What is an Untrusted Network?

• A. Internal network that the organization fully controls.
• B. Network external to the organization and out of its control.
• C. Network used only for development and testing.
• D. Wireless network with open access.

Answer: (B)

Untrusted networks are networks outside your organization’s security boundary that you don’t control. They’re the public Internet or other networks operated by third parties where you don’t manage infrastructure or security settings. That’s exactly what the option describes: a network external to the organization and out of its control.

The internal network is controlled by your organization, so it’s considered trusted. A development and testing network can be internal or otherwise controlled, so it isn’t inherently untrusted. A wireless network with open access might be untrusted, but openness isn’t the defining factor; untrusted applies whenever you don’t control the network and can’t rely on its protections. In PCI DSS, transmitting cardholder data over untrusted networks requires strong encryption and other safeguards.