Let's look at some of the key PCI SSC qualifications and what they
allow people to do, starting with a Qualified Security Assessor, or
QSA, which is the most common PCI qualification.
A QSA will have been trained in PCI DSS and also in
what we're learning in this course,
how payments work and the different roles of acquirers,
brands, and issuers.
At the end of their mandatory training,
they have to sit an exam, and if they pass the exam, they are
authorized to conduct PCI DSS assessments of organizations.
Remember, QSAs work for companies that have been approved by
the PCI SSC to carry out PCI DSS assessments.
The Internal Security Assessor, or ISA, works for an organization
that handles cardholder data, so that's typically a merchant, or a
service provider to a merchant, or a financial institution like an
issuer or an acquirer.
The organization must be a PCI participating organization, so that means it has
a relationship with the PCI SSC that allows them to have ISAs, and it also
allows them to attend the annual PCI Community Meeting.
The ISA is trained to exactly the same standards as a QSA. So they've
been trained in PCI DSS, and therefore, they are authorized to
conduct PCI DSS assessments if the card scheme or card brand allows
an ISA to conduct an assessment.
Some card schemes do allow ISAs to conduct PCI DSS assessments for
some types of merchants and other card schemes don't. Typically, an
ISA is going to be working for the internal audit department. To do
an internal assessment, the assessor has to be independent from the
people that are making the controls and the requirements and the
security happen.
All of the other types of assessors for the other PCI standards,
such as Secure Software, P2PE, 3DS, PIN, and Card Production all
have to be PCI DSS QSAs first.
Then they take the mandatory training and another exam in the other
standard they want to be able to assess against.
Typically, they will need to demonstrate some specialist technical knowledge
alongside knowledge of the particular standard, and that's largely going to be
in relation to cryptography and key management,
enhanced levels of physical security that apply to secure
zones, and then for the software standard,
secure software development and programming knowledge. A Qualified
Integrator and Reseller, or QIR, works for a company that installs
point‑of‑sale software in retail merchants. That's the software that
sits on the electronic cash registers.
Often this software is going to be compliant with the
Secure Software Standard or previously would have been
validated to the PCI PA‑DSS standard.
Now,
many breaches in retail environment have been caused by payment
software being installed and configured badly,
for example,
by leaving all the system passwords for the whole company as the
default password as it came from the manufacturer.
So that makes it very easy for the criminals to steal cardholder data.
So the QIR program was developed to train people that install those
types of systems on how to configure them securely.
And some card schemes have made the use of a QIR mandatory now for
face‑to‑face retailers. An approved scanning vendor provides
external vulnerability scans to organizations.
An external vulnerability scan is software that probes an organization's
internet‑facing systems to look for known vulnerabilities or
misconfigurations that could be exploited by an attacker.
These types of scans are very important in keeping data
secure because in the early days of the internet when people
really didn't understand security,
they just connected stores and web servers to the internet
without a firewall. Forcing organizations to have scans and
remediate vulnerabilities was an initiative from one of the
card brands to improve security.
So their program for accrediting scanning vendors and
requiring scans became part of the PCI program.
Some card brands still require companies to have external scans and
report the findings to their acquirer, but it is now also a requirement
in PCI DSS. The PCI program for ASVs has requirements for the operation
of the scanning tool, and then also, the personnel in the ASV company
have to be trained.
The PCI Forensics Investigator, or PFI, is a QSA who's had extensive
training and experience in computer forensics.
Their role is to determine what happens after a breach of cardholder data. So
they will come in, they will try and determine the cause of the breach, and
they will make sure that the breach has been sealed and that the criminal is no
longer active in the company's network.
Now, I've met some of these people, and they're generally very nice people,
but I do hope you never have the opportunity to work with
them on a professional basis because that would imply you've
had a breach of cardholder data.