CompTIA DataSys+ (DS0-001)Data and Database SecurityHard
A banking application uses a database to store credit card numbers. To reduce the scope of PCI DSS compliance and minimize the risk associated with storing sensitive cardholder data, the development team decides to replace actual credit card numbers with unique, non-sensitive surrogate values. These surrogate values can be used for internal processing, but the original credit card numbers are stored separately in a highly secure vault and are only retrieved when absolutely necessary. Which data security technique is being implemented?
- AData encryption
- BData masking
- CPseudonymization
- DTokenization
Show answer & explanationAnswer & explanation
Correct answer: D. Tokenization
Tokenization replaces sensitive data (credit card numbers) with a non-sensitive equivalent (tokens) that has no extrinsic meaning or value. The original sensitive data is stored separately and securely, and the token can be used for most operations, significantly reducing the scope of PCI DSS compliance for systems handling only tokens.
Why the other options are wrong
- A. Data encryption protects data but still involves storing the original encrypted data, which is within PCI scope.
- B. Data masking replaces sensitive data with fictitious data, typically for non-production environments, and the original data is usually overwritten or not linked.
- C. Pseudonymization replaces direct identifiers with artificial identifiers, but the link to the original data can be re-established, and it doesn't typically involve a 'secure vault' for the original data in the same way as tokenization for PCI DSS.
Tokenization
The process of replacing sensitive data with a unique, non-sensitive placeholder (token) that retains all essential information without compromising its security.
- Original sensitive data is stored securely in a token vault.
- Tokens are irreversible and mathematically unrelated to the original data.
- Widely used for PCI DSS compliance to reduce the scope for systems handling only tokens.
Memory trick: Tokens are safe stand-ins for real cards.