SISA\'s PCI DSS implementation workshop and importance.

1. ® SISA and CPISI logo are the registered Trademarks of SISA Information Security
PCI Implementation Workshop
(India, Bahrain, Kuwait, United Kingdom, Malaysia, Singapore, Taiwan, Dubai,
United States)
© 2010 by SISA Information Security page 1

2. SISA Background
 SISA : Information Security Specialists
 Three Competency Centers namely Consulting, Training
and Products. Fifteen Intellectual Property Rights in
Information Security Space.
 Headquartered in India with subsidiaries in Delaware-USA,
Kula Lumpur-Malaysia, Manila-Philippines and Bahrain.
 Customer Footprint in over 21 Countries spread across
Banks, Information Technology, Insurance, Telecom and
Retail.
 Recognized by CERT India as specialist Information
Security firm.
 PCI Compliance - first M-Commerce, first BPO, first Bank in CEMEA, first Bank in Asia, first
Merchant in Asia, etc. Over 23 Banks for PCI in Middle East, Certify the payment brand company ….

3. Competency Matrix
Consulting Training Products
• PCI QSA Validation Services (PCI-DSS) •OCTAVE (SEI-CMU) Security Risk Assessment •SMART-RA.COM
• PCI ASV Scanning Services (PCI-DSS) Workshop •MANAGEPCI.COM
• PA QSA Validation Services (PA-DSS) •Information Security Risk Assessment •DDT (Data Discovery Tool)
• PCI Assurance Services (SAQ) workshop (CISRA) •SISASMART IT-GRC
• Risk Assessment (IS-RA) •PCI DSS Implementation Workshop (CPISI) •SISASMART Audit Management Tool
• Privacy and Standards Compliance (ISO •ISO 27001 Implementation Workshop •SISASMART Survey Management
27001, GLBA, HIPAA, DPA, COBITFISMA, BS •Business Continuity Management Workshop
25999) •Secure Coding in Dot-Net
• Application Pen Test and Code Review •Awareness Sessions
• Network VA and Pen Test
• Forensics

4. Payment Card Industry Actors –
“Card Present”
Issuing Processor
Acquire. Processor
Issuer
Acquirer (Merchant
Bank)
Cardholder
Merchants

5. Payment Card Fraud Evolution
1983 Re-embossed counterfeit fraud
1988 Re-encoded counterfeit fraud
1989 Card not present fraud/ fraud applications
1991 Never received issued fraud
1992 Merchant fraud
1994 Identity Theft
2000 Skimmed counterfeit
2002 Communications interception
Now Server Hacking/ E-Business Merchant server hacking/
Chip sniffing and card counterfeit/ Fake terminals
Future ????

6. Compliance Requirement Shared
by All Payment Brands
• Any Entity that stores, processes and/or transmits
Account Data must comply with the PCI Data Security
Standard (DSS). Account Data consists of cardholder
data and sensitive authentication data
• Entities include, but are not limited to:
– Merchants
– Acquirers
– Service Providers
– Trusted Third Parties
• Each brand has their own set of compliance
requirements based on this general requirement.
- Requirements for validation of compliance vary
by payment brand.
© 2010 by SISA Information Security page 6

7. Join SISA’s PCI DSS Implementation Workshop
And be Certified as CPISI(Certified Payment Card Industry Security Implementer).
Mail at: manish.m@sisa.in/ training@sisa.in
Reach Me at: +91-9538923863
Regards: Manish Mahapatra
Assistant Manager
SISA Information Security(P) Ltd.
© 2010 by SISA Information Security page 7