Performing PCI DSS Assessments Using Zero Trust Principles

PERFORMING PCI DSS
ASSESSMENTS USING
ZERO TRUST PRINCIPLES
YOUR IT COMPLIANCE PARTNER –
GO BEYOND THE CHECKLIST

ControlCase Introduction
Zero Trust Principles by PCI Requirement
About PCI DSS
Current State
ControlCase Remote Assessment Methodology
AGENDA
© 2020 ControlCase. All Rights Reserved. 2
1
2
3
4
5

1 CONTROLCASE INTRODUCTION

ControlCase Snapshot
CERTIFICATION AND CONTINUOUS COMPLIANCE SERVICES
Go beyond the auditor’s checklist to:
Dramatically cut the time, cost and burden from becoming certified and maintaining IT compliance.
• Demonstrate compliance more efficiently
and cost effectively (cost certainty)
• Improve efficiencies
⁃ Do more with less resources and gain
compliance peace of mind
• Free up your internal resources to focus
on their priorities
• Offload much of the compliance burden to
a trusted compliance partner
1,000+ 275+10,000+
CLIENTS IT SECURITY
CERTIFICATIONS
SECURITY
EXPERTS

Solution - Certification and Continuous Compliance Services
“I’ve worked on both sides of
auditing. I have not seen any other
firm deliver the same product and
service with the same value. No
other firm provides that continuous
improvement and the level of detail
and responsiveness.
— Security and Compliance Manager,
Data Center
Certification and Continuous Compliance Services

Certification Services
One Audit™
Assess Once. Comply to Many.
“You have 27 seconds to make a first
impression. And after our initial
meeting, it became clear that they
were more interested in helping
our business and building a
relationship, not just getting the
business.
— Sr. Director, Information Risk & Compliance,
Large Merchant
PCI DSS ISO 27001
& 27002
SOC 1,2,3 & SOC
for Cybersecurity
PCI SSF
HIPAA PCI P2PE GDPR NIST 800-53
PCI PIN PCI PA-DSS CSA STAR Microsoft SSPA

ABOUT PCI DSS2

What is PCI DSS
Payment Card Industry Data Security Standard:
• Guidelines for securely processing, storing,
or transmitting payment card account data
• Maintained by the PCI Security Standards
Council (PCI SSC)
• Established by leading payment card brands

PCI DSS Requirements
CONTROL OBJECTIVES REQUIREMENTS
Build and maintain a secure network
1. Install and maintain a firewall configuration to protect cardholder data
2. Do not use vendor-supplied defaults for system passwords and other security parameters
Protect cardholder data
3. Protect stored cardholder data
4. Encrypt transmission of cardholder data across open, public networks
Maintain a vulnerability management program
5. Use and regularly update anti-virus software on all systems commonly affected by malware
6. Develop and maintain secure systems and applications
Implement strong access control measures
7. Restrict access to cardholder data by business need-to-know
8. Assign a unique ID to each person with computer access
9. Restrict physical access to cardholder data
Regularly monitor and test networks
10.Track and monitor all access to network resources and cardholder data
11.Regularly test security systems and processes
Maintain an information security policy 12.Maintain a policy that addresses information security

CURRENT STATE3

Current State
Many companies are implementing work-from-home policies,
which challenge traditional IT Compliance and Cyber Security programs.
Organizations are expected
to consider and review their processes
on remote work.
Due to restrictions on travel and physical
meetings as a result of the coronavirus,
PCI SSC has published guidance for
assessors on the topic of remote
assessments.

Automation In Remote Assessments
ACE
• Automated Compliance
Engine
• Can collect evidence
such as configurations
remotely
CDD
• Data Discovery Solution
• Can scan end user
workstations for
card data
VAPT
• Vulnerability
Assessment &
Penetration Testing
• Can perform remote
vulnerability scans and
penetration tests
LOGS
• Log Analysis and
Alerting
• Can review log settings
and identify missing
logs remotely
1 2 3 4

ZERO TRUST PRINCIPLES
PER PCI DSS REQUIREMENT
4

PCI DSS Requirements
CONTROL OBJECTIVES REQUIREMENTS
Build and maintain a secure network
1. Install and maintain a firewall configuration to protect cardholder data
2. Do not use vendor-supplied defaults for system passwords and other security parameters
Protect cardholder data
3. Protect stored cardholder data
4. Encrypt transmission of cardholder data across open, public networks
Maintain a vulnerability management program
5. Use and regularly update anti-virus software on all systems commonly affected by malware
6. Develop and maintain secure systems and applications
Implement strong access control measures
7. Restrict access to cardholder data by business need-to-know
8. Assign a unique ID to each person with computer access
9. Restrict physical access to cardholder data
Regularly monitor and test networks
10.Track and monitor all access to network resources and cardholder data
11.Regularly test security systems and processes
Maintain an information security policy 12.Maintain a policy that addresses information security

Personal firewall software or
equivalent functionality on any
portable computing devices
(including company and/or
employee-owned) that connect to
the internet when outside the
network and which are used to
access the Cardholder Data
Environment (CDE).
Only required Inbound and
Outbound access control rules
are required to be configured on
the personal firewall running on
such workstations.
Employees should not be
able to disable or modify the
configuration of personal
firewall software.
Requirement 1: Firewalls

Requirement 2: Configuration Scans
System configuration standards approved
by organizations must be enforced on WFH
users’ workstations.
Maintain the inventory of workstations.

Increase the frequency of card
data discovery scanning.
Establish process to run
automated secure data
disposal on disks of workstations
for WFH users.
Reduce the exposure of full
card numbers.
Requirement 3: Protect Stored Cardholder Data

Applications accessible over
internet should be accessed
using HTTPS (TLS v1.2).
Use VPN Connection with
encryption for WFH users.
Prohibit use of unofficial email
and end-user messaging
applications for sharing
cardholder data.
Requirement 4: Protect Cardholder Data In Transmission

Requirement 5: Antivirus and Malware
All systems should have an Anti-Virus
solution installed and regularly updated.
Users should not be able to disable
the Anti-virus solution.

Requirement 6: Secure Applications
Regular patch management must be
completed on WFH user workstations.
Ensure that development workstations
are not able to access remote production
environments.

Requirement 7: Access Control
No regular user (except power users) should be
able to access any system within CDE that stores,
processes or transmits bulk cardholder data.
Need-to-know basis access along with least
privileges must be implemented to restrict
access to cardholder data for WFH users.

Requirement 8: User IDs
All the WFH users must use two factor authentication to connect to cardholder data environment.

No realistic way to control
physical access of personnel
working from home.
Ensure controls (such as Citrix)
are in place that full cardholder
data cannot be viewed or
downloaded when working from
home.
Data Center reviews may have to
be done using mobile cameras
and or CCTV images/
photographs (with time stamp)
based evidence.
Requirement 9: Physical Security

Requirement 10: Logging and Monitoring
Ensure all user activities done on WFH
workstations are logged.
Ensure all WFH workstations are synchronizing
time with designated NTP server.

Requirement 11: Vulnerability Management
Internal vulnerability assessment and penetration
testing must be conducted for WFH workstations.
Penetration tests emulating a work from home
user scenario must be performed.

Requirement 12: Policies and Procedures
Provide Information Security Awareness Training to WFH users on
how to secure their wireless network (if any).

CONTROLCASE REMOTE
ASSESSMENT METHODOLOGY
5

1
Automation (Remote scanning,
evidence collection & testing)
2
Mechanisms to enable remote
assessment (CCTV, phone
cameras etc.)
3
Continuous compliance
controls (such as more
frequent user access
reviews, scans and firewall
ruleset reviews)
3 Key Areas Of Focus

1. Automation-driven for Remote Work From Home Testing
ACE
• Automated Compliance
Engine
• Can collect evidence
such as configurations
remotely
CDD
• Data Discovery Solution
• Can scan end user
workstations for
card data
VAPT
• Vulnerability
Assessment &
Penetration Testing
• Can perform remote
vulnerability scans and
penetration tests
LOGS
• Log Analysis and
Alerting
• Can review log settings
and identify missing
logs remotely
1 2 3 4

2. Mechanisms to Enable Remote Assessments
Assessors should maintain their structure
for an onsite audit but instead use video
calling and screen sharing to provide
evidence and conduct interviews as a part
of the assessment.
Data Center reviews may have to be done
using mobile cameras and or CCTV
images/photographs (with time stamp)
based evidence.
Prepare for additional time interviewing
vis a vis traditional face to face interviews.
Technology to upload and manage
evidence to be shared between
assessor and organization.

3. Continuous Compliance Enablement
The continuous compliance
monitoring is a big value add to
their audit and certification
services, which is good for
organizations that don’t have the
team in-house. It’s a big
differentiator for them.
— VP of IT,
Call Center / BPO Company
70% of company’s assets
are non-compliant at some
point in the year.
Go beyond monitoring and alerting to predict,
prioritize and remediate compliance risks before
they become security threats.
Address common non-compliant situations that
leave you vulnerable all year long, including:
• In-scope assets not reporting logs
• In-scope assets missed from vulnerability scans
• Critical, overlooked vulnerabilities due to volume
• Risky firewall rule sets go undetected
• Non-compliant user access scenarios not flagged
“

Summary – Why ControlCase
“They provide excellent service,
expertise and technology. And,
the visibility into my compliance
throughout the year and during
the audit process provide a lot
of value to us.
— Dir. of Compliance,
SaaS company

Access Now - Free Ebook
PERFORMING PCI DSS ASSESSMENTS
USING ZERO TRUST PRINCIPLES
https://www.controlcase.com/free-pci-ebook/

THANK YOU FOR THE
OPPORTUNITY TO CONTRIBUTE TO
YOUR IT COMPLIANCE PROGRAM.
www.controlcase.com
(US) + 1 703.483.6383 (INDIA) + 91.22.62210800
contact@controlcase.com

Performing PCI DSS Assessments Using Zero Trust Principles

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Performing PCI DSS Assessments Using Zero Trust Principles

Similar to Performing PCI DSS Assessments Using Zero Trust Principles (20)

More from ControlCase

More from ControlCase (18)

Recently uploaded

Recently uploaded (20)

Performing PCI DSS Assessments Using Zero Trust Principles

Editor's Notes