Our PCI compliance vendor requires that we disable all but RC4 encryption on our web server. Currently our apache config file looks like this: SSLHonorCipherOrder On SSLCipherSuite ...
PCI compliance requires annual rotation of keys. The definition of "rotation of keys" that I keep coming across is decrypting your data, then re-encrypting with a new key. Really? Everyone out there ...
For PCI-DSS compliance you have to disable weak ciphers. PCI-DSS permits a minimum cipher size of 128 bits. However for the highest score (0 I believe) you should only accept 168 bit ciphers but you ...