PCI/DSS：静态数据
您会考虑在静态数据类别中使用缓存产品吗？
Would you consider the use of caching products in the category of data at rest?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
您会考虑在静态数据类别中使用缓存产品吗？
Would you consider the use of caching products in the category of data at rest?
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
接受 或继续使用网站，即表示您同意使用 Cookies 和您的相关数据。
发布评论
评论（3）
是的。 无论产品是什么，只要它存储、处理或传输支付卡数据，那么它就属于 PCI-DSS 的范围。
话虽如此，如果您的缓存设备仅存储加密数据并且无法访问用于解密的任何密钥，那么您应该能够同意您的 QSA 的意见，即它超出了您的评估范围。
如果它确实处理未加密的支付卡数据，或者它有权访问解密密钥，那么您将必须至少为缓存设备实施 PCI-DSS 控制的一个子集。
Yes. It doesn't matter what the product is, if it stores, processes or transmits payment card data then it is within scope of PCI-DSS.
Having said that, if your cacheing device only stores encrypted data and doesn't have access to any keys used for decryption then you should be able to agree with your QSA that it is out of scope for your assessment.
If it does handle unencrypted payment card data, or if it has access to decryption keys then you will have to implement at least a sub-set of the PCI-DSS controls for the cacheing devices.
这是一个复杂的问题，但任何保存超过 24 小时的内容都被视为“存储”，并且卡数据的处理方式受到严格控制 - 例如，没有 CV2。
但数据也必须在前往卡交易的途中，而不是在交易后的返回路径中。
您可能需要讨论您的具体示例，以及您关心的卡数据的哪些位与 QSA 的确切用途
This is a complex issue, but anything that is held for over 24 hours is considered as "storage" and is under strict controls about how card data is handled - No CV2 for example.
But you also the data must be on its way to the card transaction and not in the return path after the transaction.
You probably need to discuss your specific example and exactly what use of which bits of card data you are concerned about with your QSA
同意这很复杂，但根据我的理解，您可以从 PCI-DSS 中借鉴几个原则：
在我看来，如果您的缓存存储持卡人数据，则它违反了标准。 与数据存储（以及其他）相关的目的是将存储、使用、传输限制在敏感数据实际需要的地方。 如果没有您提供有关缓存内容的更多详细信息，我无法想象为什么您需要缓存敏感数据。
我当然同意 Cheekysoft 先生的观点，即您应该开诚布公地与您的 QSA 讨论，因为我相信他/她一旦了解细节将能够为您提供一些指导。
Agreed this is complex, but based on my understanding, there is a couple of principals you can draw from in PCI-DSS:
Its seems in my view that if your cache is storing card holder data, its going against the grain of the standard. The intention in relation to data storage (amoungst others) is to limit storage, use, transmission to only where actually required for sensitive data. Without further details from you on your cache content, I cant imagine why you need to cache sensitive data.
I certainly agree with Mr Cheekysoft in that you should be open and discuss with your QSA as I am sure he/she once enlightened on the details will be able to provide you with some guidance.