Which statement best describes how to validate CHD transmission security over open networks?

Which statement best describes how to validate CHD transmission security over open networks?

• A. Identify all CHD transmission locations and verify the use of secure protocols, strong crypto, and trusted keys/certificates.
• B. Assume all open networks are secure if firewalls are in place.
• C. Only verify that encryption exists, regardless of version support.
• D. Disregard the configuration of the cryptographic protocols.

Answer: (A)

Protecting cardholder data in transit over open networks requires comprehensive coverage of every place CHD leaves your environment and ensuring the protection in use is strong and properly configured. The best approach is to identify all CHD transmission locations and verify the use of secure protocols, strong crypto, and trusted keys/certificates. This ensures that every path CHD takes is protected with robust, properly managed cryptographic controls, not just assumed to be safe. Relying on firewalls alone isn’t enough because open networks can still expose data in transit if encryption isn’t enforced at every point. Merely checking that encryption exists misses whether the algorithms are current and strong, whether the protocol versions are supported, and whether keys and certificates are properly managed. Ignoring how cryptographic protocols are configured leaves you vulnerable to weak settings and misconfigurations that could expose data. This approach aligns with PCI DSS requirements to encrypt the transmission of CHD across open networks.

Protecting cardholder data in transit over open networks requires comprehensive coverage of every place CHD leaves your environment and ensuring the protection in use is strong and properly configured. The best approach is to identify all CHD transmission locations and verify the use of secure protocols, strong crypto, and trusted keys/certificates. This ensures that every path CHD takes is protected with robust, properly managed cryptographic controls, not just assumed to be safe.

Relying on firewalls alone isn’t enough because open networks can still expose data in transit if encryption isn’t enforced at every point. Merely checking that encryption exists misses whether the algorithms are current and strong, whether the protocol versions are supported, and whether keys and certificates are properly managed. Ignoring how cryptographic protocols are configured leaves you vulnerable to weak settings and misconfigurations that could expose data. This approach aligns with PCI DSS requirements to encrypt the transmission of CHD across open networks.