Compliance With The PCI DSS Property of CampusGuard Todays Agenda - PowerPoint PPT Presentation

Compliance With The PCI DSS Property of CampusGuard

Today’s Agenda  PCI DSS Introduction  How are Colleges and Universities Affected?  How Do You Validate Compliance?  Best Practices  Q&A Property of CampusGuard

CampusGuard  Full-Service QSA/ASV Firm  We Know Security  Focused Solely on Higher Education Property of CampusGuard

The Target Breach  40 million customers  Insider ?  POS was the vector  Lessons for all… Property of CampusGuard

PCI… MERCHANTS & SOFTWARE MANUFACTURERS PROCESSORS DEVELOPERS PCI Security PCI PTS PCI DSS & Compliance PCI PA-DSS PIN Transaction Payment Application Data Security Security Vendors Standard Ecosystem of payment devices, applications, infrastructure and users Property of CampusGuard

PCI Relationships Responsible for managing the Responsible for enforcing and PCI DSS and certifying QSAs monitoring merchant compliance and ASVs with the PCI DSS CREDIT CARD SECURITY Bank Merchant Communicates and educates Responsible for safeguarding merchants on PCI DSS and credit card data and complying reports compliance status to with the PCI DSS Card Associations Property of CampusGuard

Penalties can be Huge  In the event of a breach the bank can make the merchant responsible for:  Fines from card associations  Up to $500,000  + Cost to notify victims  + Cost to replace cards  + Cost for any fraudulent transactions  + Forensics  + Level 1 certification Bad Publicity – Priceless! Property of CampusGuard

How Much Time Left?  You are assumed to be compliant NOW!  Banks will be requiring your validation SOON! Property of CampusGuard

Higher Ed Is Vulnerable Past 3 Years Government Higher Education Healthcare 6% 8% 33% Financial Services 14% 17% 22% Other Retailers Source: Privacy Rights Clearinghouse Property of CampusGuard

Colleges and Universities are like Cities… Property of CampusGuard

A Campus Is A “City" Challenges for PCI Compliance:  Open networks and systems  Scope conversations complex  Overloaded staff  Fiscal constraints Property of CampusGuard

PCI in Higher Education Source: 2012 Treasury Institute PCI Workshop Property of CampusGuard

PCI in Higher Education Source: 2012 Treasury Institute PCI Workshop Property of CampusGuard

PCI in Higher Education Source: 2012 Treasury Institute PCI Workshop Property of CampusGuard

PCI in Higher Education Source: 2012 Treasury Institute PCI Workshop Property of CampusGuard

PCI DSS: 6 Goals, 12 Requirements Control Objective Requirements 1. Install and maintain a firewall configuration to protect data 1. Build and maintain a secure 2. Change vendor-supplied defaults for system passwords and other network security parameters 3. Protect stored data 4. Encrypt transmission of cardholder magnetic-stripe data and 2. Protect cardholder data sensitive information across public networks 5. Use and regularly update antivirus software 3. Maintain a vulnerability 6. Develop and maintain secure systems and applications management program 7. Restrict access to data to a need-to-know basis 8. Assign a unique ID to each person with computer access 4. Implement strong access 9. Restrict physical access to cardholder data control measures 10. Track and monitor all access to network resources and 5. Regularly monitor and test cardholder data networks 11. Regularly test security systems and processes 6. Maintain an information 12. Maintain a policy that addresses information security security policy Property of CampusGuard

Merchant Levels Level 1 > 6 million Visa/MC txns/yr > 2.5 million transactions/yr 2 1 to 6 million Visa/MC txns/yr 50,000 to 2.5 million txns/yr 20,000 to 1 million Visa/MC 3 All other Amex Merchants ecommerce txns/yr Most Colleges and Universities 4 All other Visa/MC merchants N/A Property of CampusGuard

Validation Requirements Level • Annual on-site assessment (QSA) • Annual on-site assessment (QSA) 1 • Quarterly network scan (ASV) • Quarterly network scan (ASV) • Annual penetration test (ASV) • Annual penetration test (ASV) • Annual on-site assessment (QSA) • Quarterly network scan (ASV) 2 • Quarterly network scan (ASV) • Annual penetration test (ASV) • Annual penetration test (ASV) • Annual Self-Assessment • Quarterly network scan (ASV) Questionnaire (SAQ) • Annual penetration test (ASV) 3 • Quarterly network scan (ASV) • Annual penetration test (ASV) • At discretion of acquirer  N/A • Annual SAQ 4 • Quarterly network scan (ASV) • Annual penetration test (ASV) Property of CampusGuard

Self-Assessment Questionnaires Card-Not Imprint Only, No Standalone Dial Payment All other Present, All Cardholder Data Out Terminal, No Application methods Cardholder Data Storage Cardholder Data Systems Functions Storage Connected to Outsourced the Internet SAQ A SAQ B SAQ B SAQ C / VT SAQ D (11 questions) (29 questions) (29 questions) (80/51 questions) (286 questions) 11 286 Move as far to the left as possible! Property of CampusGuard

Can I assess myself?  Short answer: Maybe (but you probably don’t want to)  Long answer: You can assess yourself, provided:  You follow audit procedures  Your acquirer agrees  An approved officer (think President or CFO) signs on the “dotted line” (attesting to the veracity of the results)  You’re absolutely sure you’re going to do it right Property of CampusGuard

What’s in PCI Scope? Office Workstations? Card Swipe Machine? Student in dorm? Shopping Cart? Computer Lab? Phone Transaction? Property of CampusGuard

PCI DSS Assessment Your Campus Service Provider ? PCI DSS PA-DSS Level 1 Internet Payment Application PCI DSS SAQ ? A/B/C/D? Property of CampusGuard

Case Study: The commercial software was PA-DSS certified, but 1 – Firewall configuration 7 – Access to system components and cardholder data 8 – Assign unique ID to each person with computer access 9 – Restrict physical access 11 – Regularly test security systems and processes 12 – Maintain a policy that addresses information security Property of CampusGuard

Managing Compliance Property of CampusGuard

Compliance Finish Line! ? Property of CampusGuard

PCI Compliance Discovery and Remediation Validation Assessment • Payments Analysis • Correct Problems • ROC or SAQ • Quarterly Scanning • Merchant Discovery • Compensating • Penetration Testing Submission • Documentation Controls • Preliminary Scanning Re-Valida Re alidate te • Gap Analysis ever ery y 12 12 mos mos Property of CampusGuard

Awareness Training • PCI DSS • General Info Security • Red Flags • Identity Theft • HIPAA • Clery Act • FERPA • Title IX • GLBA Property of CampusGuard

Online Training: PCI DSS Topics An overview of PCI DSS  PCI DSS objectives and  requirements Costs of non-compliance  Sensitive Authentication Data  Hard-copy storage  Protecting cardholder information  Payment card transactions  Remote access  Good work practices  Security incidents  Restricted computer access  Restricted physical access  Tracking and monitoring  Social engineering  Property of CampusGuard

Online Training: Administration Property of CampusGuard

Closing Thoughts  PCI is a journey  PCI requires partnerships  Requires perseverance  Keep the faith Property of CampusGuard

Ron King, CampusGuard rking@campusguard.com (972) 964-8884 Property of CampusGuard