend it?
Yes.
Right.
For what I hope are painfully obvious reasons.
Yes.
And that's actually a really good point,
and again, we're back to compliance versus security.
There've been many attacks and the large payment processor in the U.S.
that was about five or six years ago, that was an attack where,
you know, if they'd been encrypting data,
it wouldn't have got taken from; it was an on-the-wire attack basically.
So off the network interface guard,
would they had been using encryption at the TLS level
they would've never gotten the data.
Indeed.
And so encrypting data on local networks now is more important.
One of the things I always talk about with people is you know,
when I started doing, well, you've been an assessor since before PCI,
haven't you?
Yes, I have.
And we've seen that attacks used to be against stored cardholder data,
because people used to store cardholder data.
Right.
And the attacks are now all about data in transit,
whether it's memory scraping malware, or whether it's network traffic.
So that's where the attack is, our defense has to be encrypting on the network.
Indeed, indeed, you know, or even at the contact layer,
right, so that you can protect against those memory scraping attacks.
Don't let the relative lengths of the requirements fool you.
Requirement is probably more important at this point than requirement 3.
Yeah, because the attack is against in transmission, not against storage.
Against the stored repository, yep.
That's great.
Anything else we should talk about, about requirement 4?
I think that's the short of it.
Yeah, it's a short requirement, but really involved.