Downloaded 264 times
Uploaded byAlienVault
PCI DSS Simplified: What You Need to Know
The document outlines key strategies for achieving PCI DSS compliance, emphasizing the importance of asset discovery, vulnerability assessment, and threat detection. It highlights essential practices such as maintaining effective security configurations, employing threat intelligence, and automating compliance processes. Additionally, it introduces AlienVault's Unified Security Management as a comprehensive solution for managing compliance and security needs in a streamlined manner.
More Related Content
Similar to PCI DSS Simplified: What You Need to Know
![[BDD 2025 - Full-Stack Development] Agentic AI Architecture: Redefining Syste...](https://cdn.slidesharecdn.com/ss_thumbnails/fs-agenticaiarchitectureredefiningsystemcommunication-251124030838-e6c70cc2-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Mobile Development] Exploring Apple’s On-Device FoundationModels](https://cdn.slidesharecdn.com/ss_thumbnails/md-exploringappleson-devicefoundationmodels-251124030840-d690542c-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Full-Stack Development] PHP in AI Age: The Laravel Way. (Rizqy Hi...](https://cdn.slidesharecdn.com/ss_thumbnails/fs-phpinaiagethelaravelway-251125012602-ef9d330e-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Mobile Development] Mobile Engineer and Software Engineer: Are we...](https://cdn.slidesharecdn.com/ss_thumbnails/md-mobileengineerandsoftwareengineerarewestillrelevantsidiqpermana-251127010650-55224ef1-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Full-Stack Development] Digital Accessibility: Why Developers nee...](https://cdn.slidesharecdn.com/ss_thumbnails/fs-digitalaccessibilitywhydevelopersneedtoknowandcarein2025-251127011019-0674441d-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Full-Stack Development] The Modern Stack: Building Web & AI Appli...](https://cdn.slidesharecdn.com/ss_thumbnails/fs-themodernstackbuildingwebaiapplicationswithserverless-251124030844-388cf04f-thumbnail.jpg?width=640&height=640&fit=bounds)
PCI DSS Simplified: What You Need to Know
- 1. PCI DSS SIMPLIFIED: WHATYOU NEED TO KNOW Sandy Hawke, CISSP VP, Product Marketing @sandybeachSF Tom D’Aquino Technical Lead
- 2. AGENDA 2 Common challenges Pre-audit checklist Corecapabilities for PCI Automation & consolidation Product Demo Key Takeaways Q & A
- 3. SETTING THE STAGE… Pre-auditchecklist & more
- 7. QUESTIONS TO ASKYOURSELF… SOONER RATHER THAN LATER. Pre-audit checklist: Where do your PCI-relevant assets live, how are they’re configured, and how are they segmented from the rest of your network? Who accesses these resources (and the other W’s… when, where, what can they do, why and how)? What are the vulnerabilities that are in your PCI-defined network – app, etc? What constitutes your network baseline? What is considered “normal/acceptable”? Ask your team… What do we NEVER want to happen in our PCI environment? How do we capture those events when they do happen? 7
- 8. FRENEMIES: SECURITY ANDCOMPLIANCE 88
- 9. SO…. WHAT DO INEED FOR PCI-DSS?
- 10. Piece it all together Lookfor strange activity which could indicate a threat Start looking for threats Identify ways the target could be compromised What do we need for PCI- DSS? Figure out what is valuable 10
- 11. Piece it all together Lookfor strange activity which could indicate a threat Start looking for threats Identify ways the target could be compromised What do we need for PCI- DSS? 11 Asset Discovery Asset Discovery • Active Network Scanning • Passive Network Scanning • Asset Inventory • Host-based Software Inventory
- 12. Piece it all together Lookfor strange activity which could indicate a threat Start looking for threats What do we need for PCI- DSS? 12 Asset Discovery Asset Discovery • Active Network Scanning • Passive Network Scanning • Asset Inventory • Host-based Software Inventory Vulnerability Assessment Vulnerability Assessment • Network Vulnerability Testing
- 13. Piece it all together Lookfor strange activity which could indicate a threat What do we need for PCI- DSS? 13 Asset Discovery Asset Discovery • Active Network Scanning • Passive Network Scanning • Asset Inventory • Host-based Software Inventory Vulnerability Assessment Vulnerability Assessment • Network Vulnerability Testing Threat Detection • Network IDS • Host IDS • Wireless IDS • File Integrity Monitoring Threat Detection
- 14. Piece it all together Whatdo we need for PCI- DSS? 14 Asset Discovery Asset Discovery • Active Network Scanning • Passive Network Scanning • Asset Inventory • Host-based Software Inventory Vulnerability Assessment Vulnerability Assessment • Network Vulnerability Testing Threat Detection • Network IDS • Host IDS • Wireless IDS • File Integrity Monitoring Threat Detection Behavioral Monitoring • Log Collection • Netflow Analysis • Service Availability Monitoring Behavioral Monitoring
- 15. What do we need forPCI- DSS? 15 Asset Discovery Asset Discovery • Active Network Scanning • Passive Network Scanning • Asset Inventory • Host-based Software Inventory Vulnerability Assessment Vulnerability Assessment • Network Vulnerability Testing Threat Detection • Network IDS • Host IDS • Wireless IDS • File Integrity Monitoring Threat Detection Behavioral Monitoring • Log Collection • Netflow Analysis • Service Availability Monitoring Behavioral Monitoring Security Intelligence • SIEM Correlation • Incident Response Security Intelligence
- 16. 16 Asset Discovery Asset Discovery • ActiveNetwork Scanning • Passive Network Scanning • Asset Inventory • Host-based Software Inventory Vulnerability Assessment Vulnerability Assessment • Network Vulnerability Testing Threat Detection • Network IDS • Host IDS • Wireless IDS • File Integrity Monitoring Threat Detection Behavioral Monitoring • Log Collection • Netflow Analysis • Service Availability Monitoring Behavioral Monitoring Security Intelligence • SIEM Correlation • Incident Response Security Intelligence Unified Security Management BTW… this is just the technologies… process is a whole ‘nother topic.
- 17. READING IN BETWEENTHE LINES… D YN A M IC TH R E A T IN TE L L IGE N C E U P D A TE S TH E TH R E A TS C H A N GE , S O S H OU L D YOU R E V E N T C OR R E L A TION R U L E S , IP R E P U TA TI ON D A TA , E TC . FL E X IB L E U S E C A S E S U P P OR T IT’ S I M P OS S I B LE TO P R E D IC T A L L B A D OU TC OM E S S O H A V E A S OL U TI ON TH A T GR OW S W ITH YOU WHAT’S NOT IN THE FINE PRINT BUT SHOULD BE… Dynamic threat intelligence updates THE THREATS CHANGE, SO SHOULD YOUR EVENT CORRELATION RULES, IP REPUTATION DATA, ETC. Flexible use case support IT’S IMPOSSIBLE TO PREDICT ALL BAD OUTCOMES SO HAVE A SOLUTION THAT GROWS WITH YOU 17
- 18. LET’S HEAR FROMYOU! ALIENVAULT POLL QUESTION What is your biggest pain point when it comes to PCI compliance? • Uncertainty about what’s on my network • Vulnerability assessment and remediation • Concerns about threat detection • Compliance reporting • None of the above – I’m a PCI Ninja!
- 19. WHY ALIENVAULT FORPCI DSS COMPLIANCE? All-in-one functionality • Easy management • Multiple functions without multiple consoles Automate what and where you can* • “Baked in” guidance when you can’t Flexible reporting & queries… as detailed as you want it. Threat intelligence from AlienVault Labs 19 *Disclaimer: Despite the hype, you can’t automate EVERYTHING nor would you want to. This is cyber security we’re talking about!
- 20. ALIENVAULT USM: AUTOMATION &CONSOLIDATION ① Install and Maintain a Firewall Configuration to Protect Data ② No Use of Vendor-Supplied Parameter Defaults ③ Protects Stored Cardholder Data ④ Encrypt Cardholder Data Transmission Across Open Public Networks ⑤ Use and Update Antivirus Software ⑥ Develop and Maintain Secure Systems and Applications ⑦ Restrict Cardholder Data Access to Need to Know ⑧ Assign Unique IDs to Everyone with Computer Access ① Track and Monitor Access to All Network Resources and Cardholder Data ② Regularly Test Security Systems and Processes http://www.alienvault.com/products-solutions/compliance- management/pci-dss-compliance
- 21. LET’S SEE ITIN ACTION. AlienVault USM Demo – PCI DSS Compliance Simplified
- 22. WHAT’S COMING INPCI DSS V3*? Increased clarity • Intention and application • Scoping and reporting • Eliminate redundancy, consolidate documentation Stronger focus on “greater risk areas” in the threat environment Consistency among assessors Key Goals *https://www.pcisecuritystandards.org/security_standards/documents.php Key Themes Education and Awareness Increased flexibility Security as a shared responsibility Nov 7 2013 • PCI DSS v3 is published Jan 1 2014 • PCI DSS v3 becomes effective Dec 31 2014 • PCI DSS v2 expires Key Dates
- 23. KEY TAKE-AWAYS Use the“force” of compliance to bolster your security monitoring / incident response program. PCI Compliance is more than just reporting. Automate and consolidate as much as possible. And… throw away that cover page for your TPS reports. ….But keep the red stapler. 23
- 24. NOW FOR SOMEQ&A… Three Ways to Test Drive AlienVault Download a Free 30-Day Trial http://www.alienvault.com/free-trial Try our Interactive Demo Site http://www.alienvault.com/live-demo-site Join our LIVE Demo on Thursday! http://www.alienvault.com/marketing/alienvault-usm-live- demo Sales@alienvault.com
Editor's Notes
- #9 We all know… Security doesn’t equal compliance and compliance doesn’t equal security…But… you can usecompliance to getyour security projects funded.Use the “force” of compliance to improve your security.Remember… compliance is about more than reporting!
- #11 Before we go into the nitty gritty of the requirements (and let’s face it, that’s the really boring stuff), at a high –level what are the core functionalities I need to pass my audit and stay in compliance?Asset visibility (broad and deep)Vulnerability assessment (network, apps, etc)Threat detectionFile integrity monitoringHost-based IDS (on the “interesting” stuff)Network-based IDSWireless IDSBehavioral MonitoringService availability – if credit card processing breaks, you have bigger problemsNetwork anomaliesPolicy violationsUser activity – especially those with superpowersSecurity IntelligenceEvent Correlation (here’s where “Big Data” comes in, but yawn who cares, that’s just a processing challenge)Incident ResponseCompliance ReportingExecutive DashboardsEasy management (RBAC, output types, filters, etc.)
- #12 Before we go into the nitty gritty of the requirements (and let’s face it, that’s the really boring stuff), at a high –level what are the core functionalities I need to pass my audit and stay in compliance?Asset visibility (broad and deep)Vulnerability assessment (network, apps, etc)Threat detectionFile integrity monitoringHost-based IDS (on the “interesting” stuff)Network-based IDSWireless IDSBehavioral MonitoringService availability – if credit card processing breaks, you have bigger problemsNetwork anomaliesPolicy violationsUser activity – especially those with superpowersSecurity IntelligenceEvent Correlation (here’s where “Big Data” comes in, but yawn who cares, that’s just a processing challenge)Incident ResponseCompliance ReportingExecutive DashboardsEasy management (RBAC, output types, filters, etc.)
- #13 Before we go into the nitty gritty of the requirements (and let’s face it, that’s the really boring stuff), at a high –level what are the core functionalities I need to pass my audit and stay in compliance?Asset visibility (broad and deep)Vulnerability assessment (network, apps, etc)Threat detectionFile integrity monitoringHost-based IDS (on the “interesting” stuff)Network-based IDSWireless IDSBehavioral MonitoringService availability – if credit card processing breaks, you have bigger problemsNetwork anomaliesPolicy violationsUser activity – especially those with superpowersSecurity IntelligenceEvent Correlation (here’s where “Big Data” comes in, but yawn who cares, that’s just a processing challenge)Incident ResponseCompliance ReportingExecutive DashboardsEasy management (RBAC, output types, filters, etc.)
- #14 Before we go into the nitty gritty of the requirements (and let’s face it, that’s the really boring stuff), at a high –level what are the core functionalities I need to pass my audit and stay in compliance?Asset visibility (broad and deep)Vulnerability assessment (network, apps, etc)Threat detectionFile integrity monitoringHost-based IDS (on the “interesting” stuff)Network-based IDSWireless IDSBehavioral MonitoringService availability – if credit card processing breaks, you have bigger problemsNetwork anomaliesPolicy violationsUser activity – especially those with superpowersSecurity IntelligenceEvent Correlation (here’s where “Big Data” comes in, but yawn who cares, that’s just a processing challenge)Incident ResponseCompliance ReportingExecutive DashboardsEasy management (RBAC, output types, filters, etc.)
- #15 Before we go into the nitty gritty of the requirements (and let’s face it, that’s the really boring stuff), at a high –level what are the core functionalities I need to pass my audit and stay in compliance?Asset visibility (broad and deep)Vulnerability assessment (network, apps, etc)Threat detectionFile integrity monitoringHost-based IDS (on the “interesting” stuff)Network-based IDSWireless IDSBehavioral MonitoringService availability – if credit card processing breaks, you have bigger problemsNetwork anomaliesPolicy violationsUser activity – especially those with superpowersSecurity IntelligenceEvent Correlation (here’s where “Big Data” comes in, but yawn who cares, that’s just a processing challenge)Incident ResponseCompliance ReportingExecutive DashboardsEasy management (RBAC, output types, filters, etc.)
- #16 Before we go into the nitty gritty of the requirements (and let’s face it, that’s the really boring stuff), at a high –level what are the core functionalities I need to pass my audit and stay in compliance?Asset visibility (broad and deep)Vulnerability assessment (network, apps, etc)Threat detectionFile integrity monitoringHost-based IDS (on the “interesting” stuff)Network-based IDSWireless IDSBehavioral MonitoringService availability – if credit card processing breaks, you have bigger problemsNetwork anomaliesPolicy violationsUser activity – especially those with superpowersSecurity IntelligenceEvent Correlation (here’s where “Big Data” comes in, but yawn who cares, that’s just a processing challenge)Incident ResponseCompliance ReportingExecutive DashboardsEasy management (RBAC, output types, filters, etc.)
- #17 Before we go into the nitty gritty of the requirements (and let’s face it, that’s the really boring stuff), at a high –level what are the core functionalities I need to pass my audit and stay in compliance?Asset visibility (broad and deep)Vulnerability assessment (network, apps, etc)Threat detectionFile integrity monitoringHost-based IDS (on the “interesting” stuff)Network-based IDSWireless IDSBehavioral MonitoringService availability – if credit card processing breaks, you have bigger problemsNetwork anomaliesPolicy violationsUser activity – especially those with superpowersSecurity IntelligenceEvent Correlation (here’s where “Big Data” comes in, but yawn who cares, that’s just a processing challenge)Incident ResponseCompliance ReportingExecutive DashboardsEasy management (RBAC, output types, filters, etc.)
- #23 The updated versions of PCI DSS and PA-DSS will: Provide stronger focus on some of the greater risk areas in the threat environment Provide increased clarity on PCI DSS & PA-DSS requirements Build greater understanding on the intent of the requirements and how to apply them Improve flexibility for all entities implementing, assessing, and building to the Standards Drive more consistency among assessors Help manage evolving risks / threats Align with changes in industry best practices Clarify scoping and reporting Eliminate redundant sub-requirements and consolidate documentation While not stated in the August document, it’s anticipated that the new standard will address issues of what falls within the scope of the standard, as well as network segmentation, and defense fortification to ward off specific threats that have been identified since the 2010 release. In addition, the new requirements are likely to address card data handling in mobile, cloud and e-commerce environments in the wake of previous guidance issued by the council.
- #24 Use the “force” of compliance to bolster your security monitoring / incident response program.PCI Compliance is more than just reporting – it’s about basic security hygiene – don’t focus JUST on reporting, although that is importantAutomate and consolidate as much as possible – reduces cost, complexity, and accelerates remediation.If mgmt wants to do this w/home grown or manual processes or tools (can’t get budget for more software), try open source, specifically OSSIM.