Card numbers are needed for analysis, but the original numbers must not be stored in the analytics environment.
Only an authorized payment service may restore the original.
Which protection approach is most appropriate?
Replace the number with a token and isolate the mapping table and detokenization permission.
Detailed explanation
Analytics uses only the token while the original remains in a restricted service.
Analytics uses only the token while the original remains in a restricted service.
Base64 is reversible encoding, not confidentiality protection.
Base64 is reversible encoding, not confidentiality protection.
Object listings and logs can expose the value.
Object listings and logs can expose the value.
An audit identifier neither protects nor consistently represents the payment value.
An audit identifier neither protects nor consistently represents the payment value.
Check official documentation
Compare the following points with the official documentation.
AWS tokenization、Amazon Macie sensitive data、KMS encryptionの公式説明を確認する。
What to confirm
Base64・ハッシュと、復元主体を限定するトークン化の違いを説明できる。
Key points
- Tokenization
- Mapping table
- PCI DSS
- Detokenization
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Re-identification
Limit the restore API, principal, and audit events and do not share the mapping key.
Retention
Coordinate deletion of originals, mappings, and backups with legal requirements.