PCI: The Real Deal
How to do PCI Right
(And how to really hose it up)
Branden R. Williams, CISSP, CISM
bwilliams@verisign.com
www.brandenwilliams.com

Why companies succeed
What are the steps to success?

PCI Requires Planning
Programmatic approach
Fully staffed compliance office
Trained and/or certified
Must be baked into culture

Getting it RIGHT
Medium sized service
provider
Assessment scope
less than 1% of
systems
On-Site Assessment
done in 1 week
No gaps last three
years

How do they do it?
Simple & elegant
payment systems
Complex ≠ Competitive
Advantage
Simplicity+Elegance =
Competitive Advantage
Go into assessment
knowing you will pass

Good Program Makeup
Documented Data Flows
Accountability
Documentation
Plan for Maintenance
Process Integration
Training
Assessment Prep/Self Assessment

Why companies fail
Avoid these pitfalls!

Getting it wrong
Medium US-Based
Retail
< 1000 locations
Fail every year
But remediate in 60 days
Out of compliance for
most of year
Risk breach in
between

Getting it wronger
No repeatable processes
Compliance viewed as “audit”
Security/Compliance office buried
All reporting to IT?
CISO unable to sell MGT
Process stagnates

How could we improve?
Build a program to MAINTAIN PCI
Security reporting elsewhere
CFO
HR
Legal
CISO take a business need
Audit results

What are secure
companies doing?

Encrypt all stored data
What are my options?
Retrofit applications
Use an encryption appliance
Use an encrypting database
Render unreadable withoutencryption (truncation, hashing)
The Dangers of Encryption
Enterprise-Wide Approach
Create a sound strategy
Data flows required!

Hashing/Rainbow Tables
What is the risk of Hashing?
Hashed Data = Cardholder Data. Wait… What?
Hashes must be treated like encrypted card data
Hashing is still a viable method!
Watch other data stored nearby
What is a Rainbow Table?
Subvert complex math
Orange vs. Juice
Pre-computed hashes
Secrecy in Salt/Algorithm

Truncation
What is Truncation?
Remove all but First 6, Last 4
Identify any transaction
First 6, Last 4
Date/Time of Purchase
Amount
Auth Code

Who does what?

What is on the horizon?
What does the future hold?

Fees, Fines, and
Penalties, OH MY!
Cost of assessments rising (Q/A)
Global Fines in 18 months
Payment App Mandates
Scrutiny of Assessments

High Tech Payments
SIM Based Payments
PED Encryption
Chip/PIN (BUSTED)
RFID/Contactless
Examples!

Discuss Breaches

Questions & Answers
Branden R. Williams, CISSP, CISM
bwilliams@verisign.com
www.brandenwilliams.com