Which wireless control is explicitly prohibited?

• A. The use of WEP as a security control is prohibited.
• B. The use of WPA2 with AES is prohibited.
• C. The use of TLS for wireless is prohibited.
• D. The use of open authentication with no encryption is prohibited.

Answer: (A)

WEP is the wireless security control that PCI DSS explicitly prohibits because it is fundamentally insecure. WEP uses a weak encryption scheme with a short, fixed initialization vector that can be reused, making it vulnerable to practical attacks that can decrypt traffic and reveal the encryption key. This means wireless transmissions protected only by WEP can be cracked quickly, exposing cardholder data.

In contrast, WPA2 with AES (CCMP) provides strong, modern protection and is an accepted standard for securing wireless networks handling payment data. TLS is a separate security protocol used to protect data in transit, not a wireless access control method, so it isn’t the type of wireless control being evaluated here. Open authentication with no encryption offers no protection at all, which PCI also forbids for transmitting sensitive data, but the item specifically points to WEP as the prohibited wireless control.