Dharshan Shanthamurthy (Founder and Chief Executive Officer of SISA Information Security) an Information Security Expert has spoken about Middle East Perspective on Payment Security in 2015 Middle East Forum organised by PCI Security Standard Council.

1. 2014 North American
Community Meeting2015 Middle East Forum
2015 Middle East Forum
Middle East
Perspective on
Payments Security
SISA

2. 2014 North American
Community Meeting2015 Middle East Forum
Introduction
Qualifications: PCI QSA, PA-QSA, CISA, CISSP, CEH, FCA, ISO 27001 Implementer, CEH, OCTAVE (SEI-CMU)
Authorized Trainer and Advisor, SANS Certified Web Application Pen Tester (GWAPT), Microsoft Certified
Professional (MCP),
SISA Information Security operates from Dubai and Bahrain as part of its middle east
operations. SISA in America, Asia and Middle East. SISA Middle East was set up in 2008 and
since then has worked with more than 100 organizations as a QSA, PA-QSA and ASV. SISA
has trained over 5,000 professionals on payment security with its flagship certifiation CPISI.
Dharshan was the proposer and lead for the PCI DSS Risk Assessment Group that authored
the PCI DSS Risk Assessment guidance document.
Dharshan Shanthamurthy,
Founder and Chief Executive Officer
Email: dbs@sisainfosec.com Linkedin: dharshanshanthamurthy
SISA

3. 2014 North American
Community Meeting2015 Middle East Forum
Session Agenda:
 PCI DSS Adoption
 PCI DSS Gap Assessment – What's common between them?
 Challenges
 PCI Success Plan
3
SISA

4. 2014 North American
Community Meeting2015 Middle East Forum
PCI DSS Adoption
4
0
10
20
30
40
50
60
2011 2012 2013 2014
Merchant
Service Provider
Note :- Statistics based on SISA database, VISA and Master Card Service Provider List
SISA

5. 2014 North American
Community Meeting2015 Middle East Forum
Gaps across requirements
5
0
20
40
60
80
100
Not Applicable
Non Compliant
Compliant
1
1
233
4
5
6
7
8
9
7
Note :- Statistics Based on Approx. 100+ Assessment Conducted by SISA In Middle East
SISA

6. 2014 North American
Community Meeting2015 Middle East Forum
Challenges
TECHNICAL
 Applications
 Segmentation
 PCI DSS Risk Assessment
 Out of support systems
 Sustenance
6
IMPLEMENTATION
 Project Management
 Driven by one or few teams
 Training to implementers/decision
makers
 Not on boarding right partners or
investing in the right solutions
SISA

7. 2014 North American
Community Meeting2015 Middle East Forum
PCI Success Plan*
1. Get highest level of sponsorship for the program
2. Get the right team/person behind the program
3. Put a proper project plan and budget sufficient time to get it right
4. Conduct 3 types of training:
a. PCI DSS training implementers
b. PCI DSS training for decision makers
c. PCI DSS training for developers
5. Creation of a cross functional PCI Steering Committee
6. Identify cardholder data in the environment
7
* Extract of the SISA PCI Success Plan
SISA

8. 2014 North American
Community Meeting2015 Middle East Forum
PCI Success Plan*
7. Conduct PCI DSS Risk Assessment
8. Conduct self assessment on PA-DSS for critical applications at the earliest
9. Gaps Discussion and Agreement between QSA and internal stakeholders
10. Remediation as per the plan and inform key stakeholders of any delay
11. Periodic steering committee meetings to take decisions
12. Milestone review calls to discuss technical challenges and agreement with QSA
8
* Extract of the SISA PCI Success Plan
SISA

9. 2014 North American
Community Meeting2015 Middle East Forum
2015 Middle East Forum
Email: dbs@sisainfosec.com Linkedin: dharshanshanthamurthy
SISA