Surviving the PCI Self -Assessment James Placer, CISSP West Michigan Cisco Users Group Leadership...
-
Upload
colten-jacobi -
Category
Documents
-
view
219 -
download
3
Transcript of Surviving the PCI Self -Assessment James Placer, CISSP West Michigan Cisco Users Group Leadership...
Surviving the PCI Self -Assessment
James Placer, CISSPWest Michigan Cisco Users Group Leadership Board
Agenda
• Overview of the Payment Card Industry Data Security Standard (PCI DSS)
• PCI DSS requirements• Merchant levels• Requirements of Self-Assessment• The ASV conflict. • Questions
Protecting card data
• Why it’s important• causes hardship for our customers• loss of customer confidence• required by PCI DSS• state laws on “disposal” and “notice”• State breach law notification requirements
Overview of PCI DSS
The basis is - cloned cards must never again be capable of being created from stored data, through compromise or eavesdropOne can store elements of the Track II i.e. a card number, expiry date, when required for particular cards. ( front of card information ONLY)In no circumstances should the CVV or the PIN verification value data elements be store
Overview of PCI DSS• Applies to
• all merchants that “store, process, or transmit cardholder data” ( if you accept one credit card payment a year you must be compliant)
• all payment (acceptance) channels, including brick-and-mortar, mail, telephone, e-commerce (Internet)
• Includes 12 requirements, based on• administrative controls (policies, procedures, etc.)• physical security (locks, physical barriers, etc.)• technical security (passwords, encryption, etc.)
Shared Network Resources
• A network that is shared by other services cannot be considered secure.
• …• whatever we think of our wider network,
we cannot fully “trust” it
Merchant levels• Merchant levels are based on yearly transaction
volume of merchant• Specific criteria for placement in merchant levels
varies across card companies• All merchants, regardless of level, must adhere to
PCI DSS requirements• Level into which merchant is placed determines
PCI DSS compliance validation (and ultimately cost)
• Let’s take a quick look at Visa’s levels…
Merchant levels - Visa
• Level 2:• merchants, regardless of acceptance channel,
processing 1,000,000 to 6,000,000 Visa transactions
• Level 3:• any merchant processing 20,000 to 1,000,000
Visa e-commerce (Internet) transactions
Merchant levels - Visa
• Level 4:• any merchant processing fewer than 20,000
Visa e-commerce (Internet) transactions• all other merchants, regardless of acceptance
channel, processing up to 1,000,000 Visa transactions
PCI DSS compliance validation
• Level 2 and 3 merchants• self-assessment questionnaire• quarterly network security scan by approved
scan vendor (ASV)
PCI DSS compliance validation
• Level 4 merchants• self-assessment questionnaire
• if required by acquirer
• quarterly network security scan by approved scan vendor• if required by acquirer
PCI DSS compliance validation
• 5 levels of self assessment
• • 4 self assessment questionnaires
Self Assessment Questionnaire
• Type 1Card-not-present (e-commerce or mail/telephone-
order) merchants, all cardholder data functions outsourced. This would never apply to face-to-face merchants. Use questionnaire A
• Type 2 Imprint-only merchants with no electronic cardholder
data storage. Use Questionnaire B
Self Assessment Questionnaire
• Type 3Stand-alone terminal merchants, no electronic
cardholder data storage Use questionnaire B
• Type 4 Merchants with POS systems connected to the
Internet, no electronic cardholder data storage . Use Questionnaire C
Self Assessment Questionnaire
• Type 5All other merchants (not included in Types 1-4
above) and all service providers defined by a payment brand as eligible to complete an SAQ.
• May be required to perform full Self-Assessment form as opposed to short forms A through C)
Authorized Scanning Vendors
• External ASV scan may be required for self assessment.
• Not all ASV's are created equal• ASV's must be approved by PCI and on the
PCI authorized scanning vendor list• DO NOT automatically use the
“recommended” ASV of your card processor!!!
PCI DSS requirements
First step is to document the FULL path of credit card data through your company.
This is electronic as well and procedural
If you do not know the path you cannot self- assess!!!!!
Card Environment MUST be isolated...
PCI DSS requirementsBest Practice to be applied!
Each requirement has many sub-requirements!
1. Install and maintain a firewall configuration to protect data
2. Do not use vendor-supplied defaults for system passwords and other security parameters
3. Protect stored data
PCI DSS requirements
1. Encrypt transmission of cardholder data and sensitive information across public networks
2. Use and regularly update anti-virus software
3. Develop and maintain secure systems and applications
4. Restrict access to data by business need-to-know
PCI DSS requirements
1. Assign a unique ID to each person with computer access
2. Restrict physical access to cardholder data3. Track and monitor all access to network
resources and cardholder data4. Regularly test security systems and
processes5. Maintain a policy that addresses
information security
Resources
PCI DSS self assessment guidelineshttps://www.pcisecuritystandards.org/saq/
instructions.shtml
The PCI DSS guidance documenthttps://www.pcisecuritystandards.org/
security_standards/pci_dss.shtml
Questions???