Encryption Key Management. Teleflora Dove POS 5

Teleflora Point of Sales PA-DSS Implementation Guide

Encryption Key Management

Addresses:

PA-DSS 2.5

PA-DSS 2.6

PA-DSS 2.7

PCI DSS 3.5

Your Dove POS system encrypts the cardholder information being retained on disk. An “encryption key”, comprising of special files is ultimately used to protect the data. In order to retain a level of security, you must follow some key management procedures as per PCI DSS 3.

Directives you must follow are summarized as follows:

• Restrict access to the decryption key material (Dove POS files) to the fewest number of people possible. (PCI 3.5.1)

• Store the cryptographic files in the fewest possible locations and formats. Do not make multiple

“copies” of your Dove POS files in unprotected or insecure storage locations. (PCI 3.5.2)

• Store the cryptographic files in a secure location and form. (PCI 3.6.3)

• In the event of software or system changes, ensure that older encryption keys are securely deleted (See appendix on using secure delete utility). (PCI 3.6.5, PCI 3.6.8)

• Change the encryption key (DeK), at least annually. See appendix on How to Change your Dove

POS Data Encryption Key (PCI 3.6.4)

• Do not retain old cryptographic files; destroy them once you are done with them. (PCI 3.6.5)

• Prevent the possibility of unauthorized substitution of cryptographic material. For example, do not tamper with the file permissions structure of your Dove POS system (PCI 3.6.7)

• If you know, or even suspect, that your data encryption key(s) have been taken, stolen, or otherwise compromised, you should take action to rotate the encryption keys immediately (See appendix on How to Change your Dove POS Data Encryption Key)(PCI 3.6.8)

Dove_POS_PA-DSS_Implementation_Guide_v1.3.doc – 2011-11-11 Page 7