Using Edge Processor to mask or truncate cardholder data for PCI DSS compliance

Learn PCI DSS requirements

PCI DSS requirement 3 states that cardholder data elements like the primary account number (PAN), cardholder name, service code, and expiration date must be protected whenever they are stored, transmitted, or processed. This is in contrast to other sensitive authentication data elements like full magnetic stripe data, card verification value (CVV2), card validation code (CVC2), and card identification number (CID), as well as the PIN/PIN block. Storage of those elements is not permitted, even if encrypted.

In this example, we'll explore how to mask or truncate the PAN to comply with the requirement that this data is protected whenever it is stored, transmitted, or processed.

Whether you decide to truncate or mask the PAN depends on how the data is being used. You should truncate the PAN if you're only storing the data, whereas if you're looking to display the PAN, you'd mask it instead. The requirement and implementation practices for each are:

• Truncation
  • Requirement: Truncate PAN for storage.
  • Implementation: Retain only the last four digits of the PAN and remove the middle six digits (e.g. XXXX-XXXX-XXXX-0123).
• Masking
  • Requirement: Mask PAN for display.
  • Implementation: Ensure that systems and processes are configured to display only the first six and last four digits of the PAN, masking the digits in between (for example, 0123-45XX-XXXX-2345.

After you've identified the data that needs to be masked or truncated, you can begin to build your pipeline.

Build the pipeline

1. Ensure that the correct source types are available for identifying card data. The table below outlines recommended source types, associated fields, and typical data sources for credit card data across financial applications.

   Suggested source type	Fields	Sources
   cc_transaction_logs	cc_number, pan_number, cc_type, ccv, expiry_data, pin, pin_block, transaction_type, cardholder_name, track1, track2, track3	Payment gateways Stripe, PayPal, Clover Banking systems Core banking platforms E-commerce platforms Shopify, Magento Point of Sale (POS) systems Retail transaction systems

2. Create an SPL2 pipeline to truncate or mask the data before it's stored or displayed. The pipeline below takes in credit card transaction data, does a regex match on the PAN to confirm that the data matches a known format (for example, Amex, Visa, or Mastercard credit card number formats), and drops those fields. After dropping fields from the data ingested, the pipeline then sends the cleaned data to an index in Splunk Cloud Platform.

   Pipeline definition (SPL2)

   $source

   function process_pan($source, $display: boolean = false) { return | from $source | eval pan_regex = case( cc_type == "Visa" or cc_type == "MasterCard" or cc_type == "UnionPay", "^[0-9]{16}$", cc_type == "Discover", "^[0-9]{17}$", cc_type == "AMEX", "^[0-9]{15}$" ) | eval cc_regex = case( cc_type == "Visa" or cc_type == "MasterCard" or cc_type == "UnionPay", "^[0-9]{4}[- ]?[0-9]{4}[- ]?[0-9]{4}[- ]?[0-9]{4}$", cc_type == "Discover", "^[0-9]{4}[- ]?[0-9]{4}[- ]?[0-9]{4}[- ]?[0-9]{4}[- ]?[0-9]{1}$", cc_type == "AMEX", "^[0-9]{4}[- ]?[0-9]{6}[- ]?[0-9]{5}$" ) | eval is_pan_valid = if(pan_regex != "", match(pan_number, pan_regex), 0) | eval is_cc_valid = if(cc_regex != "", match(cc_number, cc_regex), 0) | where is_pan_valid=="True" or is_cc_valid=="True" | eval mask_pattern = case( (cc_type == "Visa" or cc_type == "MasterCard" or cc_type == "UnionPay") and $display, "^([0-9]{4}[- ]?[0-9]{2})[0-9]{4}([- ]?[0-9]{4})$", (cc_type == "Visa" or cc_type == "MasterCard" or cc_type == "UnionPay") and not $display, "^([0-9]{4}[- ]?)[0-9]{8}([- ]?[0-9]{4})$", cc_type == "Discover" and $display, "^([0-9]{4}[- ]?[0-9]{2})[0-9]{5}([- ]?[0-9]{4})$", cc_type == "Discover" and not $display, "^([0-9]{4}[- ]?)[0-9]{9}([- ]?[0-9]{4})$", cc_type == "AMEX" and $display, "^([0-9]{4}[- ]?[0-9]{2})[0-9]{4}([- ]?[0-9]{5})$", cc_type == "AMEX" and not $display, "^([0-9]{4}[- ]?)[0-9]{6}([- ]?[0-9]{5})$" ) | eval masked_value = if(mask_pattern != "", replace(cc_field, mask_pattern, if($display, "$1XX-XXXX$2", "XXXX-XXXX-XXXX$2")), cc_field) | eval cc_field = masked_value | fields - is_pan_valid, is_cc_valid, pan_regex, cc_regex, mask_pattern, masked_value } $pipeline = | from $source | process_pan display=false | eval index="cc_transactions_index" | into $destination;

   sourcetype= cc_transactions

   The SPL2 above contains the following parameters:

   • $source - implicit; takes input from the preceding pipe.
   • $display - Boolean tunable parameter that controls whether the PAN data should be truncated or masked.
     • True - Apply masking if PAN data will be stored and displayed.
     • False - Apply truncation if PAN data will only be stored.

   The allowed credit card formats by card type are:

   • 15-digit card variations for Amex
   • 16-digit card variations for Visa, Mastercard, Discover, and UnionPay

   Your final pipeline should look like this:

   

3. After you have constructed your pipeline, follow these instructions to save and apply your pipeline:
   1. Test your pipeline rule. In the top right corner of the screen, click the blue Preview button.
   2. Set the Data destination to the appropriate index, for example: cc_transactions_index.
   3. To save the destination, click Apply.
   4. In the top right corner of the screen, click Save pipeline.
   5. Give your pipeline a suitable name, for example: cc_transactions_pci_clean_storage.
   6. To save your pipeline, click Save.
   7. To try out the new pipeline, click Pipelines on the top left of the page.
   8. Locate the pipeline you just created, click the three dots next to your new pipeline, and select Apply/remove.
   9. Select the Splunk Edge Processor you created earlier and click Save. You will see a brief message stating that your changes are being saved.

Test the pipeline

To verify that your pipeline has been successfully applied:

1. Log into the Splunk platform and open the Search app.
2. Run the following search and verify that you see the events coming from this pipeline:

   index=cc_transactions_index sourcetype=cc_transactions

3. Verify that no prohibited cardholder data elements (for example, full PAN, or unmasked numbers) appear in the results. Cross-check with the pipeline rules you implemented to ensure compliance.

Monitor data ingestion

To ensure your data ingestion pipelines comply with PCI DSS requirements, it is critical to perform ongoing monitoring. You should regularly review data metrics to ensure that incoming and outgoing data aligns with expected volumes and formats. For more information, see Monitor system health and activity for Edge Processor.

Next steps

To enhance your use cases and maintain compliance, the Splunk App for PCI Compliance with Splunk Enterprise or Splunk Enterprise Security can assist in addressing challenges related to PCI audits. This app, developed and supported by Splunk, is designed to help organizations meet PCI DSS 4.0 requirements. It evaluates and monitors the effectiveness and current status of PCI compliance technical controls in real-time. Additionally, it can identify and prioritize control areas that might need attention, allowing you to promptly address auditor reports or data requests.

The Splunk App for PCI Compliance provides businesses with the advanced tools to meet PCI DSS requirements and automate monitoring. As cyber threats change, utilizing the Splunk platform means being ready for any challenge while maintaining compliance.

In addition, these resources might help you understand and implement this guidance:

• Demo: Splunk PCI App Demo
• Lantern: Using Splunk Enterprise Security to ensure PCI compliance
• Lantern: Auditing with the Splunk App for PCI Compliance