PCI DSS Myths 2009: Myths and Reality

PCI DSS Myths 2009: Fiction and Reality Dr. Anton Chuvakin Security Warrior Consulting www.securitywarriorconsulting.com November 2009

Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object]

What is PCI DSS or PCI? ,[object Object],[object Object],[object Object],[object Object],[object Object]

PCI DSS is based on basic data security practices! ,[object Object],[object Object],Protect Cardholder Data ,[object Object],Maintain an Information Security Policy ,[object Object],[object Object],Regularly Monitor and Test Networks ,[object Object],[object Object],[object Object],Implement Strong Access Control Measures ,[object Object],[object Object],Maintain a Vulnerability Management Program ,[object Object],[object Object],Build and Maintain a Secure Network

Ceiling vs Floor ,[object Object],[object Object],[object Object],[object Object],[object Object]

M1 - PCI just doesn’t apply to us … ,[object Object],[object Object],Reality: PCI DSS DOES apply to you if you “ accept, capture, store, transmit or process credit and debit card data ”, no exceptions! At some point, your acquirer will make it clear to you!

M2 - PCI is confusing ,[object Object],[object Object],[object Object],Reality: PCI DSS documents explain both what to do and how to validate it; take some time to read and understand it. <- Also, read our book on PCI! 

M3 - PCI is too hard ,[object Object],[object Object],Reality: PCI DSS is basic, common sense, baseline security practice; it is only hard if you were not doing it before. It is no harder than running your business or IT – and you’ve been doing it!

M4 - Breaches prove PCI irrelevant ,[object Object],[object Object],Reality: Data breaches prove that basic PCI DSS security is not enough, but you have to start from the basics. PCI is actually easier to understand than other advanced security and risk matters. Start there!

M5 – PCI is Easy : Just Say “YES” ,[object Object],[object Object],Reality: Not exactly - you need to: a) Get a scan – and then resolve the vulnerabilities found b) Do the things that the questions refer to – and prove it c) Keep doing a) and b) forever!

M6 – My tool is PCI compliant ,[object Object],[object Object],[object Object],Reality: There is no such thing as “PCI compliant tool, network”, PCI DSS compliance applies to organizations . PCI DSS combines technical AND process, policy, management issues; awareness and practices as well.

M7 – PCI Is Enough Security ,[object Object],[object Object],Reality: PCI is basic security, it is a necessary baseline, but NOT sufficient (floor – not the ceiling!) PCI is also about cardholder data security , not the rest of private data, not your intellectual property, not SSNs, etc. It also covers confidentiality , and NOT integrity and availability. There is more to security than PCI!

M8 – PCI DSS Is Toothless ,[object Object],[object Object],Reality: Possible fines + lawsuits + breach disclosure costs + investigation costs + CC rate increases + contractual breaches + cost of more security measures + cost of credit monitoring = will you risk ALL that?

Summary: Eight Common PCI Myths ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Your Approach To PCI DSS ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Continuous Compliance vs Validation ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

PCI and Security Today ,[object Object],[object Object],[object Object],[object Object]

Conclusions and Action Items ,[object Object],[object Object],[object Object]

Get More Info! ,[object Object],[object Object],[object Object]

About Anton Chuvakin ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],For more: http://www.chuvakin.org

More on Anton ,[object Object],[object Object],[object Object],[object Object],[object Object]

Security Warrior Consulting Services ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

PCI DSS Myths 2009: Myths and Reality

PCI DSS Myths 2009: Myths and Reality

Recommended

More Related Content

What's hot

What's hot(17)

Similar to PCI DSS Myths 2009: Myths and Reality

Similar to PCI DSS Myths 2009: Myths and Reality(20)

More from Anton Chuvakin

More from Anton Chuvakin(20)

Recently uploaded

Recently uploaded(20)

PCI DSS Myths 2009: Myths and Reality