What does requirement 8.2 require regarding credentials?

What does requirement 8.2 require regarding credentials?

• A. Render credentials unreadable during transmission and storage
• B. Store credentials in plaintext
• C. Use symmetric encryption only
• D. Do not encrypt at all

Answer: (A)

Protecting credentials means ensuring they cannot be read by anyone who isn’t authorized. Requirement 8.2 asks you to render credentials unreadable during both transmission and storage. In practice, this means encrypting data as it moves across networks (like using TLS) and protecting stored credentials with strong cryptographic measures (for passwords, this often involves hashing with salt, and for other secrets or keys, encrypting them with protected keys and proper key management). The goal is that even if data is captured or accessed, the information remains unintelligible to unauthorized parties. Storing credentials in plaintext, relying only on symmetric encryption without broader protection, or not encrypting at all would fail to meet this requirement because they leave sensitive data readable or vulnerable.

Protecting credentials means ensuring they cannot be read by anyone who isn’t authorized. Requirement 8.2 asks you to render credentials unreadable during both transmission and storage. In practice, this means encrypting data as it moves across networks (like using TLS) and protecting stored credentials with strong cryptographic measures (for passwords, this often involves hashing with salt, and for other secrets or keys, encrypting them with protected keys and proper key management). The goal is that even if data is captured or accessed, the information remains unintelligible to unauthorized parties.

Storing credentials in plaintext, relying only on symmetric encryption without broader protection, or not encrypting at all would fail to meet this requirement because they leave sensitive data readable or vulnerable.