8/7/2014

PCI Security Standards Council
Bob Russo, General Manager
PCI Security Standards
Council
Guiding
open standards for global payment card security

Why PCI Matters

About the Council

AgendaOur Resources

Get Involved

Guiding open standards for global payment card security

1

8/7/2014

Why PCI Matters

Guiding open standards for global payment card security

As Global Use Rises, So Does Risk

Growth in Purchase Transactions Worldwide from2011-2016

33%

51%

105%

44%

97%

99%
99%
©2013 The Nilson
ReportGuiding open standards for global payment card security2

8/7/2014Your card data is a gold mine for criminals
Types of Data on a Payment Card
CID(American Express)

ChipPanCardholder Data

Expiration Date

Magnetic Strip(data on tracks 1 & 2)

CAV2/CID/CVC2/CW2(Discover, JCB, MasterCard, Visa)

Guiding open standards for global payment card security

Business Sectors with the Most Breaches

Guiding open standards for global payment card security3

8/7/2014

People inPayment
Chain
Cause
Most
Internal
Breaches!
Top Mistakes Revealed by Forensic Audits

Weak or default
passwords

Lack of employee
education

Security deficiencies
introduced by thirdparties

Slow self-detection

Source: 2013 Trustwave Global Security Report

Guiding open standards for global payment card security

4

8/7/2014

How Can These Challenges be Overcome?

Guiding open standards for global payment card security

About the Council

Guiding open standards for global payment card security

5

8/7/2014

About the PCI Council
Open, global forum
Created in 2006

Guiding open standards for payment card security• Development• Management• Education• AwarenessGuiding open standards for global payment card security

PCI: Architecture for Payment Card Security

Five major card brandsdrive efforts forpayment card security
PCI Security Standards
Council manages thetechnical standards
and processes

Guiding open standards for global payment card security

6

8/7/2014

Ground Rules
PCI SSC…

PCI SSC Does Not…

• Is an Independent Industry
Standard• Manage or Drive Compliance• Manages the technical andbusiness requirements for how
payment data should be stored
and protected• Maintains Lists of Qualified PCI
Assessor Community– Each brand continues tomaintain its own complianceprograms• Identifies stakeholders that needto validate compliance• Definitions of Validation Levels• Fines and Fees

– QSAs, ASVs, PA-QSA, PFI andPTS Labs

Guiding open standards for global payment card security

8/7/2014

13

Expanding Global Representation
PCI Council Participating Organizations

1234681540
20

Guiding open standards for global payment card security7

8/7/2014

Our Resources

Guiding open standards for global payment card security

PCI Security Standards Suite
Protection of Cardholder Payment Data

Manufacturers

PCI PTS
Pin Entry
Devices

SoftwareDevelopers

Merchants &Service Providers

PCI PA-DSS

PCI DSS

PaymentApplications

SecureEnvironments

PCI Security& Compliance

P2PE

Ecosystem of payment devices, applications, infrastructure and users
Guiding open standards for global payment card security

8

8/7/2014

The Standards Continually Evolve

Guiding open standards for global payment card security

PCI DSS, PA-DSS 3.0 – Key Themes

Education
Awareness

Flexibility

Security as aShared
Responsibility

Make PCI your compass, not your roadmap
Guiding open standards for global payment card security

9

8/7/2014

On the Lookout for New Technologies

Guiding open standards for global payment card security

The Formula for PCI Success++Technology

Processes=PeopleSecurity

Guiding open standards for global payment card security

10

8/7/2014

Maintaining Security is Running a Marathon,
not a Sprint

Guiding open standards for global payment card security

Preparing for
the Future
Personal PCI training
is essential to keep
on top of emerging
threats

PCI training by theCouncil is the mosteffective, targeted
way to acceleratemaster y and stay
current

Validation proves
your value to youremployer and sets
you apart from socalled “experts”

Guiding open standards for global payment card security

11

8/7/2014

Training Highlights
 PCI DSS 3.0 Insider’s Guide
 PCI Essentials

 Online Internal Security Assessor (ISA)
Training

 Corporate Group Training– Let Us Come To
You!

 Online Awareness Training in Four Hours
 Qualified Integrators and Resellers (QIR)™
Program PCI
Professional
Program (PCIP)™
To learnmore, visit:www.pcisecuritystandards.org/training

Guiding open standards for global payment card security

What’s New for 2014: PCI DSS 3.0 Insider
Training

New “Businessas Usual”

Enhanced
Sampling Clarity
for Assesors

Reporting &Guidance
ColumnTargeted, comprehensive education on theintent, interpretation and implementation of
the major changes from DSS v2.0Modules, total 90 minutes
o Module 1 : Overview of intent
o Module 2: v3.0 changes. 12 learning
segments
Emphasis on Security as the new “Business asUsual”
Step by step sampling clarity for auditors
Using the new “Guidance” column
Delivered by Security Innovation

To learn more, visit:www.pcisecuritystandards.org/training
Guiding open standards for global payment card security

12

8/7/2014

PCI Essentials• 10 interactive modules
provide thorough primer on
PCI topics• Each module takes approx
20 minutes to complete, forover 2 hours of learning
content

Guiding open standards for global payment card security

Online Resources

Guiding open standards for global payment card security

13

8/7/2014

PCI SSC Website• Documents library• Dedicated page forsmall merchants• Listings of approved
companies andproviders• Videos and webinars• Frequently asked
questions microsite
Guiding open standards for global payment card security

Multilingual Resources on the PCI Website
FrenchSpanish
Japanese
GermanItalian
Portuguese
ChineseRussianGuiding open standards for global payment card security

14

8/7/2014

New Videos & Quick Resources

www.pcisecuritystandards.org/news_events/quick_resources.php

Guiding open standards for global payment card security

Participation Opportunities

Guiding open standards for global payment card security

15

8/7/2014

Security is a shared
responsibility

Guiding open standards for global payment card security

Help Participate in Standards Development

Implementation
Feedback

FormalFeedback

Draft Revisions
Feedback

Guiding open standards for global payment card security

16

8/7/2014

Attend 2014 Community Meetings
North America

9-11 September
Orlando, Florida

Europe7-9 October
Berlin, Germany

Asia-Pacific18-19 November
Sydney, Australia

Guiding open standards for global payment card security

Be Part of Special Interest Groups
Community-driven initiatives that provide
additional guidance and clarifications orimprovements to the PCI Standards andsupporting programs.

Guiding open standards for global payment card security

17

8/7/20142015 SIG Selection Timeline• SIG proposal presentations at Community
Meetings –11 September; 9 October• SIG election – 13-23 October• 2015 SIG winners announced – 6 November• 2015 SIG registration opens – 8 December• 2015 SIG kick-off – January 2015

Guiding open standards for global payment card security

Small businessfocused marketing
campaign

Focus oneducation andawareness aroundpassword security
for payments

Bring together
global channel
partners toeducate,disseminate
informationwww.pcisecuritystandards.org/smb/passwords_for_payments.html
Guiding open standards for global payment card security

18

8/7/2014

Get Involved – We Need Your Input

Join

Learn

Input

Network

Nominate

Vote

Share

Influence

Guiding open standards for global payment card security

Stand Out From the Crowd – Become a PO
Benefits of Participating
Organization (PO):• Two free passes to Community
Meetings• Savings on Council training• Ability to vote for Board ofAdvisors officers• Opportunity to participate inSIGs• And more!

Guiding open standards for global payment card security

198/7/2014

Contribute Your Expertise!

Chief Security
Officers

Information
Security
Professionals

IT Managers

Risk Managers

Compliance
Officers

Forensic
Investigators

Technologists

Information
Officers

Legal Experts

Data Security
Experts

Join! Become aParticipating
Organization
today
Chief

Guiding open standards for global payment card security

Compliance Doesn’t Equal Security

Guiding open standards for global payment card security

20

8/7/2014

You are our future

Guiding open standards for global payment card security

21