[Autogenerated] right.
We've quickly refreshed on knowledge of the participants in the
payment and compliance ecosystem off the key steps in payment
processing where the cardholder dates exchange and we've met the
three key roles of Q S A I s a on P C I.
P on.
Maybe I've persuaded you to go and take the ___ quantification.
So now let's make a very quick recap of the PC Idea says requirements on again.
If you're happy you're really familiar with these,
then just skip this clip and go to the start of the next module.
Now the standard consists of around 300 prescriptive
controls grouped into 12 core requirements.
First of these requirement one is to install and maintain a
firewall configuration to protect cardholder data.
The sub requirements here are divided into three main sections.
The first is to have configuration standards with firewalls.
The second is to build those firewalls to the configuration standards,
and the third is to make sure that all traffic entry and
leaving your organization actually passes through those
correctly configured firewalls.
There's also a weird sub requirement in requirement one.
The make sure devices, such as laptops,
have a personal firewall installed so that they're protected when
they're outside of the organization's network.
Finally, as you'll find in all 12 of the PC ideas s requirements,
you need to make sure there are written policies that say,
PC Idea says this requirement is what your organization does.
The second requirement is a battle against default values.
Criminals use default accounts,
default passwords and exploit services that are not really required
because people use default builds of computer systems.
So to comply with the second requirement, you need to change default passwords.
Make sure you build systems to a secure baseline using an independent standard,
encrypt administrative user names and passwords when they're transmitted
over a network and make sure you haven't up today.
Inventory of all system components on, of course, have those policies.
The third requirement is only concerned with stored cardholder data on.
Although the distinction between ramen disk is increasingly less clear.
This requirements dealing with non volatile storage of cardholder data,
it doesn't apply to cardholder data in volatile memory.
The sub requirement starts off.
We one of the most sensible PC ideas as sub requirements of all,
which is toe work out what cardholder days he really need and store only
that in my career I've worked with organizations that retained every
single payment card number they ever taken.
There was no need for them to do this.
They didn't do anything with the data, but no one made the decision to delete it.
And so this first requirement is to have a storage and retention,
possibly cardholder data.
In my view,
it's perhaps the most important requirement in the whole standard
because with the retention policy in place,
once you've deleted the cardholder data,
criminal can't steal it.
The other sub requirements here in Requirement three,
when you have to encrypt hash or otherwise obscure all stored cardholder data,
you know that you don't still the data that's used to authenticate a
card or a customer such as the magnetic stripe,
track data pens or the card verification code using e commerce transactions.
And finally,
there's a whole set of sub requirements that deal with how you encrypt data.
The fourth requirement is to encrypt cardholder data when
it travels across open public networks, and typically,
for most people, this means the Internet and wireless networks.
When you asked people to send you cartel,
the data over the Internet or you send cardholder data over the Internet.
It has been encrypted with what the standard calls strong cryptography,
which basically means anything that's approved by nest.
So there are vulnerabilities.
For example, in SSL and TLS 1.0.
The standard requires organizations to move away from these protocols,
toe higher versions of tear less.
There are also some requirements to prevent the
transmission of cardholder data of what stand expects to be
insecure messaging and email channels.
Oh, you know nowadays,
the strongest end to end cryptography is actually available on mobile messaging,
so I think that this will be an updated in the next
standard or the next version of the standard.
The fighter.
Some requirement is once more travel those policies.
The fifth requirement is to have working anti virus on systems that
are typically infected by viruses and then risk assess other
operating systems where you don't instill a V such as mainframes to
see what if it would be useful.
There are some requirements to make sure the A V is logging,
that it can't be disabled, and, as always,
you have policies and procedures to back this up.
The ___ requirement is quite a long one and deals with
the security of operating systems, commercial software and software.
You develop yourself.
The 1st 2 requirements are mostly targeted at software you buy
and that you must track published vulnerabilities for all the
software active in your environment.
But also make sure software's patch to eliminate known vulnerabilities.
The software You develop yourself that there are quite a few serve requirements,
which in total add up to basically having a secure
software development life cycle.
So on, then the next requirement is have really great change control on.
Believe me,
change control is gonna be your best friend when it comes to
keeping an organization in compliance to PC,
Idea says.
Especially after that first assessment.
The final technical sub requirement in ___ is concerned
with security Web facing applications.
They must have an independent code review or be protected by a Web application,
firewall or a laugh.
Personally, I'd have both for high volume e commerce sites,
but the standards happy the war will be over in this little ways,
you'd have those written policies for all these activities in Requirement six,
The seventh PC idea says requirement is one of the core
fundamentals of information security.
You must only give people the minimum access they need to do their job on.
This is especially true for privileged uses and any users who
are in roles with access to cardholder data.
You need to use some sort of automated access control and,
of course,
have that documentation where requirements seven is all about authorization
Requirement eight is about identification and authentication.
Firstly, everyone should have their own user i d.
So no group or shared user accounts,
Then there are lots of sub requirements dealing
with path words stretch and then, most importantly,
the requirement for multi factor authentication.
Have any remote access that can end up with somebody in the CD A,
and also all administrative access into the cardholder data environment?
And in my experience, correctly,
implementing this requirement alone would have prevented many
breaches of cardholder data from merchants where the criminals took
advantage of badly security amount access.
There are a few other authentication sub requirements,
but one of the other key ones applies.
If you have databases containing cardholder data,
because the tables where the cuddle data stored
shouldn't be directly queria bill by users.
Only letting applications access those tables is what's allowed.
And finally,
I'm sure you've guessed the less of requirements about
policies for identification authentication.
Now it's time to get physical in respect of people's physical
access into areas where cardholder data is stored,
processed and transmitted on the protection of physical
things that have card data on them, such as paper or disks.
And these need to be kept secure and disposed of properly.
So that typically means shredding paperwork and destroying
discs that have contained payment card data.
There are also special requirements for looking after devices that read
the magnetic stripe on chips on payment card data.
And, of course,
this all needs to be documented in the policies requirement tennis for security,
logging and monitoring,
which you might also called slam the some requirements for
everything degenerate logs believe may.
The standard goes into some detail about the events that need
to be logged on what needs to be logged.
This requirement also wants to make sure that the logs can't
be tampered with and that everything that is logging is
properly synchronised to the same time.
Source.
Finally,
one of the hardest requirements in PC idea says to meet is
that all the logs are reviewed daily, so nowadays,
that's certainly going to mean using some automated log passing.
And reviewing tools are not just having an intern sitting in a
cupboard watching the logs roll off the screen.
As with all the other requirements that need to be policies supporting this,
no requirement 11 is one of the ones that
organizations failed to keep up with on.
That's a shame,
because this one is about making sure all the other
security controls and systems are working,
and they're doing their job properly.
You know,
sometimes I wonder whether this requirement so neglected
because it's at the end of the standard on.
People got tired of reading the standard by now.
But if the PC I SSC moved it to Requirement One,
maybe organizations would give it more attention.
So many of the sub requirements here needs you to do
something on a regular basis to provide regularly
assurance that your security is working.
It's the first thing you need to test for the presence of rogue wireless
access points plugged into your network on a quarterly basis.
Also, every three months, you need to scam,
the internal network,
every device on the internal network and all externally
facing systems for vulnerabilities.
Using a commercial vulnerability scholar and then each
year and also after significant change,
you must conduct a ___________ tests from within the network and
also from outside of the network looking in.
And finally, there is some some requirements for continual assurance in the form.
Intruder detection were intruded prevention at the network
perimeter and also at key points on the network.
And also you need to deploy change detection software such as file
integrity monitoring T look for changes in in critical files and
then have those policies and procedures.
The 12th and final requirement could be called the
People and Process Requirement.
It's got quite a few sub requirements the and to make sure
there's an adequate governance for the security of cardholder
data on the first of these governors,
related is the need seven information security policy that
includes all the PC ideas s requirements.
Next is the need to do an annual risk assessment.
You know,
I've had people ask why do we need to the annual risk assessment cause PC i.
D.
S s effects.
He tells an organization what to do to protect his cardholder data.
But remember, PCR DSS is a baseline security standard.
You might be in a higher threat environment,
or there may be a new former cyber attack.
The standard will take 18 months to catch up with.
So the risk assessments crucial for your business to understand how to
protect its data the next set some requirements of people focused the
responsibilities were looking after the security policy for monitoring and
analyzing alerts for looking after incident response but administrating
user account on for monitoring and control access to the CD A must all be
allocated to individual roles now all personal were interact with or who
can affect the security of cardholder data must receive security awareness
training.
And that also needs to be a risk based screening in program in place
finally took it away right at the end of the standard.
On on page 110 we get to two of the most crucial requirements,
the first of which is to make sure that any third party
supplies have access to your cardholder data or who could
affect security of your card.
Hold the data have to comply with all the relevant requirements of PC Idea,
says the second crucial requirement is toe have and
practice an incident response plan.
So if you suspect a loss of cardholder data, you know what to do.
Okay, so now we're all on the same page.
It's time to address what I think is the most important question
people should ask before they start any piece.
The idea says initiative, and that is what this compliance really mean,
and that's what the next module is concerned with.