Which issue is covered by PCI DSS Requirement 6.5.3?

Which issue is covered by PCI DSS Requirement 6.5.3?

• A. Insecure communications
• B. Insecure cryptographic storage
• C. Cross-site scripting (XSS)
• D. Improper error handling

Answer: (B)

The main idea here is how sensitive data is protected when it is stored. PCI DSS 6.5.3 focuses on insecure cryptographic storage—the risk that data is kept in plaintext, encrypted with weak methods, or with poor key management. The requirement is about making sure that the software and the processes around it use strong, standard cryptographic protections for data at rest, and that cryptographic keys are handled securely (not hard-coded, rotated appropriately, access-controlled, and protected by secure modules). In practice, this means if an application stores cardholder data or other secrets, the storage must use strong encryption with proper key management. It also means avoiding situations where data is stored without adequate protection or with weak cryptography that could be broken if accessed. Why the other concerns aren’t the focus here: insecure communications deals with data in transit, while issues like cross-site scripting or improper error handling pertain to how the application behaves during use, not specifically how data is stored cryptographically.

The main idea here is how sensitive data is protected when it is stored. PCI DSS 6.5.3 focuses on insecure cryptographic storage—the risk that data is kept in plaintext, encrypted with weak methods, or with poor key management. The requirement is about making sure that the software and the processes around it use strong, standard cryptographic protections for data at rest, and that cryptographic keys are handled securely (not hard-coded, rotated appropriately, access-controlled, and protected by secure modules).

In practice, this means if an application stores cardholder data or other secrets, the storage must use strong encryption with proper key management. It also means avoiding situations where data is stored without adequate protection or with weak cryptography that could be broken if accessed.

Why the other concerns aren’t the focus here: insecure communications deals with data in transit, while issues like cross-site scripting or improper error handling pertain to how the application behaves during use, not specifically how data is stored cryptographically.