There's a lot of talk about Tokenization and Encryption with data security. But what is the difference between Tokenization and Encryption, and which method provides better protection? First, let's define both terms. Then compare the two methods to help you decide whether using tokenized or encrypted cardholder data will meet your needs.
Tokenization
Tokenization is a process that substitutes a sensitive data element with a non-sensitive equivalent, referred to as a token , that has no extrinsic or exploitable meaning or value. The token is a reference key used to retrieve the original sensitive data when needed for further processing within the security domain. This means data being protected by tokenization is rendered useless to anyone who accesses it outside of the tokenization system.
Tokenized data elements can be replaced by a reference, such as a token or string of characters, that points to the actual value in a database table. Tokenizing refers to replacing sensitive data (like an account number) with tokens (like "TOKEN987654321") that cannot be reverse-engineered back to their original values. This means successful hackers can't steal card data without also having the tokenization system, which immediately renders stolen data pointless for fraudulent purposes.
Encryption
Encryption is a process of changing information into an unreadable format (a cipher) by using an algorithm (a cipher key) to modify the data . The information can be returned to its original format (decrypted) when needed. Encryption is used in many ways; you may have seen an encrypted email or received a file transmission that has been encrypted.
Encryption works by using mathematical algorithms to scramble, encode and decode data. Just like in tokenization, data is useless when it's encrypted. But unlike tokenization, encryption protects sensitive data at rest and in transit by using a single key to encrypt the data and a different key to decrypt it.
What is better - Tokenization or Encryption?
Data security professionals have long debated whether tokenization or encryption is a more effective method for protecting sensitive data. Each has its own benefits and drawbacks, as well as different levels of PCI compliance that must be considered.
Tokenization
In order to break the encrypted code, you need both the password and cryptographic key . In contrast, tokenization relies on a possession factor where hackers must have access to both the outside encryption system and the tokens within it in order to exploit them. Tokenization relies on a token value that is mathematically related to the original sensitive data, but not identical.
If a hacker were able to extract encrypted data without the key or tokenization system, the stolen data would be limited in usability. If an attacker gains access to a database containing encrypted cardholder data, the only thing they will find is a token – useless without the tokenization system.
Encryption
In contrast, encryption protects sensitive data by using a single key to both encrypt and decrypt the data . This makes it possible for hackers who steal encrypted data to exploit stolen information. Encryption uses a mathematical algorithm to transform data into an unreadable format. Decryption requires the use of the encryption key . This means that without the encryption key, encrypted data is useless because it cannot be decrypted.
Is tokenization or encryption better for protecting sensitive cardholder data?
There are several factors businesses should consider in order to determine which method of data protection, tokenization or encryption, is the best fit for their particular environment. There are compliance standards to consider as well as security concerns related to whether tokenization or encryption provides better overall protection of sensitive cardholder data.
