|
This online help file is for EFT Server version 6.2.x. For other versions of EFT Server, please refer to http://help.globalscape.com/help/index.html. (If the Index and Contents are hidden, click Show Contents pane in the top left corner of this topic.) |
From the PCI DSS:
Sensitive information must be encrypted during transmission over networks that are easily accessed by malicious individuals. Misconfigured wireless networks and vulnerabilities in legacy encryption and authentication protocols can be continued targets of malicious individuals who exploit these vulnerabilities to gain privileged access to cardholder data environments.
PCI DSS Requirement |
How Requirement is Addressed with EFT Server |
4.1 Use strong cryptographic ciphers for transport protocols |
EFT Server provides secure protocols such as secure sockets layer (SSL), transport layer security (TLS), and SFTP (SSH2) for data transmission. For HS-enabled sites, the PCI DSS HS limits SSL versions to v3 or higher, and ciphers to minimum of 128 bits. EFT Server can also force secure data transmission by automatically redirecting incoming HTTP traffic to HTTPS. |
4.2 Never send unencrypted PANs by e-mail. |
It is up to the administrator to ensure that PAN data is not included in user-generated e-mails sent by EFT Server. EFT Server system-generated messages have no way of including PAN data in the body of the e-mail message. |