Replay Attack
PCIComplianceHubLast updated
A type of cyberattack in which an attacker intercepts and retransmits a valid message or session to gain unauthorized access or manipulate the system. Organizations must implement appropriate security measures, such as encryption and secure session management, to prevent replay attacks and maintain PCI DSS compliance.
Applies to. PCI DSS v4.0.1 names replay attacks in Requirement 8. 8.5.1 requires that the MFA system is not susceptible to replay attacks, and the assessor checks this against the vendor's system documentation rather than by attempting one. The other elements of 8.5.1 sit alongside it: no bypass without documented, time-limited management authorisation, at least two different factor types, and success of all factors before access is granted.
Limits. 8.5.1 is written about the MFA system, and its replay test is documentary (8.5.1.a examines vendor documentation). It says nothing about replay of payment messages, session tokens or API calls.
In PCI DSS v4.0.1. 8.5.1
Related. Multi-factor Authentication (MFA), Nonce, One-time Password (OTP), Authentication, Transport Layer Security (TLS)
Sources. PCI DSS v4.0.1 (June 2024)