As of June 30, 2015, which vulnerability becomes a formal requirement?

As of June 30, 2015, which vulnerability becomes a formal requirement?

• A. Insecure cryptographic storage
• B. Broken authentication and session management
• C. Improper error handling
• D. Buffer overflows

Answer: (A)

The concept being tested is how PCI DSS formalizes protections for cardholder data at rest. As of June 30, 2015, the standard explicitly requires using strong cryptography to protect stored cardholder data and to manage cryptographic keys securely, which makes insecure cryptographic storage a formal requirement. This focus on encryption and key management directly addresses the risk of data being read if storage is compromised. The other issues—broken authentication and session management, improper error handling, and buffer overflows—are important security concerns in general software development, but they are not the specific formal storage-protection requirement that PCI DSS had formalized at that date.

The concept being tested is how PCI DSS formalizes protections for cardholder data at rest. As of June 30, 2015, the standard explicitly requires using strong cryptography to protect stored cardholder data and to manage cryptographic keys securely, which makes insecure cryptographic storage a formal requirement. This focus on encryption and key management directly addresses the risk of data being read if storage is compromised. The other issues—broken authentication and session management, improper error handling, and buffer overflows—are important security concerns in general software development, but they are not the specific formal storage-protection requirement that PCI DSS had formalized at that date.