View
34
Download
4
Category
Tags:
Preview:
Citation preview
Can you protect my Credit Card data? It is 2015 after all!
Compliance (PCI-DSS), emerging technologies, and scope reduction
Mr. Kelvin Medina, CISSP, SEC+, ITIL
Presenter
Mr. Kelvin Medina, CISSP, SEC+, ITIL
Security Engineer, University of Miami (UM)
Contact Information
305-284-1005 (Office)
kmedina1@miami.edu
kmedina@jhu.edu (personal)
https://www.linkedin.com/in/kelvinmedina
Presenter (Who is this guy anyway!?)
• Information Security Engineer (ISE) at the University of Miami (UM)• IT enterprise compromised of more than 25k users, 700 plus applications, and over $160 millions
in credit card transactions per year across different facilities in South Florida
• Previously, Information Systems Security Officer (ISSO) at the US Navy• Lately conducting mission assurance assessments on cybersecurity across the world for the DoD• Software Engineer for the submarine-launched ballistic missiles (SLBMs) Trident II
• Recent public engagements• “Your biggest cyber threat? Naïve end-users”, United States Cybersecurity Magazine, January 2015• Panelist, “Network Security and PCI-DSS”, South Florida Technology Alliance (SFTA), February 2015
• Education• BS Computer Science, University of Puerto Rico• MS Technical Management, Johns Hopkins University• Global Pre-MBA Leadership Program, Yale University
Life according to PCI-DSS
• 1.3.5 Is outbound traffic from the cardholder data environment to the Internet explicitly authorized?
• 2.2.2 Disable unnecessary services and protocols
• 2.2.4 Remove all unnecessary functionality
• And 300 plus requirements (and counting!)
Moving toward a data centric approach
• Data centric approach• Cell level security (e.g. Transparent Data Encryption (TDE) in Azure SQL)
• Encryption (e.g. P2PE)
• Security containers (e.g. MobileIron MDM)
• Social, Mobile, Analytics, and Cloud (SMAC)
Point to Point Encryption (P2PE)
• End-to-End encryption (E2EE) is not equal to P2PE
• Point of Interaction (POI) is the key here
VISA expand Technology Innovation Program (TIP) Expanded• VISA TIP now includes merchants
who process at least 75% of their transactions through a PCI-validated P2PE solution• Effective on April 1st, 2015
• Annual PCI-DSS validation assessment might be waived
Magnetic Stripe Technology
• Virtually no changes since its introduction in the 1960s
• Prone to• Skimming (capture the track data)
• Shoulder-surfing (watch the PIN as it is being entered)
Europay, Visa, Mastercard (EMV) Technology
• EVM or smart cards were patented by in the 1970’s by France, Germany, and Japan
• Started as a way to store bank account information securely on a card
EMV Workflow1. Match between Terminal and Chip Card’s Application ID
• ARQC’s algorithm create cryptogram • Chip Card Master Key (unique value to the card) + Session Key (unique to the transaction) as parameters
• ARQC is encrypted/hashed w/Chip Card Master key, result is 16 characters HEC ARQC: 1A2B3C4D5E6F4321
2. Terminal → ARQC → Acquirer
3. Acquirer → ARQC → Issuer
4. Issuer validates ARQC by creating its own ARQC using a HSM and makes authorization decision. 5. Issuer ARPC → Acquirer6. Acquirer → ARPC → Terminal
7. Terminal send ARPC to Chip Card plus optional Issuer’s commands (e.g. card block) • Issuer’s command known as the Application Protocol Data Unit (APDU)• The Chip Card validates the ARPC by creating its own and approve any APDU sent by Issuer• Chip Card respond back to the Terminal indicating whether or not the command was executed successfully
EMV Deadline
• Liability fraud shift from Issuer to Merchant• Oct 2015
• Not an actual PCI-DSS requirement
What is tokenization?
As per PCI-DSS “a process by which the primary account number (PAN) is replaced with a surrogate value called a ―token. De-tokenization is the reverse process of redeeming a token for its associated PAN value.”
Takeaways
• Whenever you consider a new product or service, • Weight pros and cons
• Use a security first approach• Security is engaged as early as possible during the acquisition process
• Clearly understand all the responsibilities• Your responsibilities• Your Vendor responsibilities
• Focus on security as an overall strategy for your business
• See security as an integrated part of your business
• AND finally make informed, risk based decisions
Recommended