Certified Information Systems Auditor (CISA) — Question 1370

What is the BEST method for securing credit card numbers stored temporarily on a file server prior to transmission to the downstream system for payment processing?

Answer options

• A. Masking the full credit card number
• B. Encryption with strong cryptography
• C. Truncating the credit card number
• D. One-way hash with strong cryptography

Correct answer: B

Explanation

Encryption with strong cryptography (B) is the best method as it secures the credit card data in such a way that it cannot be easily accessed or understood without the proper decryption key. Masking (A) can obscure data but does not provide strong security, while truncating (C) removes parts of the number and may not be sufficient for security. A one-way hash (D) is not suitable here because it does not allow for the retrieval of the original credit card number, which is necessary for processing payments.