Hello.
Welcome to PCI DSS: Securing Data, Systems, and Applications.
I'm John Elliott, and together we're going to look at requirements 3,
4, 5, and 6 of PCI DSS, which are the ones focused on securing applications,
securing operating systems, and securing card holder data.
Before we dive into the PCI DSS requirements,
I just want to quickly go over how this course works.
If you've seen this introduction on another of my PCI DSS courses,
then you're fine to skip this clip.
If you haven't, this will only a couple of minutes.
You see, learning about PCI DSS can be a bit boring.
Altogether there are about three-hundred individual sub requirements,
and as you expect, I'm going to talk about each one.
When I did my QSA training many years ago,
what the instructor did was read out each requirement
just as it was printed in the standard, like this.
Requirement 8.1 .4 ; remove or disable inactive user accounts within 90 days.
Any questions?
Now as I'm sure you agree,
that's perhaps the most dull training course you can imagine,
and so I'm not going to do that.
Instead,
I want you to make sure you've downloaded a copy of the latest
version of PCI DSS from the PCI SSC website.
Either print it out or have it open in another window so you can refer to it.
When you look at the standard,
you'll see that each sub requirement is split into three
sections; the sub requirement itself, the testing procedure,
and finally the guidance section,
which describes the intent behind the requirements.
As I talk about each sub requirement,
I'm going to briefly summarize the point of the requirements,
the guidance, and what a QSA will look for when do an assessment.
Then, when we get to the end of a number of PCI DSS requirements,
we're going to join the discussion I had with Jacob Ansari,
who's one of the most experienced QSAs on the planet.
Jacob and I will discuss the real-world issues you need to
know about when implementing PCI DSS.
We'll talk about common problems, what QSAs look for,
and how security breaches happen.
So I hope at the end of the course you'll understand both
the theory and the practice of PCI DSS.
To get the best out of the course,
you need to understand PCI DSS concepts such what a PAN is,
the cardholder data environment,
and PCI DSS roles such as qualified security assessors.
If you're a bit unsure about any of these foundations,
then my Pluralsight PCI DSS, The Big Picture course will help.
Sometimes I'm going to need to refer to PCI DSS requirements in
the context of a network or system components.
So I've invented a network for an imaginary merchant that accepts
card payments in physical stores and on the web.
In each store, there's a point-of-sale system,
a local server that collects payment data,
which it then sends over a VPN to a payment server at head office,
which talks to the bank for authorization and settlements.
Once a transaction has been authorized, all transaction details,
including payment card data is stored in a database.
There's also an e-commerce channel,
which consists of an e-commerce web server at head
office sitting inside the DMZ,
which also talks to the payment server through a firewall.
There's also a separate network used to manage the cardholder data environment,
which itself is segmented from the corporate
network and has no access to the CDE.
Of course, your network probably doesn't look anything like this,
but it will have the same sort of things in it,
and most importantly, the different types of components.
There's the cardholder data environment where cardholder data is stored,
processed, or transmitted.
There's systems that are connected to or that can affect the
security of the cardholder data environment,
and systems that are intended to be out of scope of PCI DSS requirements.
That's the end of talking about how the course is structured so now
it's time to look at requirement 3 of PCI DSS.