Contents
Are logs PII?
Log messages without addressing PCI and PII compliance Notice that the sensitive information in the request and response body is clearly visible to anyone who can gain access to the logs. PII information like name, property address, social security number is clearly visible.
What is PCI PII?
In the digital age, safeguarding digital data means adhering to strict guidelines that fall under two categories: PCI (payment card industry) and PII (personally identifiable information) compliance.
How do I get PII data?
How to Look for PII in Your Google Analytics
- Look for email addresses.
- Look for social security #’s.
- Look for addresses.
- Look for phone numbers.
- Look for names.
How to comply with PCI and PII requirements?
The request and response logs below address the PCI and PII requirements by masking or encrypting the relevant data. The sensitive data is no longer visible to anyone including developers who can gain access to the logs.
How does logging a PII data field work?
For logging PII data fields, we replace all the characters with a hash of the original value keeping the length of the string the same. We also allow the programmer to specify how many characters to show or keep without masking. For example, when we log the social security number, we do show the last 4 digits.
How are PCI and PII annotated in Java?
We created Java annotations for PCI, PII, and Mask as follows… We then annotate the request and response java model objects. We annotate the class with @Mask to indicate that the Java object has PCI and/or PII data fields in it. We then annotate the appropriate data fields with PII or PCI as shown below.
What kind of information is in a PII request?
Notice that the sensitive information in the request and response body is clearly visible to anyone who can gain access to the logs. PII information like name, property address, social security number is clearly visible.