PCI DSS-based Security: Is This For Real? by Dr. Anton Chuvakin

PCI DSS-based Security: Is This For Real?Using PCI DSS as A Foundation for Your Security Program,[object Object],Dr. Anton Chuvakin,[object Object],Author of “PCI Compliance”,[object Object],http://www.pcicompliancebook.info,[object Object],Security Warrior Consulting,[object Object],www.securitywarriorconsulting.com,[object Object],Secure 360, Minneapolis, MN,[object Object],May 2010,[object Object]

Inspiration….,[object Object],“Too many have lost sight of goal which is to reduce the risk of security breaches and card fraud. Assessors often just focus on the words in the standard. They do not understand WHY the standard was written, or the risk built into it. “,[object Object],PCI Knowledge Base by late David Taylor,[object Object]

“PCI Is The Devil !!!”,[object Object]

Outline,[object Object],What is PCI DSS? Why it is here?,[object Object],PCI DSS as a security framework,[object Object],PCI DSS as a data security framework,[object Object],Starting from PCI: how to do it?,[object Object],Risks and pitfalls,[object Object]

What is PCI DSS or PCI?,[object Object],Payment Card Industry Data Security Standard,[object Object],Payment Card = ,[object Object],Payment Card Industry = ,[object Object],Data Security = ,[object Object],Data Security Standard = ,[object Object]

PCI Data Security Standard,[object Object],PCI Council publishes PCI DSS –Data Security Standard,[object Object],Outlined the minimumdata security protections measures for payment card data.,[object Object],Defined Merchant & Service Provider Levels, and compliance validation requirements.,[object Object],Left the enforcement to card brands (Council doesn’t fine anybody!),[object Object],Key point: PCI DSS (document) vs PCI (validation regime),[object Object]

PCI Game: The Players,[object Object],PCI Security Standards Council,[object Object]

My Data – Their Risk!?,[object Object],*I* GIVE *YOU* DATA,[object Object],*YOU* LOSE IT,[object Object],*ANOTHER* SUFFERS!,[object Object]

Do not use vendor-supplied defaults for system passwords and other security parametersBuild and Maintain a Secure Network,[object Object],[object Object]

Encrypt transmission of cardholder data and sensitiveinformation across public networksProtect Cardholder Data,[object Object],[object Object]

Develop and maintain secure systems and applicationsMaintain a Vulnerability Management Program,[object Object],[object Object]

Assign a unique ID to each person with computer access

Restrict physical access to cardholder dataImplement Strong Access Control Measures,[object Object],[object Object]

Regularly test security systems and processesRegularly Monitor and Test Networks,[object Object],[object Object],Maintain an Information Security Policy,[object Object],PCI Data Security Standard In-Depth,[object Object]

PCI DSS Coverage,[object Object],… in no particular order:,[object Object],Security policy and procedures,[object Object],Network security,[object Object],Malware protection,[object Object],Application security (and web),[object Object],Vulnerability scanning and remediation,[object Object],Logging and monitoring,[object Object],Security awareness,[object Object]

PCI DSS With No Cards?,[object Object]

PCI Coverage: What Do We Learn?,[object Object],Focus: confidentiality credit of card data…,[object Object],… but not exactly: data avoidance is even better!,[object Object],Now …,[object Object],… a hard question: what is “a good security program”? ,[object Object],What technology, processes, etc?,[object Object],What are the goals?,[object Object],What are the metrics?,[object Object]

Holes?,[object Object],BIG HOLE#1 Everything availability,[object Object],“If your payment app blows up, it magically becomes ‘PCI compliant’” ,[object Object],HOLE #2 Everything productivity,[object Object],Spam, web filtering, client protection, etc,[object Object],HOLE #3 Card data discovery,[object Object],PCI assumes omniscient data owners…,[object Object]

Sidetrack: WTH is “Data Security”,[object Object],… back to ,[object Object],If you router is 0wned, is data security still achieved?,[object Object],If a secondary system is compromised?,[object Object],QA machine?,[object Object],Public web server?,[object Object],Know any “data idiots?”,[object Object]

Pros and Cons,[object Object],Pros:,[object Object],Good coverage of many domains (tech and process),[object Object],Useful focus on data elimination, app security and monitoring,[object Object],Detailed guidance available,[object Object],A lot of tools available to help,[object Object],Lacks complexity of ISO, NIST, etc,[object Object],Cons:,[object Object],[object Object]

Lack of logical structure (but Prioritized Approach is there)

“Kill the data” focus doesn’t apply to some

Measuring success?!,[object Object]

OK, Diving In…,[object Object]

Phase 1 Understanding,[object Object],Read PCI DSS and Prioritized Approach,[object Object],Organize into domains,[object Object],Split technology requirements from process/policy/procedure,[object Object],Mind the holes!,[object Object],Also: think about other regulations, e.g. breach disclosure laws,[object Object]

Holes? What Holes?,[object Object]

Phase 2 Plan,[object Object],Gaps?,[object Object],Policy/process gap,[object Object],Technology gap,[object Object],Anything to buy? Build? Outsource?,[object Object], “Close the gap” strategy,[object Object],Guidance: PCI SSC “Prioritized Approach”,[object Object],“Reverse PCI”: start from Req 12 “Policy “,[object Object],Coordinate with stakeholders,[object Object]

Scope Explodes!,[object Object],Key lesson in PCI compliance: ,[object Object],SHRINK THE SCOPE! “Drop the data”,[object Object],Here we expand the scope to all data and even all systems.,[object Object]

Phase 3 Do it!,[object Object],Following the prioritized plan, start building ,[object Object],If under actual PCI regime, start from payment networks [of course!],[object Object],Adjust! You are not “praying to PCI gods”,[object Object],Q: Can I use ISO27001 instead?,[object Object],A: Sure, but you would not be reading this if you had this choice!,[object Object]

Phase 4 Run it!,[object Object],Ongoing tasks in PCI:,[object Object]

PCI DSS-based Security: Is This For Real? by Dr. Anton Chuvakin

PCI DSS-based Security: Is This For Real? by Dr. Anton Chuvakin

Recommended

More Related Content

What's hot

What's hot(20)

Viewers also liked

Viewers also liked(20)

Similar to PCI DSS-based Security: Is This For Real? by Dr. Anton Chuvakin

Similar to PCI DSS-based Security: Is This For Real? by Dr. Anton Chuvakin(20)

More from Anton Chuvakin

More from Anton Chuvakin(20)

Recently uploaded

Recently uploaded(20)

PCI DSS-based Security: Is This For Real? by Dr. Anton Chuvakin

Editor's Notes