Re: Email blocking inbound credit card numbers -- PCTECH

Short answer is no. PCI data stored in production databases needs to be
encrypted at rest. Typically that involves disk encryption, file/folder
encryption, or column encryption within tables (transparent data encryption
or similar).

Also, PCI data in transport needs to be encrypted when sent over public
networks.

PCI also requires encryption key management so sending something encrypted
without a key management process to rotate the keys, have assigned key
custodians, etc. is only a partial pass of the controls.

On Wed, Apr 17, 2019 at 1:33 PM Rob Berendt <rob@xxxxxxxxx> wrote:

Kind of curious. If the sensitive information is in an encrypted
attachment does that exclude tossing in the whole email system for review?

-----Original Message-----
From: PcTech <pctech-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of John Jones
Sent: Wednesday, April 17, 2019 2:14 PM
To: PC Technical Discussion for IBM i (AS/400 and iSeries) Users <
pctech@xxxxxxxxxxxxxxxxxx>
Cc: David Gibbs <david@xxxxxxxxxxxx>
Subject: Re: [PCTECH] Email blocking inbound credit card numbers

If you're a merchant, service provider, or other processor in the PCI
chain and you take CCs via email then your entire email system may be
considered in-scope by your PCI assessor and the full DSS applies. Which
means encryption everywhere, physical access reviews, etc. Generally, even
if you use Office365, G Suite, or some other hosted solution, this is
non-trivial and non-cheap.

Also, rejecting CCs sent via email might, just might, slowly train a few
people to think before they send sensitive information via insecure
channels.

Downside is that a lot of numbers can match the Luhn check so false
positive rate can be high unless the logic looks for other things.

(I own the PCI compliance program for a Level 1 service provider)

On Wed, Apr 17, 2019 at 10:41 AM Jim Oberholtzer <
midrangel@xxxxxxxxxxxxxxxxx> wrote:

I would not want the liability of getting onto my system in the first
place....

--
Jim Oberholtzer
Agile Technology Architects

-----Original Message-----
From: PcTech <pctech-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of David
Gibbs via PcTech
Sent: Wednesday, April 17, 2019 10:39 AM
To: pctech@xxxxxxxxxxxxxxxxxx
Cc: David Gibbs <david@xxxxxxxxxxxx>
Subject: [PCTECH] Email blocking inbound credit card numbers

I've noticed something kind of interesting on the mailing lists recently.

Some mail servers are blocking inbound email that appear to contain
credit card numbers.

I can understand restrictions on filtering outbound mail that might
contain credit card numbers. While it's obviously not a good idea to
send a credit card number in email, why would a company block mail that

does contain one?

david

--
IBM i on Power Systems: For when you can't afford to be out of business!

I'm riding 615 miles (Yes, you read that right) in the American
Diabetes Association's Tour de Cure to raise money for diabetes
research, education, advocacy, and awareness. You can make a
tax-deductible donation to my ride by visiting

https://mideml.diabetessucks.net.

You can see where my donations come from by visiting my interactive
donation map ... https://mideml.diabetessucks.net/map (it's a geeky
thing).

I may have diabetes, but diabetes doesn't have me!
--
This is the PC Technical Discussion for IBM i (AS/400 and iSeries)
Users
(PcTech) mailing list To post a message email:
PcTech@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe, or change list
options,
visit: https://lists.midrange.com/mailman/listinfo/pctech
or email: PcTech-request@xxxxxxxxxxxxxxxxxx Before posting, please
take a moment to review the archives at

https://archive.midrange.com/pctech.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com

--
This is the PC Technical Discussion for IBM i (AS/400 and iSeries)
Users
(PcTech) mailing list
To post a message email: PcTech@xxxxxxxxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/pctech
or email: PcTech-request@xxxxxxxxxxxxxxxxxx Before posting, please
take a moment to review the archives at
https://archive.midrange.com/pctech.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com

--
John Jones, CISSP
History has taught us that we don't learn from the past.
--
This is the PC Technical Discussion for IBM i (AS/400 and iSeries) Users
(PcTech) mailing list To post a message email: PcTech@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/pctech
or email: PcTech-request@xxxxxxxxxxxxxxxxxx Before posting, please take a
moment to review the archives at https://archive.midrange.com/pctech.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com
--
This is the PC Technical Discussion for IBM i (AS/400 and iSeries) Users
(PcTech) mailing list
To post a message email: PcTech@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/pctech
or email: PcTech-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/pctech.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com