8/7/2014

Update from the PCI Security Standards Council
Troy Leach, CTO, PCI Security Standards Council

Guiding open standards for global payment card security

Evolution ofCyber Attacks
VirusesTrojanHorses

Worms

Custom
MalwareAdvanced
PersistentThreats

Guiding open standards for global payment card security

1

8/7/2014

Modern Malware Hides Itself

Guiding open standards for global payment card security

Top Mistakes Revealed by Forensic Audits
Weak or default
passwords

Lack of employee
education

Security deficiencies
introduced by thirdparties

Slow self-detection

Source: 2013 Trustwave Global Security Report

Guiding open standards for global payment card security2

8/7/2014

A Multi-layered Approach is Needed++Processes

Technology=People

Security

Guiding open standards for global payment card security

PCI Standards are the Foundation
With version 3.0, PCI DSS
is more mature than ever,and covers a broad baseof technologies andprocesses such as
encryption, access
control, and vulnerability
scanning to offer a soundbaseline of security.

PCI DSS has madecomprehensive security controls
more commonplace in larger
organizations. Therefore, theorganizations become moredifficult to compromise.

Source: 2013 Trustwave Global Security Report

92%

97%

Guiding open standards for global payment card security

38/7/2014

PCI DSS, PA-DSS 3.0 – Key Themes

Education
Awareness

Flexibility

Security as a
SharedResponsibility

Make PCI your compass, not your roadmap
Guiding open standards for global payment card security

At a Glance…

• 12 core security principles of PCI DSS
remain the same
• Several new sub-requirements that will
impact PCI DSS security efforts• Future implementation dates provided
for more significant changes• Clarified PCI DSS Applicability• Enhanced testing procedures to clarify
level of validation expected for eachrequirement• Aligned language between requirements
and testing procedures for consistency• Instructions for Report on Compliance(ROC) reporting now separate ROC
reporting template
Guiding open standards for global payment card security

4

8/7/2014

Maintaining ComplianceBest Practices for
Implementing PCI DSS toStay Secure• Focus on security notcompliance• PCI DSS is not a once-ayear activity• Don’t forget about people

Guiding open standards for global payment card security

Understanding Intent of Requirements

Guiding open standards for global payment card security

5

8/7/2014

Impactful Changes – Requirement 1.1.3
Do you know where your data is?

Requirement 1.1.3 Current diagram that shows all cardholder data flow

Guiding open standards for global payment card security

Physical Security for POS Devices
9.9 Protect devices that capture payment
card data from tampering and substitution• Maintain an up-to-date list ofdevices• Periodically inspect device surfaces
to detect tampering or substitution• Provide training for personnel to beaware of attempted tampering or
replacement of devices

Guiding open standards for global payment card security

6

8/7/2014

Penetration Testing and Effective Scoping

11.3

Implement a penetration testing methodology

11.3.4

If segmentation is used, perform penetration tests to verify that thesegmentation methods are operational and effective.

Guiding open standards for global payment card security

Security as a Shared Responsibility
Guidance• Outsourcing PCI DSS responsibilities.

Requirement 8• Service providers use unique credential
per customer

Requirement
12• Service providers acknowledge
responsibility

Guiding open standards for global payment card security7

8/7/2014

Service Provider Requirements• Maintain program to monitor
Ser vice Providers PCI DSS status• Maintain which requirements aremanaged by each ser vice provider• Ser vice provider acknowledges inwriting their responsibility toprotect cardholder data

Guiding open standards for global payment card security

Important Dates for v3.0 PCI DSS

Version 3.0
was effective
on 1 January
2014

Version 2.0 isvalid until 31
December
2014

Check ourwebsite forSAQs, FAQS,
Prioritized
ApproachFeedback
period kicks
off atCommunity
MeetingsDo not mix and match

Guiding open standards for global payment card security

88/7/2014

Technology and Emerging Payments

Cloud computing reduces total cost of ownership but at what expense?
Mobile provides new payment alternatives but is it ‘smart’?

New technology emerging to remove sensitive data
Guiding open standards for global payment card security

Guiding open standards for global payment card security

9

8/7/2014

Market Today
75% new merchantsusing mobile

How many apps?

Billiondevices
50% increase of merchantpopulation

Guiding open standards for global payment card security

19

Mobile Payment Acceptance
PCI Standards focus onmerchant-acceptance
Mobile payment acceptancestill evolving

Understand risk and use PCI
SSC resources
PCI SSC is working withindustry
Guiding open standards for global payment card security

10

8/7/2014

Mobile Guidelines and Best Practices
Guidelines published2012-2013• PCI Mobile Payment
Acceptance Guidelines forDevelopers• PCI Mobile Payment
Acceptance Guidelines for
Merchants as End-Users• Accepting Mobile Paymentswith a Smartphone or Tablet
Guiding open standards for global payment card security

Why Mobile Guidance, Not Standards

Guiding open standards for global payment card security

11

8/7/2014

In the Cloud

Guiding open standards for global payment card security

Shared Responsibility

Cloud provider

Cloud customer (client)

Guiding open standards for global payment card security

12

8/7/2014

Cloud Computing Guidelines
Different cloud types

Role of cloud customers and providers
Considerations for PCI DSS

Scoping and segmentation
Compliance Challenges
Risks and Security Challenges

Guiding open standards for global payment card security

Key Recommendations
Cloud computing is still evolving and is yet to be standardized

Outsourcing management of security controls does not equate tooutsourcing of PCI DSS responsibility

Understand scope for both parties

Due diligence, contractual agreements (SLAs), and ongoing monitoringare critical
Guiding open standards for global payment card security

13

8/7/2014

Where the Footprint Begins

66% of data breaches, theorganization didn’t know
the data was on thecompromised system

VERIZON DATA BREACH INVESTIGATIONSREPORT

Guiding open standards for global payment card security

Ways to Reduce the Footprint
Reduce theneed orability tostore ortransmit
cardholder
data

Business process forretention
P2PETokenization

Guiding open standards for global payment card security

14

8/7/2014

EMVChipHelpsReduce
Face-toFace
Fraud

Guiding open standards for global payment card security

Even EMV Chip Needs PCI

Guiding open standards for global payment card security

15

8/7/2014

Terminal Security

Guiding open standards for global payment card security

Point-to-Point Encryption

Guiding open standards for global payment card security

16

8/7/2014

What is a PCI P2PE Solution?

PCI PTS approved devices withSRED
PCI P2PE validated applications
and processes

Listed by PCI SSC

Guiding open standards for global payment card security

P2PE and Merchants

Only PCI-listed P2PE solutions
are recognized as meeting
requirements for reducing
merchant PCI DSS scope

Merchants and their acquirers
accept the risk when using
encr yption solutions notlisted by the Council

Guiding open standards for global payment card security

17

8/7/2014

Tokenization
Ensure that token
a tokencannotor collection
be usedof
intokenslieu of by
Ensure that adequate
process ofcontrols
creatingexist
token
overfromthemselves
PAN
cannotfeasiblyallow
discoveryWorkon tokenization
standards
hasPANbegunof
PAN
de-tokenization
doesn’tleakprocess
informationabout
PANimpermissible purposesforPANTokenization

Guiding open standards for global payment card security

The Formula for PCI Success++Technology

Processes=PeopleSecurity

Guiding open standards for global payment card security

18

8/7/2014

Questions?

Please visit our website atwww.pcisecuritystandards.org

Guiding open standards for global payment card security

19