PCI Glossary of Technical Terms

Process of converting information into a scrambled form except to holders of the proper cryptographic key. Using encryption protects information against unauthorized disclosure while it is encrypted.

Filters at the edge of a network that block traffic from coming into the network without permission, and block traffic from leaving the network without permission.

A merchant's legal business name as differentiated from the names of a company's principals or other entity that owns or manages the business. A DBA that is significantly different from the principals' or other entity's name can result in an unrecognizable merchant name, or descriptor, on a cardholder's monthly statement, which can in turn lead

Is an acronym for "Demilitarized Zone". It is a network added between a private and a public network to provide an additional layer of security for the private network.

Systems that are not used for 'real work', but for designed or building new solutions or programs. The idea is that if something goes wrong, the systems that are used for real work are not damaged or interfered with.

A computer system for storing and organizing information in a structured way. It can be a special program, or something simple like an Excel spreadsheet.

A piece of data exchanged between a web server and a web browser to maintain a session. Cookies may contain user preferences and personal information.

The rules on a firewall that tell it what traffic is 'good' (and is allowed) and what traffic is 'bad' (and is blocked).

An arrangement between a merchant and another company, generally an Internet Service Provider, in which the merchant is allowed to house its own computer and software at the company's location. The merchant generally manages its own computer, but benefits from other infrastructure and services at the company's location.

Security measures designed to make the user do the right thing on their computer. These cannot be trusted completely, which is why software developers need to also rely on server-side security controls.