Hello, my name is John Elliott, and welcome to PCI DSS, The Big Picture.
This course describes the what, the when,
the where, the why, the who,
and even the how of the payment card industry data
security standard in just 60 minutes.
In fact, if you're in a real hurry,
the first 10 minutes will be enough for you to sit through a
PCI DSS meeting and not be too confused.
So if you're involved in a PCI project or just PCI curious,
this is the course for you, just the basics,
nothing more, nothing less,
so let's jump straight in with a really simple question,
what is PCI DSS?
And actually, that's not such a simple question,
because when people talk about PCI DSS,
they can be talking about two separate things.
They'll either be referring to the written technical standard,
the payment card industry data security standard,
or they're referring to a compliance program that requires
an organization to comply with the requirements written in
that technical standard.
And I'm going to talk about this distinction quite a bit in this course,
because it's really actually very important to how you get compliance and
understanding what can go wrong and making a success of it.
I'm going to make sure I'm going to use this little purple
document icon when I talk about PCI DSS,
the written standard,
and the little orange bank icon when I'm talking about PCI
DSS in terms of a compliance program, and hopefully this will become clearer.
So first let's look at the standard.
The data security standard as its name suggests, a published security standard.
It's about, gosh,
140 pages long and it contains 12 security requirements that are
broken down into around 280 sub-requirements.
The 12 requirements are, firstly,
to have firewalls to protect your network from other networks.
Number two, make sure you remove all the default configurations and passwords,
well, because criminals know those, number three,
protect any stored cardholder data you have,
number four, encrypt transmissions of cardholder data over public networks,
which could be the internet, or it could be something like Wi-Fi,
number five, have, use, turn on, make sure it's working,
whatever, antivirus and anti-malware solutions,
six,
use and maintain secure applications and operating
systems and write secure applications, seventh,
to restrict access to cardholder data to people that really need to see it,
and also have a concept of this privilege in your organization.
The eighth requirement is to identify and authenticate all users individually.
The ninth requirement is to protect physical locations
where cardholder data physically is, so that would be like paper,
discs, that type of thing.
The 10th requirement is to log and monitor access to systems,
the 11th requirement to test security on a regular basis to prove all the
requirements or controls you have in place are actually working,
and finally, have policies and procedures that your users know and understand.
Now this standard, PCI DSS, is freely available on the PCISSE website,
there's the URL, you can just go and download it,
you don't have to pay for it.
So if we look at the standard, the standard is actually really prescriptive.
It's perhaps the most prescriptive security standard there is,
so for example,
that first requirement that basically says install and maintain a
firewall configuration to protect cardholder data,
there are 22 sub requirements describing how the firewall should be deployed,
configured and managed.
I'll show an example of one of them here.
1.
2.
1, and there's something about restricting inbound and outbound traffic,
and then for every sub requirement,
there's going to be one or more documented test procedures to
validate that you've correctly followed the standard.
So in requirement one, that firewall requirement,
there are actually 37 separately documented test procedures to
validate that the firewall requirements are in place,
which is why it's a pretty long document.
Okay, that's the what, next, the who.
Each of the main card schemes, American Express,
Discover, JCB,
MasterCard and Visa each originally have their own security
standards for protecting cardholder data.
Those standards told banks how to make sure that their suppliers
and the merchants took care of card data to make sure that
criminals couldn't take advantage of it.
So having five sets of security standards,
and I'll be honest, that sometimes contradicted each other,
was really confusing for the industry.
So in 2006, the Payment Card Industry Security Standard council,
the PCI SSC was formed.
And the best bits taken out of each card scheme's own standard to make
one payment card industry data security standard.
That standard is now managed and developed by the PCI SSC.
The five card brands,
along with some representatives from European payment organizations,
and then permanent members of staff of the PCI SSC all
worked to produce the standard together,
they met on a really regular basis, quite often on the telephone to write it,
revise it, clarify it, and manage it when it needs to change.
Now the when, the standard came out in 2006,
it had major revisions in 2010 and 2013,
and everyone expected a new one, version 4 in 2016.
But the standard's pretty stable, and so only minor revision came out in 2016.
If you're worried about keeping up with the standard that's constantly changing,
whenever a new version comes out organizations have about 18 months
advanced notice so that there is time for you to get budget and change
your systems to comply with any new requirements.
Now where does PCI DSS apply?
The standard states that all of the 280 or so security requirements in PCI DSS
applies to all system components that are included in or connected to something
called the cardholder data environment or CDE.
And this cardholder data environment is all the network devices,
servers, computing devices, applications,
people, processes that either store, process or transmit cardholder data.
Let's look at this in a bit more detail, okay?
So in your environment,
you're going to have technology people and processes that in some way store,
process or transmit cardholder data,
that's what the standard calls this cardholder data environment or CDE.
All of those 280 PCI DSS requirements apply to anything
that's contained within that CDE.
However, you've also got technology,
people and processes that although they don't actually store,
process or transmit cardholder data,
they are connected to the cardholder data environment,
and so they're subject to all the requirements of PCI DSS.
And the reason for this is that if a connected to system was compromised,
it could be used as a bridge to attack the cardholder data environment.
So that's where PCI DSS applies, but why does it exist?
And it exists simply because criminals steal cardholder data to make money.
They steal the data you can see on a card such as the long account number,
the expiration date,
the cardholder's name and the CVV2 security code from the back of the card.
And they also steal the data you can't see,
the data that's encoded on the magnetic stripe.
And so PCI DSS tries to stop criminals stealing cardholder data.
So there we are,
the standard is maintained by the Payment Card
Industry Security Standards Council.
It's a highly prescriptive technical security standard with around 280
requirements or controls separated into 12 main areas.
It's been around since 2006, and the standard's been revised about three times.
It exists because criminals steal cardholder data,
and they use it to make fraudulent purchases.
And finally, the standard applies to all systems that store,
process, or transmit cardholder data, and all systems,
processes and people that are also connected to
this cardholder data environment, that stores,
processes or transmits cardholder data.