Upload
theodore-mclaughlin
View
219
Download
3
Tags:
Embed Size (px)
Citation preview
Introduction to Payment Card Industry Data Security Standard
21st Annual ECI Conference
Simon Pugh
History of PCI Security Standards Council
• Responsible for development, management education and awareness of PCI Security Standards
• Formed by American Express, Discover, JCB, MasterCard and Visa in 2006
• Its genesis dates back to work underway during the dot-com boom a decade ago
21st Annual ECI Conference
Three Components of PCI
21st Annual ECI Conference
Source: PCI Security Standards Council
PCI DSS – 6 Goals, 12 Requirements
Build and Maintain a Secure Network 1. Install and maintain a firewall configuration to protect cardholder data2. Do not use vendor-supplied defaults for system passwords and other
security parameters
Protect Cardholder Data 3. Protect Stored Data4. Encrypt transmission of cardholder data across open, public networks
Maintain a Vulnerability Management Program 5. Use and regularly update anti-virus software6. Develop and maintain secure systems and applications
Implement Strong Access Control Measures 7. Restrict access to cardholder data by business need-to-know8. Assign a unique ID to each person with computer access9. Restrict physical access to cardholder data
Regularly Monitor and Test Networks 10. Track and monitor all access to network resources and cardholder data11. Regularly test security systems and processes
Maintain an Information Security Policy 12. Maintain a policy that addresses information security
21st Annual ECI Conference
Applicability of PCI DSSData Element Storage Permitted Protection
Required
Cardholder Data Primary Account Number (PAN)
Yes Yes
Cardholder Name Yes Yes*
Service Code Yes Yes*
Expiration Date Yes Yes*
Sensitive Authentication Data (Post Authorization)
Full Magnetic Stripe Data No N/A
CAV2/CVC2/CVV2/CID No N/A
PIN/PIN Block No N/A
21st Annual ECI Conference
Source: PCI Security Standards Council* If stored in conjunction with the PAN
Six steps to PCI DSS Compliance
• If you don’t need it, don’t store it• Secure the perimeter• Secure applications• Control access to systems• Protect stored cardholder data• Finalize remaining compliance efforts, and
ensure all controls are in place
21st Annual ECI Conference
A Simple view of a Payment Transaction
21st Annual ECI Conference
THE ANATOMY OF A TRANSACTION
A U T H O R I Z A T I O N TIME OF PURCHASE
MasterCard authorization system
Cardholder submits Merchant’s bank asks valida tes ca rd security fea tu res and
MasterCard account MasterCard to determine approves send ing to cardho lder’s ba nk
to merchant cardholder’s bank for purchase approval
1 2 3
7 6 5 4
Cardholder completes Merchant’s bank sends MasterCard sends approval Cardholder’s bank
purchase and receives receipt approval to merchant to merchant’s bank approves purchase
C L E A R I N G U SU A LLY W ITH IN O N E D AY
Merchant’s bank sends
MasterCard clearing system validates
information and approves sending purchase
purchase information to information to cardholder’s bank, which
MasterCard network prepares da ta fo r cardholder’s sta tem en t
1 2
3 MasterCard clearing system provides comprehensive reconciliation to both the merchant’s bank and to the cardholder’s bank
Source: MasterCard Worldwide
The Retailer’s View
21st Annual ECI Conference
`POS
In-StoreProcessor
Wireless AP
`
Headquarter/Data Center
WAN
Kiosk
Store
Line of business and management servers
`
Wireless Devices
Corporate
Router/Switch
Router
VLAN 1
VLAN 2
VLAN 3
VLAN 4
`POS
`POS
`POS
In-StoreProcessor
Wireless AP
`
Headquarter/Data Center
WAN
Kiosk
Store
Line of business and management servers
`
Wireless Devices
Corporate
Router/Switch
Router
VLAN 1
VLAN 2
VLAN 3
VLAN 4
`POS
`POS
PCI DSS - Concluding Thoughts
• PCI DSS seems simple in theory – compliance is far more challenging and expensive
• Not complying can be far more costly though!• Technologies such as Chip+PIN may reduce the
value of compromised cardholder data but don’t simplify the burden of compliance – today.
21st Annual ECI Conference