Data Protection, Encryption, and Key Management in the Cloud
Data Protection, Encryption and Key Management in the Cloud
This domain tests whether you can render PAN unreadable, protect it in transit, and prove that the keys are under your control.
Requirement 3 requires PAN at rest to be rendered unreadable with strong cryptography and associated key-management processes (3.5.1), or by hashing, truncation or tokenization (3.4.1). Requirement 4.2.1 requires strong cryptography for PAN in transit over open, public networks. Disk- or partition-level encryption alone is not accepted as rendering PAN unreadable, because anyone with host access reads plaintext.
Cloud specifics: use envelope encryption - a KMS or HSM key-encryption key wraps per-object data keys; the module should be a FIPS 140-2 or 140-3 validated cryptographic module. Key custody drives scope: if keys live in your own KMS or HSM with policies the provider's administrators cannot bypass, the provider never sees plaintext. Requirement 3.6 covers key-management processes including split knowledge and dual control, and 3.7 requires documented key-management policies. Separate the key administrator role from the workload role, rotate keys, and log every decrypt.
Worked example. PAN sits in an object store encrypted with a customer-managed KMS key. Developers hold kms:Decrypt through the application role and kms:* through an admin role in the same account. The assessor flags a key-management gap: the people who can change the application can also grant themselves decryption, so there is no separation of duties and no dual control. Remedy: move key administration to a separate account, restrict the key policy to named workload roles, enable rotation, alert on policy changes, and retain key-usage audit logs as evidence. Reasoning: PCI cares about who can use and manage keys, not merely that ciphertext exists.
Traps. TLS terminated at the load balancer with plaintext trusted internally and no segmentation justification; default provider-managed keys with no visibility into policy or rotation; treating "encrypted" as licensing indefinite retention; skipping key rotation and custodian acknowledgment.