Pci Dss: An Integrated Data Security Standard Guide

Table of Contents
About the Author
About the Technical Reviewer
Introduction
A Tribute To
Chapter 1: An Evolving Regulatory Perspective
	Introduction
	Revolution or Evolution?
		Europe
		Canada
		United States
		Australia
		China
		Japan
		Argentina
		Malaysia
		Brazil
		India
		Financial Services
	Data Privacy Hierarchy
		PCI DSS Validation Requirements
	Recommendations
		Behaviors
		Leadership
		Consent or Legitimate Use
	Conclusion
	Key Takeaways
	Risks
Chapter 2: The Evolution of PCI DSS
	Associated Costs (Non-compliance/Data Breach)
	Introduction
	PCI DSS Controls Framework Architecture
		Primary (Core) Ring
		Secondary Ring
		Tertiary Ring
		Quaternary Ring
		Quinary Ring
		Senary (Outer) Ring
	Historic References
		Build and Maintain a Secure Network
		Protect Cardholder Data
		Maintain a Vulnerability Management Program
	Implement Strong Access Control Measures
	Regularly Monitor and Test Networks
	Maintain an Information Security Policy
	Reality Bites
	Recommendations
	Conclusion
	Key Takeaways
	Risks
Chapter 3: Data Life Support System
	Introduction
	Concept
	Lessons Learned
		Layered Defenses
		24/7 Monitoring
		Physical Security
		Incident Response
		Blood Life-Cycle Management
	Recommendations
	Conclusion
	Key Takeaways
	Risks
Chapter 4: An Integrated Cyber/InfoSec Strategy
	Introduction
	Components of an Effective Strategy
		Data Privacy
		Cyber Security
			External Attack Surface Reconnaissance
				Information Gathering
				PCI DSS Applicable Controls – External Technologies
		Information Security
		Physical Security
		Resilience
			What Is Resilience?
	Recommendations
	Conclusion
	Key Takeaways
	Risks
Chapter 5: The Importance of Risk Management
	Introduction
		What Is a Risk Assessment?
		Background
	Scenario Development
		Think Like an Attacker
		Risk Scenarios
	Risk Assessment Process
	Reality Bites
	Recommendations
	Conclusion
	Key Takeaways
	Risks
Chapter 6: Risk Management vs. Compliance – The  Differentiator
	Introduction
	PCI DSS Is Not a Legal Requirement…
		…But Should Be a Business Requirement?
	Concept
		How Is This Achieved?
		Qualitative vs. Quantitative Risk Assessment
			Qualitative Risk Assessments
		Quantitative Risk Assessments
		Risk Appetite/Tolerance
	Case Studies
		Case Study 1: Telephone-Based Payments Risk Balance Case
		Case Study 2: Enhanced PCI DSS Program Through Integration into Enterprise Risk Management (ERM)
	Reality Bites
	Recommendations
	Conclusion
	Key Takeaways
	Risks
Chapter 7: PCI DSS Applicability
	PCI DSS Overview
	Introduction
	The Precious Cargo
		Structure of a Payment Card
		Precious Cargo Categories
			Front of Payment Card Breakdown
			Rear of Payment Card Breakdown
			Personal Identification Number (PIN)/PIN Blocks
			CHD Storage
	Accessing Applicability
	The Future
	Key Takeaways
	Risks
Chapter 8: De-scoping the Scoping Risk
	Introduction
	Lessons Learned from History
	Thinking Like the Enemy
	The Way Forward
	Reality Bites
	Recommendations
		High-Level Overview
		Detailed-Level Overview
	Conclusion
	Key Takeaways
	Risks
Chapter 9: An Introduction to the PCI DSS Controls Framework
	Brief History of PCI DSS
	My Life Before PCI DSS
	My Life Living with PCI DSS
	PCI DSS Structure
	PCI DSS: 6 Goals, 12 Requirements
	Goals
	6. 3 Ps: People, Policies, and Processes (Maintain a Policy That Addresses Information Security for All Personnel)
		Documentation, Documentation, Documentation
		Reality Bites
	Secure Architecture (Build and Maintain a Secure Network)
		Layered Defenses
		Identify and Manage IT Assets
		Traffic Control
		Reality Bites
		Secure by Design/Secured by Default
		Reality Bites
	Secure Data at Rest and in Transit (Protect Cardholder Data)
		Reality Bites
	Secure Maintenance (Maintain a Vulnerability Management Program)
		Reality Bites
	Gate Keeping (Implement Strong Access Control Measures)
		Reality Bites
	Routine Assurance (Regularly Monitor and Test Networks)
		Reality Bites
	PCI DSS 12 Requirements
	Introduction
		Requirement 12: 3 Ps (People, Policies, and Processes)
		Requirement 1: Layering the Network
		Requirement 2: Secure by Design/Default
		Requirement 3: The Vault
		Requirement 4: Secure in Motion
		Requirement 5: Entry Search
		Requirement 6: Build and Maintain
		Requirement 7: Role-Based Restrictions
		Requirement 8: Logical Entry Control
		Requirement 9: Physical Entry Control
		Requirement 10: Monitor and Detect
		Requirement 11: Assurance Testing
	Conclusion
	Risks
Chapter 10: Payment Channel Attack Vectors
	Introduction
		Card Not Present
			E-commerce
			Telephone-Based (a.k.a. Mail Order Telephone Order)
		Card Present
			Face to Face
	Card Not Present (CNP) Attack Vectors
		“Payload” Delivery Attacks
			Social Media Intelligence Gathering Tools
				Facebook
				Twitter
				LinkedIn
				Instagram
				Reddit
		CNP Perimeter Attacks
		Perimeter Network Attacks
		Perimeter Web Attacks
	Card Present (CP) Attack Vectors
		ATM Attacks
		POI/PTS/POS/PDQ Device Attacks
			Associated Problems
			Ongoing Research
	Third-Party Attack Vectors
	Recommendations
		Stage 1
		Stage 2
		Reality Bites
	Conclusion
	Key Takeaways
	Risks
Chapter 11: Compliance – A Team Effort
	Introduction
	It’s All in the Game
	Team Structure
	Rugby League Game Play
	Team Player Development
		Sounds Unrealistic?
	Applying “Team Tactics” to Win the PCI DSS Compliance Game
		1LOD
		2LOD
		3LOD
	Reality Bites
	Military Lessons Applied
	Recommendations
	Conclusion
	Key Takeaways
	Risks
Chapter 12: PIE FARM – A Project Managed Approach to PCI DSS
	Introduction
	Integrated Project Management
		Benefits
			Waterfall Methodology
			SCRUM Framework
			PEACE Framework
	Background
	PIE FARM Methodology
		How to Bake Your PIE?
			Phase 1 – Making your PIE
				Stage 1: Plan and Prepare
				Stage 2: Identify and Isolate
					5 Ds
				Stage 3: Engage, Explain, and Evaluate
			Phase 1 – Complete!
			Phase 2 – FARMing
				Stage 4: Fix
				Stage 5: Assess
				Stage 6: Report
				Stage 7: Maintain
	Conclusion
	Key Takeaways
	Risks
Chapter 13: Proactive Defense
	Maturing the Five Pillars of Defense
	Introduction
		Asset Management
		Vulnerability and Patch Management
			Human Firewall
			Infrastructure
			Application
			Network
		Privileged Access Management (PAM)
		Security Information and Event Management (SIEM)
		Incident Management
			Stages for Designing a Scenario
		Reality Bites
	Coincidence?
		Recommendation
		Conclusion
	Key Takeaways
	Risks
Chapter 14: People, People, People
	Introduction
	Documentation
		Policies Development (Establishing the Laws)
			5WH
		Procedures
		Supporting Documents
	Continual Security Awareness/Education
		Maintaining Specialist Knowledge/Skillsets
	Building an Effective Security Culture
	Managing Change
	Reality Bites
	Key Takeaways
	Risks
Chapter 15: The Ripple Effect
	Introduction
	PCI DSS: Appropriate Technical and Organizational Measures
		Requirement 1: Install and Maintain a Firewall Configuration to Protect Sensitive Data
		Requirement 2: Do Not Use Vendor-supplied Defaults for System Passwords and Other Security Parameters
		Requirement 3: Protect Stored Sensitive Data
		Requirement 4: Encrypt Transmission of Sensitive Data Across Open, Public Networks
		Requirement 5: Protect All Systems Against Malware and Regularly Update Anti-virus Software or Programs
		Requirement 6: Develop and Maintain Secure Systems and Applications
		Requirement 7: Restrict Access to Sensitive Data by Business Need to Know
		Requirement 8: Identify and Authenticate Access to System Components
		Requirement 9: Restrict Physical Access to Sensitive Data
		Requirement 10: Track and Monitor All Access to Network Resources and Sensitive Data
		Requirement 11: Regularly Test Security Systems and Processes
		Requirement 12: Maintain a Policy that Addresses Information Security for All Personnel
	Conclusion
	Key Takeaways
	Risks
Chapter 16: Cometh the Year, Month, Day, Hour
	Introduction
	Background
	Formal Assessment Expectations
		Principles
			Policies
				Regulatory Framework
				Communication
				Ethics
				Corporate Social Responsibility
				Capability
				Quality
				Guarantees
				Health and Safety
			Ongoing Evaluation and Improvement
		Offering
		Execution
		Closure
	Annual PCI DSS Assessment
		Planning and Preparation
		Assessment Process
	Reality Bites
	Recommendations
	Conclusion
	Key Takeaways
	Risks
Chapter 17: Quick Fire Round – Five Commonly Asked Questions
	Five Commonly Asked Questions
		Where can I enhance my or my team’s knowledge on  securing the business’s payment card security?
		What are the biggest inhibitors to a successful PCI DSS strategy for the protection of my customer cardholder data?
		I have outsourced all payment card operations to a third-party supplier, so as neither my business ­systems nor personnel interact with any cardholder data, surely, I do not need to validate my compliance?
		I am not a Merchant or a Service Provider, so does PCI DSS apply to me and how am I meant to validate my annual compliance?
		I have undergone multiple onsite assessments and there appears to be a wide range of inconsistencies in the way that different QSAs interpret the PCI DSS controls.
			Why is this?
Bibliography
	Goal 1: Build and Maintain a Secure Network and Systems
	Goal 2: Protect Cardholder Data
	Goal 3: Maintain a Vulnerability Management Program
	Goal 4: Implement Strong Access Control Measures
	Goal 5: Regularly Monitor and Test Networks
	Goal 6: Maintain an Information Security Policy
Index