Rochester Security Summit, profile picture
Uploaded byRochester Security Summit
PDF, PPTX1,704 views

You Know You Need PCI Compliance Help When…

The document discusses PCI compliance and the importance of understanding the various requirements and challenges associated with it for merchants and service providers. It highlights the necessity of having a clear understanding of compliance levels, roles, and the importance of assessments and preparation for achieving compliance. Additionally, it emphasizes the need for expert assistance when navigating complex compliance issues and implementing security measures to protect cardholder data.

Embed presentation

Download as PDF, PPTX
You Know You Need PCI Compliance Help When… Presented By: Peter Spier Manager Professional Services Fortrex Technologies Jim Raub Senior Director of Information Security and Compliance PAETEC Holding Corporation © 2010. All rights reserved.
• Instructor Biographies • Background On Fortrex • Background on PAETEC • Overview of the PCI DSS • 3 Challenges • Common Scenarios • Time to Seek Help • Compliance Roles • Assessment Preparation • PCI DSS 2.0 Agenda © 2010. All rights reserved.
Instructor Biography • Peter Spier is President of the ISACA Western New York Chapter and Manager Professional Services at Fortrex Technologies (www.fortrex.com) based in Frederick, Maryland. • Certifications include: CISSP, CISM, PMP, QSA, PA-QSA, ITILFv3, and CSF Assessor • Masters degree from Syracuse University School of Information Studies • 15 years of experience © 2010. All rights reserved.
Instructor Biography © 2010. All rights reserved. • Jim Raub is Sr. Director, Information Security and Compliance at PAETEC (www.paetec.com) based in Fairport, NY. • Current Certifications include: CISSP, CISA, & CTM. Past certifications from Cisco, Microsoft, Informix, CompTIA and others. • Bachelors degree, Summa cum Laude, from Syracuse University, with coursework towards Masters at University of Rochester • 35 years of experience in management, consulting, security, software development, IT infrastructure, networks, and database administration
Background on Fortrex General Facts • IT Security, Operational Risk and Governance Consulting • Founded in 1997 • Headquarters in Frederick, Maryland • Privately Held • Approaching 1,000 Customers  Baltimore to Alaska to Guam • Broad Industry Coverage • QSA, PA-QSA & ASV • Abundance of References Integrity, Excellence, Empowerment, Teamwork and Thankfulness © 2010. All rights reserved.
Background on PAETEC © 2010. All rights reserved. Caring Culture, Open Communication, Unmatched Service, Personalized Solution General Facts • Founded in 1998 • Headquarters in Fairport, New York • Publicly Traded (Nasdaq: PAET) • Serving over 84 of the top 100 Metropolitan Statistical Areas (MSAs) in the U.S. with personalized communications solutions • Core offerings include data, voice, and Internet communications services • Value-added solutions encompass data center colocation, communications management software, equipment, security and financing programs
Overview of the PCI DSS Reviewing PCI DSS Compliance Requirements For The First Time Can Be A Daunting Task The “Dirty Dozen” Build and Maintain a Secure Network Requirement 1: Install and maintain a firewall configuration to protect cardholder data Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data Requirement 3: Protect stored cardholder data Requirement 4: Encrypt transmission of cardholder data across open, public networks Maintain a Vulnerability Management Program Requirement 5: Use and regularly update anti-virus software Requirement 6: Develop and maintain secure systems and applications Implement Strong Access Control Measures Requirement 7: Restrict access to cardholder data by business need-to-know Requirement 8: Assign a unique ID to each person with computer access Requirement 9: Restrict physical access to cardholder data Regularly Monitor and Test Networks Requirement 10: Track and monitor all access to network resources and cardholder data Requirement 11: Regularly test security systems and processes Maintain an Information Security Policy Requirement 12: Maintain a policy that addresses information security © 2010. All rights reserved.
Challenge #1 Are you a Merchant or a Service Provider? © 2010. All rights reserved.
Merchants Defined • Merchant - Any entity that accepts payment cards bearing the logos of any of the five members of PCI SSC (American Express, Discover, JCB, MasterCard or Visa) as payment for goods and/or services. © 2010. All rights reserved.
Service Providers Defined • Service Provider - Business entity that is not a payment card brand member or a merchant directly involved in the processing, storage, transmission, and switching or transaction data and cardholder information or both. o This also includes companies that provide services to merchants, services providers or members that control or could impact the security of cardholder data.  Examples include managed service providers that provide managed firewalls, IDS and other services as well as hosting providers and other entities.  Entities such as telecommunications companies that only provide communication links without access to the application layer of the communication link are excluded © 2010. All rights reserved.
When Merchants Are Also Service Providers • A merchant that accepts payment cards as payment for goods and/or services can also be a service provider, if the services sold result in storing, processing, or transmitting cardholder data on behalf of other merchants or service providers.  For example, an ISP is a merchant that accepts payment cards for monthly billing, but also is a service provider if it hosts merchants as customers © 2010. All rights reserved.
Challenge #2 What compliance level are you? © 2010. All rights reserved.
Merchant Compliance Levels Level Visa MasterCard Discover American Express JCB 1 Merchants processing over 6 million Visa transactions annually (all channels) or Global merchants identified as Level 1 by any Visa region •Any merchant that has suffered a hack or an attack that resulted in an account data compromise •Any merchant having greater than six million total combined MasterCard and Maestro transactions annually •Any merchant meeting the Level 1 criteria of Visa •Any merchant that MasterCard, in its sole discretion, determines should meet the Level 1 merchant requirements to minimize risk to the system •All merchants processing a total of more than 6 million card transactions annually on the Discover network. •Any merchant Discover, in its sole discretion determines should meet the Level 1 compliance validation and reporting requirements •All merchants required by another payment brand to validate and report their compliance as a Level 1 merchant 2.5 million American Express Card transactions or more per year; or any Merchant that has had a data incident; or any Merchant that American Express otherwise deems a Level 1 One million JCB transactions or more per year 2 Merchants processing 1 million to 6 million Visa transactions annually (all channels) •Any merchant with greater than one million but less than or equal to six million total combined MasterCard and Maestro transactions annually •Any merchant meeting the Level 2 criteria of Visa •All merchants processing a total of 1 million to 6 million card transactions annually on the Discover network. •All merchants required by another payment brand to validate and report their compliance as a Level 2 merchant 50,000 to 2.5 million American Express Card transactions per year Less than one million JCB transactions per year © 2010. All rights reserved.
Merchant Compliance Levels Level Visa MasterCard Discover American Express JCB 3 Merchants processing 20,000 to 1 million Visa e-commerce transactions annually •Any merchant with greater than 20,000 combined MasterCard and Maestro e- commerce transactions annually but less than or equal to one million total combined MasterCard and Maestro ecommerce transactions annually •Any merchant meeting the Level 3 criteria of Visa •All merchants processing a total of 20,000 to 1 million card-not-present only transactions annually on the Discover network •All merchants required by another payment brand to validate and report their compliance as a Level 3 merchant Less than 50,000 American Express Card transactions per year N/A 4 Merchants processing less than 20,000 Visa e- commerce transactions annually and all other merchants processing up to 1 million Visa transactions annually All other merchants All other merchants N/A N/A © 2010. All rights reserved.
Service Provider Compliance Levels Level Visa MasterCard Discover American Express JCB 1 VisaNet processors or any service provider that stores, processes and/or transmits over 300,000 Visa transactions annually •All TPPs •All DSE’s that store, transmit, or process greater than 300,000 total combined MasterCard and Maestro transactions annually All TPPs All TPPs All TPPs 2 Any service provider that stores, processes and/or transmits less than 300,000 Visa transactions annually Includes all DSE’s that store, transmit, or process less than 300,000 total combined MasterCard and Maestro transactions annually N/A N/A N/A © 2010. All rights reserved.
Challenge #3 What requirements apply? © 2010. All rights reserved.
Merchant Reporting Requirements Level Visa MasterCard Discover American Express JCB 1 •Annual Report on Compliance (“ROC”) by Qualified Security Assessor (“QSA”) •Quarterly network scan by Approved Scan Vendor (“ASV”) •Attestation of Compliance Form •Annual On-site Assessment1 •Quarterly network scan by Approved Scan Vendor (“ASV”) •All merchants processing a total of more than 6 million card transactions annually on the Discover network. •Any merchant Discover, in its sole discretion determines should meet the Level 1 compliance validation and reporting requirements •All merchants required by another payment brand to validate and report their compliance as a Level 1 merchant 2.5 million American Express Card transactions or more per year; or any Merchant that has had a data incident; or any Merchant that American Express otherwise deems a Level 1 One million JCB transaction s or more per year 2 •Annual Self-Assessment Questionnaire (“SAQ”) •Quarterly network scan by ASV •Attestation of Compliance Form •On-site Assessment (At Merchant Discretion) •Annual Self-Assessment Questionnaire (“SAQ”)2 •Quarterly network scan by Approved Scan Vendor (“ASV”) •All merchants processing a total of 1 million to 6 million card transactions annually on the Discover network. •All merchants required by another payment brand to validate and report their compliance as a Level 2 merchant 50,000 to 2.5 million American Express Card transactions per year Less than one million JCB transaction s per year 1 Effective 30 June 2011, Level 1 merchants that choose to conduct an annual onsite assessment using an internal auditor must ensure that primary internal auditor staff engaged in validating PCI DSS compliance attend PCI SSC-offered merchant training programs and pass any PCI SSC associated accreditation program annually in order to continue to use internal auditors. 2 Effective 30 June 2011, Level 2 merchants that choose to complete an annual self-assessment questionnaire must ensure that staff engaged in the self-assessment attend PCI SSC-offered merchant training programs and pass any associated PCI SSC accreditation program annually in order to continue the option of self-assessment for compliance validation. Alternatively, Level 2 merchants may, at their own discretion, complete an annual onsite assessment conducted by a PCI SSC approved QSA rather than complete an annual self-assessment questionnaire. © 2010. All rights reserved.
Merchant Reporting Requirements Level Visa MasterCard Discover American Express JCB 3 •Annual SAQ •Quarterly network scan by ASV •Attestation of Compliance Form •Annual SAQ •Quarterly network scan by ASV •All merchants processing a total of 20,000 to 1 million card-not-present only transactions annually on the Discover network •All merchants required by another payment brand to validate and report their compliance as a Level 3 merchant Less than 50,000 American Express Card transactions per year N/A 4 •Annual SAQ recommended •Quarterly network scan by ASV if applicable •Compliance validation requirements set by acquirer •Annual SAQ •Quarterly network scan by ASV All other merchants N/A N/A © 2010. All rights reserved.
Service Provider Reporting Requirements Level Visa MasterCard Discover American Express JCB 1 •Annual On-site security assessment by QSA •Quarterly network scans by ASV. •Annual On-site security assessment by QSA •Quarterly network scans by ASV. •Annual On-site security assessment by QSA (or internal auditor if signed by officer of Service provider). OR Annual Self-Assessment Questionnaire D •Quarterly network scans by ASV •Annual On-site security assessment by QSA (or internal auditor if signed by officer of Service provider). •Quarterly network scans by ASV. •Annual On- site security assessment by QSA •Quarterly network scans by ASV. 2 •Annual SAQ •Quarterly network scan by ASV •Annual SAQ •Quarterly network scan by ASV N/A N/A N/A © 2010. All rights reserved.
Realization • Each card brand’s transaction-driven tiering and corresponding requirements differs from one brand to the other • For Self Assessment Questionnaire (SAQ) merchants, if you employ more than one transaction type, you’re obligated to use SAQ D • For Level 2 Service Providers, you’re obligated to use SAQ D • SAQ D is the long one… © 2010. All rights reserved.
Suppose • You have bandwidth to spare • Your internal audit personnel possess broad and deep compliance framework experience • A team member has successfully completed a PCI DSS compliance assessment in the past When should you consider bringing in expert assistance from the outside? © 2010. All rights reserved.
When Compliance Looks Easy • Familiar with ISO:27001? • Spoken with a colleague who indicated that their SAQ was a simple matter of checking all the ‘Yes’ boxes and signing it? • PCI DSS can be mapped to other frameworks, but its focus is explicitly cardholder data security • Compliance is never as easy as just checking all the ‘Yes’ boxes © 2010. All rights reserved.
When You Receive An E-mail Identifying Still Another Data Repository • Unidentified data repositories can: o Threaten momentum o Lower morale o Derail compliance efforts. • Late-in-the-game discoveries might cause you to: o Miss your target dates o Incur unforeseen penalties o Require re-work to remediate issues • Recommendation: Identify all payment flows through a combination of both human and automated means o Surveys o Interviews o Data analytics © 2010. All rights reserved.
When You Are Not Certain Where Your Cardholder Data Environment Begins Or Ends • Does an unsolicited customer email automatically bring a system into the Cardholder Data Environment (CDE)? • If an end-user chooses to record a call and save it to local or LAN file, is the PC or fileserver in scope? • If the CDE firewall allows insecure protocols, is the scope reduced? • Is a workstation part of the CDE if it is used only to key in the Payment Account Number (PAN) to a hosted application through an encrypted channel?
When You Re-Read The Same Requirement And Interpret It In Yet Another Way • Read the PCI DSS? • Attended seminars? • Poured over various forum threads and blog postings? • Was that requirement really non-applicable? • Does your planned compensating control truly go above and beyond the rigor and intent of the original requirement? • Is your “business justification” for leaving open a particular port or protocol sufficient? © 2010. All rights reserved.
Time To Seek Help • Good counsel may at first seem to be in abundance, but identifying the appropriate resource to provide accurate direction is critical • A different business’s compliance approach probably does not apply to your own environment • You can not simply repeat last year’s response • It probably does take an expert to address the “low hanging fruit” • Consulting a QSA prior to an assessment may prove to be the shortest path to achieving compliance © 2010. All rights reserved.
Suggested Compliance Roles •Audit •Complete Self Assessment Questionnaire or Level 1 or 2 assessment •Periodic review of controls •Governance •Compliance oversight •Policy development and distribution •Coordination of organizational business units •Security Operations •Management and monitoring of controls •Internal vulnerability scanning and/or penetration testing •Log Review •Incident Response •System Administration •Account and authentication management •Access control management •Configuration management •Application Developers •Development and Testing •Code review •Revision control •Database Administrators •Record management •Access control management •Project Managers •Assessment and validation planning •Stakeholder coordination and reporting •Resource scheduling •Reporting •Senior Management •Report On Compliance review •Sign Attestation Of Compliance •Qualified Security Assessors •On-site assessment •Validation •Report On Compliance creation •Submission to the payment brands •Countersign Attestation Of Compliance •Approved Scanning Vendors •External quarterly vulnerability scans © 2010. All rights reserved.
Assessment Preparation Scope •Scope of the cardholder data environment is defined as all system components which transmit, process, or store cardholder data. •Limiting the scope of the cardholder data environment may reduce the scope of assessment and ongoing compliance efforts. •Scope reduction strategies may include: •Network Segmentation •Tokenization •All systems receiving cardholder data directly and performing tokenization are in scope •End-to-End Encryption •All systems receiving cardholder data directly and performing encryption are in scope © 2010. All rights reserved.
Network Segmentation Unsegmented Segmented © 2010. All rights reserved.
Tokenization © 2010. All rights reserved.
End-to-End Encryption © 2010. All rights reserved.
Assessment Preparation Prioritized Approach Methodology •Roadmap of compliance activities based on risk associated with storing, processing, and/or transmitting cardholder data. •Assists in prioritization of efforts to achieve compliance •Establishes milestones •Lowers the risk of cardholder data breaches sooner in the compliance process •Helps acquirers to objectively measure compliance activities and risk reduction by merchants, service providers, and others •Pragmatic approach that allows for “quick wins” •Supports financial and operational planning •Promotes objective and measurable progress indicators •Suitable for merchants who choose an on-site assessment or use SAQ D. © 2010. All rights reserved.
Assessment Preparation Milestone Goals 1 Remove sensitive authentication data and limit data retention. This milestone targets a key area of risk for entities that have been compromised. Remember – if sensitive authentication data and other cardholder data are not stored, the effects of a compromise will be greatly reduced. If you don’t need it, don’t store it. 2 Protect the perimeter, internal, and wireless networks. This milestone targets controls for points of access to most compromises – the network or a wireless access point. 3 Secure payment card applications. This milestone targets controls for applications, application processes, and application servers. Weaknesses in these areas offer easy prey for compromising systems and obtaining access to cardholder data. 4 Monitor and control access to your systems. Controls for this milestone allow you to detect the who, what, when, and how concerning who is accessing your network and cardholder data environment. 5 Protect stored cardholder data. For those organizations that have analyzed their business processes and determined that they must store Primary Account Numbers, Milestone Five targets key protections mechanisms for that stored data. 6 Finalize remaining compliance efforts, and ensure all controls are in place. The intent of Milestone Six is to complete PCI DSS requirements and finalize all remaining related policies, procedures, and processes needed to protect the cardholder data environment. © 2010. All rights reserved.
PCI DSS 2.0 Requirement Reason for Change Change Category Introduction Clarify Applicability of PCI DSS and cardholder data. Clarify that PCI DSS Requirements 3.3 and 3.4 apply only to PAN. Align language with PTS Secure Reading and Exchange of Data (SRED) module. Clarification Scope Ensure all locations of cardholder data are included in scope of PCI DSS assessments Clarify that all locations and flows of cardholder data should be identified and documented to ensure accurate scoping of cardholder data environment. Guidance Introduction and Various Provide guidance on virtualization. Expanded definition of system components to include virtual components. Updated requirement 2.2.1 to clarify intent of “one primary function per server” and use of virtualization. Guidance 1 Further clarification of the DMZ. Provide clarification on secure boundaries between internet and card holder data environment. Clarification 3.2 Clarify applicability of PCI DSS to Issuers or Issuer Processors. Recognize that Issuers have a legitimate business need to store Sensitive Authentication Data. Clarification © 2010. All rights reserved.
PCI DSS 2.0 (Continued) Requirement Reason for Change Change Category 3.6 Clarify key management processes. Clarify processes and increase flexibility for cryptographic key changes, retired or replaced keys, and use of split control and dual knowledge. Clarification 6.2 Apply a risk based approach for addressing vulnerabilities. Update requirement to allow vulnerabilities to be ranked and prioritized according to risk. Evolving Requirement 6.5 Merge requirements to eliminate redundancy and Expand examples of secure coding standards to include more than OWASP. Merge requirement 6.3.1 into 6.5 to eliminate redundancy for secure coding for internal and Web-facing applications. Include examples of additional secure coding standards, such as CWE and CERT. Clarification 12.3.10 Clarify remote copy, move, and storage of CHD. Update requirement to allow business justification for copy, move, and storage of CHD during remote access. Clarification © 2010. All rights reserved.
Thank You. © 2010. All rights reserved.

More Related Content

PDF
PCI-DSS_Overview
bysameh Abulfotooh
 
PPTX
PCI DSS Compliance
bySaumya Vishnoi
 
PPTX
PCI DSS 2.0 Detailed Introduction
byControlCase
 
PPTX
PCI DSS 3.2 - Business as Usual
byKimberly Simon MBA
 
PDF
Pci standards, from participation to implementation and review
byisc2-hellenic
 
PPTX
PCI DSSand PA DSS
byKimberly Simon MBA
 
PPTX
PCI DSS and PA DSS
byKimberly Simon MBA
 
PPTX
Card Data Discovery and PCI DSS
byKimberly Simon MBA
 
PCI-DSS_Overview
bysameh Abulfotooh
 
PCI DSS Compliance
bySaumya Vishnoi
 
PCI DSS 2.0 Detailed Introduction
byControlCase
 
PCI DSS 3.2 - Business as Usual
byKimberly Simon MBA
 
Pci standards, from participation to implementation and review
byisc2-hellenic
 
PCI DSSand PA DSS
byKimberly Simon MBA
 
PCI DSS and PA DSS
byKimberly Simon MBA
 
Card Data Discovery and PCI DSS
byKimberly Simon MBA
 

What's hot

PPTX
A practical guides to PCI compliance
byJisc
 
PPTX
Introduction to Token Service Provider (TSP) Certification
byKimberly Simon MBA
 
PPTX
Vendor Management for PCI DSS; EI3PA; HIPAA and FFIEC
byKimberly Simon MBA
 
PDF
1. PCI Compliance Overview
byokrantz
 
PDF
PCI DSS for Pentesting
byn|u - The Open Security Community
 
PPTX
PCI DSS Business as Usual (BAU)
byKimberly Simon MBA
 
PPTX
PCI Compliance (for developers)
byMaksim Djackov
 
PDF
Pci ssc quick reference guide
byMohammad Makchudul Alam (Arif)
 
PPTX
PCI DSS and PA DSS
byKimberly Simon MBA
 
PPTX
PCI DSS 3.2
byKimberly Simon MBA
 
PPTX
Continual Compliance for PCI DSS, E13PA and ISO 27001/2
byControlCase
 
PPTX
Continual Compliance Monitoring
byKimberly Simon MBA
 
PPT
Experience for implement PCI DSS
byNhat Phan Canh
 
PPTX
PCI Compliance in the Cloud
byControlCase
 
PPTX
Taming the compliance beast in cloud
bySaumya Vishnoi
 
PPTX
Vendor Management for PCI DSS; EI3PA; HIPAA and FFIEC
byKimberly Simon MBA
 
PPTX
PCI DSS and PA DSS Compliance
byKimberly Simon MBA
 
PPTX
Data Discovery and PCI DSS
byKimberly Simon MBA
 
PPTX
PCI Compliance in the Cloud
byKimberly Simon MBA
 
PPTX
PCI Compliance in the Cloud
byKimberly Simon MBA
 
A practical guides to PCI compliance
byJisc
 
Introduction to Token Service Provider (TSP) Certification
byKimberly Simon MBA
 
Vendor Management for PCI DSS; EI3PA; HIPAA and FFIEC
byKimberly Simon MBA
 
1. PCI Compliance Overview
byokrantz
 
PCI DSS for Pentesting
byn|u - The Open Security Community
 
PCI DSS Business as Usual (BAU)
byKimberly Simon MBA
 
PCI Compliance (for developers)
byMaksim Djackov
 
Pci ssc quick reference guide
byMohammad Makchudul Alam (Arif)
 
PCI DSS and PA DSS
byKimberly Simon MBA
 
PCI DSS 3.2
byKimberly Simon MBA
 
Continual Compliance for PCI DSS, E13PA and ISO 27001/2
byControlCase
 
Continual Compliance Monitoring
byKimberly Simon MBA
 
Experience for implement PCI DSS
byNhat Phan Canh
 
PCI Compliance in the Cloud
byControlCase
 
Taming the compliance beast in cloud
bySaumya Vishnoi
 
Vendor Management for PCI DSS; EI3PA; HIPAA and FFIEC
byKimberly Simon MBA
 
PCI DSS and PA DSS Compliance
byKimberly Simon MBA
 
Data Discovery and PCI DSS
byKimberly Simon MBA
 
PCI Compliance in the Cloud
byKimberly Simon MBA
 
PCI Compliance in the Cloud
byKimberly Simon MBA
 

Similar to You Know You Need PCI Compliance Help When…

PPTX
Introduction to PCI DSS
bySaumya Vishnoi
 
PPTX
PCI DSS Compliance Readiness
byAl Abbas, PMP, CISSP, MBA, MSc
 
PPT
PCI DSS
byDuy Do Phan
 
PPT
PCI Compliance 101
bypgalletta
 
PPTX
Payment Card Industry Introduction 2010
byDonald E. Hester
 
PPT
eCommerce Summit Atlanta Mountain Media
byeCommerce Merchants
 
PPTX
Secrets for Successful Regulatory Compliance Projects
byChristopher Foot
 
PPT
Merchant Services Audit 03 2011
bycarolta555
 
PPT
ECMTA 2009 PCI Compliance and the Ecommerce Merchant
byMelanie Beam
 
PDF
Evolve Pci Compliance
byhypknight
 
PPTX
Payment Card Industry CMTA NOV 2010
byDonald E. Hester
 
PPTX
PCI Compliance for Community Colleges @One CISOA 2011
byDonald E. Hester
 
PPTX
Payment Card Industry Compliance for Local Governments CSMFO 2009
byDonald E. Hester
 
PDF
Reduce PCI Scope - Maximise Conversion - Whitepaper
byShaun O'keeffe
 
PPTX
Introduction to PCI APR 2010
byDonald E. Hester
 
PPT
Evolution Pci For Pod1
byAmanda Squires@Pod1
 
PDF
Adventures in PCI Wonderland
byMichele Chubirka
 
PDF
PCI Compliance—Love It, Hate It, But Don’t Ignore It (11NTCpci)
byMiminten
 
PDF
Payment card industry data security standard 1
bywardell henley
 
PDF
Introduction to the Payment Card Industry Data Security Standard (PCI DSS) - ...
byAtoZ Compliance
 
Introduction to PCI DSS
bySaumya Vishnoi
 
PCI DSS Compliance Readiness
byAl Abbas, PMP, CISSP, MBA, MSc
 
PCI DSS
byDuy Do Phan
 
PCI Compliance 101
bypgalletta
 
Payment Card Industry Introduction 2010
byDonald E. Hester
 
eCommerce Summit Atlanta Mountain Media
byeCommerce Merchants
 
Secrets for Successful Regulatory Compliance Projects
byChristopher Foot
 
Merchant Services Audit 03 2011
bycarolta555
 
ECMTA 2009 PCI Compliance and the Ecommerce Merchant
byMelanie Beam
 
Evolve Pci Compliance
byhypknight
 
Payment Card Industry CMTA NOV 2010
byDonald E. Hester
 
PCI Compliance for Community Colleges @One CISOA 2011
byDonald E. Hester
 
Payment Card Industry Compliance for Local Governments CSMFO 2009
byDonald E. Hester
 
Reduce PCI Scope - Maximise Conversion - Whitepaper
byShaun O'keeffe
 
Introduction to PCI APR 2010
byDonald E. Hester
 
Evolution Pci For Pod1
byAmanda Squires@Pod1
 
Adventures in PCI Wonderland
byMichele Chubirka
 
PCI Compliance—Love It, Hate It, But Don’t Ignore It (11NTCpci)
byMiminten
 
Payment card industry data security standard 1
bywardell henley
 
Introduction to the Payment Card Industry Data Security Standard (PCI DSS) - ...
byAtoZ Compliance
 

More from Rochester Security Summit

PPTX
GRC– The Way Forward
byRochester Security Summit
 
PPTX
Application Threat Modeling
byRochester Security Summit
 
PDF
Business Impact and Risk Assessments in Business Continuity and Disaster Reco...
byRochester Security Summit
 
PDF
Radio Reconnaissance in Penetration Testing
byRochester Security Summit
 
PDF
Firewall Defense against Covert Channels
byRochester Security Summit
 
PDF
Maximizing ROI through Security Training (for Developers)
byRochester Security Summit
 
PDF
Dealing with Web Application Security, Regulation Style
byRochester Security Summit
 
PPTX
It's All About the Data!
byRochester Security Summit
 
PPTX
Real Business Threats!
byRochester Security Summit
 
PDF
Losing Control to the Cloud
byRochester Security Summit
 
PPSX
State Data Breach Laws - A National Patchwork Quilt
byRochester Security Summit
 
PDF
A Plan to Control and Protect Data in the Private and Public Cloud
byRochester Security Summit
 
PDF
A Security Testing Methodology that Fits Every IT Budget
byRochester Security Summit
 
PPTX
IPv6 Can No Longer Be Ignored
byRochester Security Summit
 
PPTX
Finding Patterns in Data Breaches
byRochester Security Summit
 
PDF
Dissecting the Hack: Malware Analysis 101
byRochester Security Summit
 
GRC– The Way Forward
byRochester Security Summit
 
Application Threat Modeling
byRochester Security Summit
 
Business Impact and Risk Assessments in Business Continuity and Disaster Reco...
byRochester Security Summit
 
Radio Reconnaissance in Penetration Testing
byRochester Security Summit
 
Firewall Defense against Covert Channels
byRochester Security Summit
 
Maximizing ROI through Security Training (for Developers)
byRochester Security Summit
 
Dealing with Web Application Security, Regulation Style
byRochester Security Summit
 
It's All About the Data!
byRochester Security Summit
 
Real Business Threats!
byRochester Security Summit
 
Losing Control to the Cloud
byRochester Security Summit
 
State Data Breach Laws - A National Patchwork Quilt
byRochester Security Summit
 
A Plan to Control and Protect Data in the Private and Public Cloud
byRochester Security Summit
 
A Security Testing Methodology that Fits Every IT Budget
byRochester Security Summit
 
IPv6 Can No Longer Be Ignored
byRochester Security Summit
 
Finding Patterns in Data Breaches
byRochester Security Summit
 
Dissecting the Hack: Malware Analysis 101
byRochester Security Summit
 

Recently uploaded

PDF
MINDCTI Revenue Release Quarter 3 2025 - Financial Presentation
byMIND CTI
 
PDF
Getting the Best of TrueDEM – January News & Updates
bypanagenda
 
PPTX
CRM for the Insurance Industry Lessons for Insurance CIOs and Digital Leaders...
byKerry Millar
 
PPTX
Coded Agents – with UiPath SDK + LlamaIndex.pptx
bysuhanisingh58689
 
PDF
Skills to Pass the UiPath Agentic Automation Associate (UiAAA) Certification
byUiPathCommunity
 
PPTX
API Gateway Architecture - Technical Report 2026
byPowersoft2026
 
PDF
Enterprise Data Services_ A Development Guide with Use Cases, Trends and Impl...
by2601harsh23
 
PDF
Deploying Windows Clients & Managing Identities
byVICTOR MAESTRE RAMIREZ
 
PPT
Database Management Systems: Basics, History, Data Models, etc.
byParithi Thamizh
 
PDF
Quick Learn Laravel for Beginner from Zero to Survive
byiDev Semarang
 
PDF
Safer’s Picks: Recent FME Enhancements with Big Everyday Impact
bySafe Software
 
PDF
How the EU Ecolabel's Record Growth Creates ESG Opportunities for CRE
byWastify AI
 
PPTX
Code Like Bro -A guide for better Coding
byMadan Panthi
 
PPTX
AI Meets DBA Transforming Database Administration with Intelligence
byGeoPITS Global Pvt Ltd
 
PPTX
apidays Australia 2025 | Building AI RAG Applications with No Code.pptx
byapidays
 
PDF
How to Design Premium Health (Public Health) PPT Using AI? Top Strategies
byPublic Health Concern Nepal
 
PDF
Ethical AI applied to publishing: Presenting wâsikan kisewâtisiwin, an AI too...
byBookNet Canada
 
PPTX
Strategic Shelf Planning for the New Year Turning Resolutions into Revenue .pptx
byAnoop Ashok
 
PDF
Introduction to Linux and Basic Commands
byiDev Semarang
 
DOCX
Mathematical reviewer gor mmw in theofern
byyeojlevantinojesalva
 
MINDCTI Revenue Release Quarter 3 2025 - Financial Presentation
byMIND CTI
 
Getting the Best of TrueDEM – January News & Updates
bypanagenda
 
CRM for the Insurance Industry Lessons for Insurance CIOs and Digital Leaders...
byKerry Millar
 
Coded Agents – with UiPath SDK + LlamaIndex.pptx
bysuhanisingh58689
 
Skills to Pass the UiPath Agentic Automation Associate (UiAAA) Certification
byUiPathCommunity
 
API Gateway Architecture - Technical Report 2026
byPowersoft2026
 
Enterprise Data Services_ A Development Guide with Use Cases, Trends and Impl...
by2601harsh23
 
Deploying Windows Clients & Managing Identities
byVICTOR MAESTRE RAMIREZ
 
Database Management Systems: Basics, History, Data Models, etc.
byParithi Thamizh
 
Quick Learn Laravel for Beginner from Zero to Survive
byiDev Semarang
 
Safer’s Picks: Recent FME Enhancements with Big Everyday Impact
bySafe Software
 
How the EU Ecolabel's Record Growth Creates ESG Opportunities for CRE
byWastify AI
 
Code Like Bro -A guide for better Coding
byMadan Panthi
 
AI Meets DBA Transforming Database Administration with Intelligence
byGeoPITS Global Pvt Ltd
 
apidays Australia 2025 | Building AI RAG Applications with No Code.pptx
byapidays
 
How to Design Premium Health (Public Health) PPT Using AI? Top Strategies
byPublic Health Concern Nepal
 
Ethical AI applied to publishing: Presenting wâsikan kisewâtisiwin, an AI too...
byBookNet Canada
 
Strategic Shelf Planning for the New Year Turning Resolutions into Revenue .pptx
byAnoop Ashok
 
Introduction to Linux and Basic Commands
byiDev Semarang
 
Mathematical reviewer gor mmw in theofern
byyeojlevantinojesalva
 

You Know You Need PCI Compliance Help When…

  • 1.
    You Know YouNeed PCI Compliance Help When… Presented By: Peter Spier Manager Professional Services Fortrex Technologies Jim Raub Senior Director of Information Security and Compliance PAETEC Holding Corporation © 2010. All rights reserved.
  • 2.
    • Instructor Biographies •Background On Fortrex • Background on PAETEC • Overview of the PCI DSS • 3 Challenges • Common Scenarios • Time to Seek Help • Compliance Roles • Assessment Preparation • PCI DSS 2.0 Agenda © 2010. All rights reserved.
  • 3.
    Instructor Biography • PeterSpier is President of the ISACA Western New York Chapter and Manager Professional Services at Fortrex Technologies (www.fortrex.com) based in Frederick, Maryland. • Certifications include: CISSP, CISM, PMP, QSA, PA-QSA, ITILFv3, and CSF Assessor • Masters degree from Syracuse University School of Information Studies • 15 years of experience © 2010. All rights reserved.
  • 4.
    Instructor Biography © 2010.All rights reserved. • Jim Raub is Sr. Director, Information Security and Compliance at PAETEC (www.paetec.com) based in Fairport, NY. • Current Certifications include: CISSP, CISA, & CTM. Past certifications from Cisco, Microsoft, Informix, CompTIA and others. • Bachelors degree, Summa cum Laude, from Syracuse University, with coursework towards Masters at University of Rochester • 35 years of experience in management, consulting, security, software development, IT infrastructure, networks, and database administration
  • 5.
    Background on Fortrex GeneralFacts • IT Security, Operational Risk and Governance Consulting • Founded in 1997 • Headquarters in Frederick, Maryland • Privately Held • Approaching 1,000 Customers  Baltimore to Alaska to Guam • Broad Industry Coverage • QSA, PA-QSA & ASV • Abundance of References Integrity, Excellence, Empowerment, Teamwork and Thankfulness © 2010. All rights reserved.
  • 6.
    Background on PAETEC ©2010. All rights reserved. Caring Culture, Open Communication, Unmatched Service, Personalized Solution General Facts • Founded in 1998 • Headquarters in Fairport, New York • Publicly Traded (Nasdaq: PAET) • Serving over 84 of the top 100 Metropolitan Statistical Areas (MSAs) in the U.S. with personalized communications solutions • Core offerings include data, voice, and Internet communications services • Value-added solutions encompass data center colocation, communications management software, equipment, security and financing programs
  • 7.
    Overview of thePCI DSS Reviewing PCI DSS Compliance Requirements For The First Time Can Be A Daunting Task The “Dirty Dozen” Build and Maintain a Secure Network Requirement 1: Install and maintain a firewall configuration to protect cardholder data Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data Requirement 3: Protect stored cardholder data Requirement 4: Encrypt transmission of cardholder data across open, public networks Maintain a Vulnerability Management Program Requirement 5: Use and regularly update anti-virus software Requirement 6: Develop and maintain secure systems and applications Implement Strong Access Control Measures Requirement 7: Restrict access to cardholder data by business need-to-know Requirement 8: Assign a unique ID to each person with computer access Requirement 9: Restrict physical access to cardholder data Regularly Monitor and Test Networks Requirement 10: Track and monitor all access to network resources and cardholder data Requirement 11: Regularly test security systems and processes Maintain an Information Security Policy Requirement 12: Maintain a policy that addresses information security © 2010. All rights reserved.
  • 8.
    Challenge #1 Are youa Merchant or a Service Provider? © 2010. All rights reserved.
  • 9.
    Merchants Defined • Merchant- Any entity that accepts payment cards bearing the logos of any of the five members of PCI SSC (American Express, Discover, JCB, MasterCard or Visa) as payment for goods and/or services. © 2010. All rights reserved.
  • 10.
    Service Providers Defined •Service Provider - Business entity that is not a payment card brand member or a merchant directly involved in the processing, storage, transmission, and switching or transaction data and cardholder information or both. o This also includes companies that provide services to merchants, services providers or members that control or could impact the security of cardholder data.  Examples include managed service providers that provide managed firewalls, IDS and other services as well as hosting providers and other entities.  Entities such as telecommunications companies that only provide communication links without access to the application layer of the communication link are excluded © 2010. All rights reserved.
  • 11.
    When Merchants Are AlsoService Providers • A merchant that accepts payment cards as payment for goods and/or services can also be a service provider, if the services sold result in storing, processing, or transmitting cardholder data on behalf of other merchants or service providers.  For example, an ISP is a merchant that accepts payment cards for monthly billing, but also is a service provider if it hosts merchants as customers © 2010. All rights reserved.
  • 12.
    Challenge #2 What compliancelevel are you? © 2010. All rights reserved.
  • 13.
    Merchant Compliance Levels Level VisaMasterCard Discover American Express JCB 1 Merchants processing over 6 million Visa transactions annually (all channels) or Global merchants identified as Level 1 by any Visa region •Any merchant that has suffered a hack or an attack that resulted in an account data compromise •Any merchant having greater than six million total combined MasterCard and Maestro transactions annually •Any merchant meeting the Level 1 criteria of Visa •Any merchant that MasterCard, in its sole discretion, determines should meet the Level 1 merchant requirements to minimize risk to the system •All merchants processing a total of more than 6 million card transactions annually on the Discover network. •Any merchant Discover, in its sole discretion determines should meet the Level 1 compliance validation and reporting requirements •All merchants required by another payment brand to validate and report their compliance as a Level 1 merchant 2.5 million American Express Card transactions or more per year; or any Merchant that has had a data incident; or any Merchant that American Express otherwise deems a Level 1 One million JCB transactions or more per year 2 Merchants processing 1 million to 6 million Visa transactions annually (all channels) •Any merchant with greater than one million but less than or equal to six million total combined MasterCard and Maestro transactions annually •Any merchant meeting the Level 2 criteria of Visa •All merchants processing a total of 1 million to 6 million card transactions annually on the Discover network. •All merchants required by another payment brand to validate and report their compliance as a Level 2 merchant 50,000 to 2.5 million American Express Card transactions per year Less than one million JCB transactions per year © 2010. All rights reserved.
  • 14.
    Merchant Compliance Levels Level VisaMasterCard Discover American Express JCB 3 Merchants processing 20,000 to 1 million Visa e-commerce transactions annually •Any merchant with greater than 20,000 combined MasterCard and Maestro e- commerce transactions annually but less than or equal to one million total combined MasterCard and Maestro ecommerce transactions annually •Any merchant meeting the Level 3 criteria of Visa •All merchants processing a total of 20,000 to 1 million card-not-present only transactions annually on the Discover network •All merchants required by another payment brand to validate and report their compliance as a Level 3 merchant Less than 50,000 American Express Card transactions per year N/A 4 Merchants processing less than 20,000 Visa e- commerce transactions annually and all other merchants processing up to 1 million Visa transactions annually All other merchants All other merchants N/A N/A © 2010. All rights reserved.
  • 15.
    Service Provider Compliance Levels LevelVisa MasterCard Discover American Express JCB 1 VisaNet processors or any service provider that stores, processes and/or transmits over 300,000 Visa transactions annually •All TPPs •All DSE’s that store, transmit, or process greater than 300,000 total combined MasterCard and Maestro transactions annually All TPPs All TPPs All TPPs 2 Any service provider that stores, processes and/or transmits less than 300,000 Visa transactions annually Includes all DSE’s that store, transmit, or process less than 300,000 total combined MasterCard and Maestro transactions annually N/A N/A N/A © 2010. All rights reserved.
  • 16.
    Challenge #3 What requirementsapply? © 2010. All rights reserved.
  • 17.
    Merchant Reporting Requirements Level VisaMasterCard Discover American Express JCB 1 •Annual Report on Compliance (“ROC”) by Qualified Security Assessor (“QSA”) •Quarterly network scan by Approved Scan Vendor (“ASV”) •Attestation of Compliance Form •Annual On-site Assessment1 •Quarterly network scan by Approved Scan Vendor (“ASV”) •All merchants processing a total of more than 6 million card transactions annually on the Discover network. •Any merchant Discover, in its sole discretion determines should meet the Level 1 compliance validation and reporting requirements •All merchants required by another payment brand to validate and report their compliance as a Level 1 merchant 2.5 million American Express Card transactions or more per year; or any Merchant that has had a data incident; or any Merchant that American Express otherwise deems a Level 1 One million JCB transaction s or more per year 2 •Annual Self-Assessment Questionnaire (“SAQ”) •Quarterly network scan by ASV •Attestation of Compliance Form •On-site Assessment (At Merchant Discretion) •Annual Self-Assessment Questionnaire (“SAQ”)2 •Quarterly network scan by Approved Scan Vendor (“ASV”) •All merchants processing a total of 1 million to 6 million card transactions annually on the Discover network. •All merchants required by another payment brand to validate and report their compliance as a Level 2 merchant 50,000 to 2.5 million American Express Card transactions per year Less than one million JCB transaction s per year 1 Effective 30 June 2011, Level 1 merchants that choose to conduct an annual onsite assessment using an internal auditor must ensure that primary internal auditor staff engaged in validating PCI DSS compliance attend PCI SSC-offered merchant training programs and pass any PCI SSC associated accreditation program annually in order to continue to use internal auditors. 2 Effective 30 June 2011, Level 2 merchants that choose to complete an annual self-assessment questionnaire must ensure that staff engaged in the self-assessment attend PCI SSC-offered merchant training programs and pass any associated PCI SSC accreditation program annually in order to continue the option of self-assessment for compliance validation. Alternatively, Level 2 merchants may, at their own discretion, complete an annual onsite assessment conducted by a PCI SSC approved QSA rather than complete an annual self-assessment questionnaire. © 2010. All rights reserved.
  • 18.
    Merchant Reporting Requirements Level VisaMasterCard Discover American Express JCB 3 •Annual SAQ •Quarterly network scan by ASV •Attestation of Compliance Form •Annual SAQ •Quarterly network scan by ASV •All merchants processing a total of 20,000 to 1 million card-not-present only transactions annually on the Discover network •All merchants required by another payment brand to validate and report their compliance as a Level 3 merchant Less than 50,000 American Express Card transactions per year N/A 4 •Annual SAQ recommended •Quarterly network scan by ASV if applicable •Compliance validation requirements set by acquirer •Annual SAQ •Quarterly network scan by ASV All other merchants N/A N/A © 2010. All rights reserved.
  • 19.
    Service Provider Reporting Requirements LevelVisa MasterCard Discover American Express JCB 1 •Annual On-site security assessment by QSA •Quarterly network scans by ASV. •Annual On-site security assessment by QSA •Quarterly network scans by ASV. •Annual On-site security assessment by QSA (or internal auditor if signed by officer of Service provider). OR Annual Self-Assessment Questionnaire D •Quarterly network scans by ASV •Annual On-site security assessment by QSA (or internal auditor if signed by officer of Service provider). •Quarterly network scans by ASV. •Annual On- site security assessment by QSA •Quarterly network scans by ASV. 2 •Annual SAQ •Quarterly network scan by ASV •Annual SAQ •Quarterly network scan by ASV N/A N/A N/A © 2010. All rights reserved.
  • 20.
    Realization • Each cardbrand’s transaction-driven tiering and corresponding requirements differs from one brand to the other • For Self Assessment Questionnaire (SAQ) merchants, if you employ more than one transaction type, you’re obligated to use SAQ D • For Level 2 Service Providers, you’re obligated to use SAQ D • SAQ D is the long one… © 2010. All rights reserved.
  • 21.
    Suppose • You havebandwidth to spare • Your internal audit personnel possess broad and deep compliance framework experience • A team member has successfully completed a PCI DSS compliance assessment in the past When should you consider bringing in expert assistance from the outside? © 2010. All rights reserved.
  • 22.
    When Compliance LooksEasy • Familiar with ISO:27001? • Spoken with a colleague who indicated that their SAQ was a simple matter of checking all the ‘Yes’ boxes and signing it? • PCI DSS can be mapped to other frameworks, but its focus is explicitly cardholder data security • Compliance is never as easy as just checking all the ‘Yes’ boxes © 2010. All rights reserved.
  • 23.
    When You ReceiveAn E-mail Identifying Still Another Data Repository • Unidentified data repositories can: o Threaten momentum o Lower morale o Derail compliance efforts. • Late-in-the-game discoveries might cause you to: o Miss your target dates o Incur unforeseen penalties o Require re-work to remediate issues • Recommendation: Identify all payment flows through a combination of both human and automated means o Surveys o Interviews o Data analytics © 2010. All rights reserved.
  • 24.
    When You AreNot Certain Where Your Cardholder Data Environment Begins Or Ends • Does an unsolicited customer email automatically bring a system into the Cardholder Data Environment (CDE)? • If an end-user chooses to record a call and save it to local or LAN file, is the PC or fileserver in scope? • If the CDE firewall allows insecure protocols, is the scope reduced? • Is a workstation part of the CDE if it is used only to key in the Payment Account Number (PAN) to a hosted application through an encrypted channel?
  • 25.
    When You Re-ReadThe Same Requirement And Interpret It In Yet Another Way • Read the PCI DSS? • Attended seminars? • Poured over various forum threads and blog postings? • Was that requirement really non-applicable? • Does your planned compensating control truly go above and beyond the rigor and intent of the original requirement? • Is your “business justification” for leaving open a particular port or protocol sufficient? © 2010. All rights reserved.
  • 26.
    Time To SeekHelp • Good counsel may at first seem to be in abundance, but identifying the appropriate resource to provide accurate direction is critical • A different business’s compliance approach probably does not apply to your own environment • You can not simply repeat last year’s response • It probably does take an expert to address the “low hanging fruit” • Consulting a QSA prior to an assessment may prove to be the shortest path to achieving compliance © 2010. All rights reserved.
  • 27.
    Suggested Compliance Roles •Audit •CompleteSelf Assessment Questionnaire or Level 1 or 2 assessment •Periodic review of controls •Governance •Compliance oversight •Policy development and distribution •Coordination of organizational business units •Security Operations •Management and monitoring of controls •Internal vulnerability scanning and/or penetration testing •Log Review •Incident Response •System Administration •Account and authentication management •Access control management •Configuration management •Application Developers •Development and Testing •Code review •Revision control •Database Administrators •Record management •Access control management •Project Managers •Assessment and validation planning •Stakeholder coordination and reporting •Resource scheduling •Reporting •Senior Management •Report On Compliance review •Sign Attestation Of Compliance •Qualified Security Assessors •On-site assessment •Validation •Report On Compliance creation •Submission to the payment brands •Countersign Attestation Of Compliance •Approved Scanning Vendors •External quarterly vulnerability scans © 2010. All rights reserved.
  • 28.
    Assessment Preparation Scope •Scope ofthe cardholder data environment is defined as all system components which transmit, process, or store cardholder data. •Limiting the scope of the cardholder data environment may reduce the scope of assessment and ongoing compliance efforts. •Scope reduction strategies may include: •Network Segmentation •Tokenization •All systems receiving cardholder data directly and performing tokenization are in scope •End-to-End Encryption •All systems receiving cardholder data directly and performing encryption are in scope © 2010. All rights reserved.
  • 29.
  • 30.
    Tokenization © 2010. Allrights reserved.
  • 31.
    End-to-End Encryption © 2010.All rights reserved.
  • 32.
    Assessment Preparation Prioritized ApproachMethodology •Roadmap of compliance activities based on risk associated with storing, processing, and/or transmitting cardholder data. •Assists in prioritization of efforts to achieve compliance •Establishes milestones •Lowers the risk of cardholder data breaches sooner in the compliance process •Helps acquirers to objectively measure compliance activities and risk reduction by merchants, service providers, and others •Pragmatic approach that allows for “quick wins” •Supports financial and operational planning •Promotes objective and measurable progress indicators •Suitable for merchants who choose an on-site assessment or use SAQ D. © 2010. All rights reserved.
  • 33.
    Assessment Preparation Milestone Goals 1 Removesensitive authentication data and limit data retention. This milestone targets a key area of risk for entities that have been compromised. Remember – if sensitive authentication data and other cardholder data are not stored, the effects of a compromise will be greatly reduced. If you don’t need it, don’t store it. 2 Protect the perimeter, internal, and wireless networks. This milestone targets controls for points of access to most compromises – the network or a wireless access point. 3 Secure payment card applications. This milestone targets controls for applications, application processes, and application servers. Weaknesses in these areas offer easy prey for compromising systems and obtaining access to cardholder data. 4 Monitor and control access to your systems. Controls for this milestone allow you to detect the who, what, when, and how concerning who is accessing your network and cardholder data environment. 5 Protect stored cardholder data. For those organizations that have analyzed their business processes and determined that they must store Primary Account Numbers, Milestone Five targets key protections mechanisms for that stored data. 6 Finalize remaining compliance efforts, and ensure all controls are in place. The intent of Milestone Six is to complete PCI DSS requirements and finalize all remaining related policies, procedures, and processes needed to protect the cardholder data environment. © 2010. All rights reserved.
  • 34.
    PCI DSS 2.0 Requirement Reasonfor Change Change Category Introduction Clarify Applicability of PCI DSS and cardholder data. Clarify that PCI DSS Requirements 3.3 and 3.4 apply only to PAN. Align language with PTS Secure Reading and Exchange of Data (SRED) module. Clarification Scope Ensure all locations of cardholder data are included in scope of PCI DSS assessments Clarify that all locations and flows of cardholder data should be identified and documented to ensure accurate scoping of cardholder data environment. Guidance Introduction and Various Provide guidance on virtualization. Expanded definition of system components to include virtual components. Updated requirement 2.2.1 to clarify intent of “one primary function per server” and use of virtualization. Guidance 1 Further clarification of the DMZ. Provide clarification on secure boundaries between internet and card holder data environment. Clarification 3.2 Clarify applicability of PCI DSS to Issuers or Issuer Processors. Recognize that Issuers have a legitimate business need to store Sensitive Authentication Data. Clarification © 2010. All rights reserved.
  • 35.
    PCI DSS 2.0 (Continued) Requirement Reasonfor Change Change Category 3.6 Clarify key management processes. Clarify processes and increase flexibility for cryptographic key changes, retired or replaced keys, and use of split control and dual knowledge. Clarification 6.2 Apply a risk based approach for addressing vulnerabilities. Update requirement to allow vulnerabilities to be ranked and prioritized according to risk. Evolving Requirement 6.5 Merge requirements to eliminate redundancy and Expand examples of secure coding standards to include more than OWASP. Merge requirement 6.3.1 into 6.5 to eliminate redundancy for secure coding for internal and Web-facing applications. Include examples of additional secure coding standards, such as CWE and CERT. Clarification 12.3.10 Clarify remote copy, move, and storage of CHD. Update requirement to allow business justification for copy, move, and storage of CHD during remote access. Clarification © 2010. All rights reserved.
  • 36.
    Thank You. © 2010.All rights reserved.