PCI Compliance, Third Edition: Understand and Implement Effective PCI Data Security Standard Compliance

Front\nCover......Page 1
PCI Compliance......Page 2
Copyright\npage......Page 5
Acknowledgments......Page 6
About the Authors......Page 8
Contents......Page 10
Foreword......Page 18
1 About PCI and This Book......Page 20
How to Use The Book in Your Daily Job......Page 22
Organization of the Book......Page 23
Summary......Page 24
2 Introduction to Fraud, Data Theft, and Related Regulatory Mandates......Page 26
Summary......Page 31
What is PCI and Who Must Comply?......Page 32
Electronic Card Payment Ecosystem......Page 34
Goal of PCI DSS......Page 35
Applicability of PCI DSS......Page 36
Compliance Deadlines......Page 38
Compliance and Validation......Page 39
History of PCI DSS......Page 42
PCI Council......Page 43
QSAs......Page 45
PA-QSAs......Page 46
PFIs......Page 47
Quick Overview of PCI Requirements......Page 48
PCI DSS and Risk......Page 51
Benefits of Compliance......Page 53
The Case of the Developing Security Program......Page 54
Summary......Page 55
References......Page 56
The Basics of PCI DSS Scoping......Page 58
The “Gotchas” of PCI Scope......Page 61
Scope Reduction Tips......Page 65
Planning Your PCI Project......Page 67
The Case of the Leaky Data......Page 69
The Case of the Entrenched Enterprise......Page 70
Summary......Page 71
5 Building and Maintaining a Secure Network......Page 72
Establish Firewall Configuration Standards......Page 73
Denying Traffic from Untrusted Networks and Hosts......Page 75
Restricting Connections......Page 76
Other Considerations for Requirement 1......Page 77
Requirement 2: Defaults and Other Security Parameters......Page 79
Simple Network Management Protocol Defaults......Page 80
Develop Configuration Standards......Page 81
Implement Single Purpose Servers......Page 82
Configure System Security Parameters......Page 83
Hosting Providers Must Protect Shared Hosted Environment......Page 84
Tools and Best Practices......Page 85
Egress Filtering......Page 86
The Case of the Small, Flat Store Network......Page 87
The Case of the Large, Flat Corporate Network......Page 89
Summary......Page 90
Which PCI DSS Requirements are in this Domain?......Page 92
Integrity......Page 93
Requirement 7: How Much Access Should a User Have?......Page 94
Requirement 8: Authentication Basics......Page 95
Two-Factor Authentication and Requirement 8.3......Page 96
Rendering Passwords Unreadable in Transit and Storage......Page 97
Authentication and Requirements 8.5.1–8.5.7......Page 98
Educating Users......Page 100
Locking Users Out: Requirements 8.5.13–8.5.15......Page 101
Databases and Requirement 8.5.16......Page 102
Windows File Access Control......Page 103
Enforcing Password Requirements in Windows on Standalone Computers......Page 105
Setting File Permissions on Standalone Windows Computers......Page 106
POSIX (UNIX/Linux Systems) Access Control......Page 107
Linux Enforce Password Complexity Requirements......Page 108
Setting Up SSH in a Cisco Environment......Page 109
Requirement 9: Physical Security......Page 110
Handling Visitors: Requirements 9.2–9.4......Page 111
Handling Media: Requirements 9.5–9.10.2......Page 112
What Else Can You Do to Be Secure?......Page 113
Tools and Best Practices......Page 115
Legacy Systems......Page 116
The Case of the Stolen Database......Page 117
The Case of the Loose Permissions......Page 118
Summary......Page 119
What is Data Protection and Why is it Needed?......Page 122
The Confidentiality/Integrity/Availability Triad......Page 123
Requirements Addressed in This Chapter......Page 124
PCI Requirement 3: Protect Stored Cardholder Data......Page 125
Requirement 3 Walk-Through......Page 126
File- or Folder-Level Encryption......Page 130
Full-Disk Encryption......Page 131
Database (Column-Level) Encryption......Page 132
PCI and Key Management......Page 135
PCI Requirement 4 Walk-Through......Page 136
IPsec Virtual Private Networks......Page 137
Wireless Transmission......Page 138
Misc Card Transmission Rules......Page 139
Requirement 12 Walk-Through......Page 140
Appendix A of PCI DSS......Page 142
Step 1: Identify Business Processes with Card Data......Page 143
Step 5: Determine Who Needs Access......Page 144
Common Mistakes and Pitfalls......Page 145
The Case of the Leaky Data......Page 147
The Case of the Satellite Location......Page 148
References......Page 149
8 Using Wireless Networking......Page 150
What is Wireless Network Security?......Page 151
Requirements 1 and 12: Documentation......Page 153
Actual Security of Wireless Devices: Requirements 2,4, and 9......Page 155
Testing for Unauthorized Wireless: Requirement 11.1......Page 157
Why Do We Need Wireless Network Security?......Page 159
Other Wireless Technologies......Page 160
Tools and Best Practices......Page 161
Common Mistakes and Pitfalls......Page 162
Why is WEP So Bad?......Page 163
The Case of the Untethered Laptop......Page 164
The Case of the Expansion Plan......Page 165
The Case of the Double Secret Wireless Network......Page 166
Summary......Page 167
9 Vulnerability Management......Page 168
PCI DSS Requirements Covered......Page 169
Vulnerability Management in PCI......Page 170
Stages of Vulnerability Management Process......Page 171
Prioritization......Page 172
Mitigation......Page 173
What to Do to Be Secure and Compliant?......Page 175
Requirement 6 Walk-Through......Page 177
Web-Application Security and Web Vulnerabilities......Page 180
WAS......Page 181
Web Application Firewalls......Page 183
Requirement 11 Walk-Through......Page 184
Considerations When Picking an ASV......Page 186
How ASV Scanning Works......Page 191
Operationalizing ASV Scanning......Page 192
What Do You Expect from an ASV?......Page 194
Internal Vulnerability Scanning......Page 195
Penetration Testing......Page 197
Common PCI Vulnerability Management Mistakes......Page 198
PCI at a Retail Chain......Page 200
PCI at an E-Commerce Site......Page 201
Summary......Page 202
References......Page 203
10 Logging Events and Monitoring the Cardholder Data Environment......Page 204
Why Logging and Monitoring in PCI DSS?......Page 205
Logging and Monitoring in Depth......Page 206
PCI Relevance of Logs......Page 209
Logging in PCI Requirement 10......Page 210
Monitoring Data and Log for Security Issues......Page 214
Logging and Monitoring in PCI—All Other Requirements......Page 216
PCI DSS Logging Policies and Procedures......Page 220
Guidance for Identifying “Known Bad” Messages......Page 223
Exception Investigation and Analysis......Page 224
PCI Compliance Evidence Package......Page 226
Daily Tasks......Page 227
Tools For Logging in PCI......Page 228
Intrusion Detection and Prevention......Page 232
Integrity Monitoring......Page 236
Common Mistakes and Pitfalls......Page 237
The Case of the Risky Risk-Based Approach......Page 238
The Case of Tweaking to Comply......Page 239
Reference......Page 240
11 PCI for the Small Business......Page 242
The Risks of Credit Card Acceptance......Page 243
New Business Considerations......Page 244
Your POS is Like My POS!......Page 246
Case Study......Page 247
Summary......Page 248
12 Managing a PCI DSS Project to Achieve Compliance......Page 250
Figuring Out If You Need to Comply......Page 251
Compliance Overlap......Page 252
The Level of Validation......Page 253
Penalties for Noncompliance......Page 254
Obtaining Corporate Sponsorship......Page 256
Getting Results Fast......Page 257
Budgeting Time and Resources......Page 258
Establishing Goals and Milestones......Page 259
Having Status Meetings......Page 260
Training the Company on Compliance......Page 261
Setting Up the Corporate Compliance Training Program......Page 262
The Steps......Page 263
Step 2: Identify and Establish Your Team......Page 264
Step 5: Set Up Quarterly External Network Scans from an Approved Scanning Vendor......Page 265
Step 8: Create PCI DSS Compliance Plan......Page 266
The Visa TIP......Page 267
Summary......Page 269
Reference......Page 270
13 Don’t Fear the Assessor......Page 272
Remember, Assessors are there to Help......Page 273
Balancing Remediation Needs......Page 274
Dealing with Assessors’ Mistakes......Page 275
Planning for Remediation......Page 277
Fun Ways to Use CVSS......Page 279
Summary......Page 281
What is a Compensating Control?......Page 282
What a Compensating Control is Not......Page 284
Funny Controls You Didn’t Design......Page 286
How to Create a Good Compensating Control......Page 288
The Case of the Newborn Concierge......Page 292
The Case of the Newborn Concierge......Page 293
Summary......Page 294
Security is a Process, Not an Event......Page 296
Plan for Periodic Review and Training......Page 297
Build and Maintain a Secure Network......Page 299
Protect Cardholder Data......Page 300
Maintain a Vulnerability Management Program......Page 301
Implement Strong Access Control Measures......Page 303
Regularly Monitor and Test Networks......Page 304
Maintain an Information Security Policy......Page 305
Case Study......Page 306
The Case of the Compliant Company......Page 307
Summary......Page 308
New Payment Schemes......Page 310
Mobile......Page 311
Near-Field Communication......Page 312
Square......Page 313
Google Checkout and Paypal......Page 314
Predictions......Page 315
Europe vs the US vs the Rest of the World......Page 316
The Case of the Cashless Cover Charge......Page 317
Summary......Page 318
17 Myths and Misconceptions of PCI DSS......Page 320
A Perfect Example of Myth #1 at Work!......Page 321
Myth #2 PCI is Confusing and Ambiguous......Page 324
Myth #3 PCI DSS is Too Onerous......Page 326
Myth #4 Breaches Prove PCI DSS Irrelevant......Page 328
Myth #5 PCI is All We Need For Security......Page 331
Myth #6 PCI DSS is Really Easy......Page 333
Myth #7 My Tool is PCI Compliant Thus I Am Compliant......Page 335
Myth #8 PCI is Toothless......Page 339
Summary......Page 341
References......Page 342
Index......Page 344