Objective 3.3: Compare and contrast concepts and strategies to protect data
Security+ SY0-701 practice question
An online retailer stores customer card numbers so that it can charge monthly subscriptions. To reduce its PCI DSS scope, it wants the order database to hold substitute values that only the payment processor's secure vault can map back to the real card numbers. If the order database is stolen, there must be no key or algorithm that could recover the card numbers from the stolen data. Which method BEST meets these requirements?
- Data masking
Data masking hides part or all of a value, for example showing only the last four digits on screen. Either the real number is still stored underneath, or (with permanent masking) it is gone and nobody can charge the card. Neither meets the requirement.
- Hashing
Hashing is one-way, so the processor could not map a hash back to the card number to charge it. Card numbers also have a small, structured keyspace, so unsalted hashes of them can be brute-forced.
- Tokenization(Correct)
Correct. Tokens are random substitutes that only the processor's vault can map back to card numbers. A stolen token database contains nothing that a key or algorithm could turn back into card data.
- Encryption with AES-256
Encrypted card numbers can be recovered by anyone who obtains the key, so the stolen database would still contain recoverable card data. The stem rules out any method that a key can reverse.
Explanation
Tokenization replaces sensitive data with a random token. The mapping between token and real value exists only in a separate, protected token vault, so the token has no mathematical relationship to the original and cannot be reversed by a key or algorithm. Systems that store only tokens can be removed from much of the compliance scope, while authorized systems can still use the vault to complete transactions.