Jon Bonham, CISA, QSA Director, ERC JBonham@Coalfire.com PCI, What is it all about? Jon Bonham, CISA, QSA Director, ERC JBonham@Coalfire.com Fayetteville Fort Bragg

Agenda Introduction of Coalfire PCI 101 Is it for the Business Office or IT Department Some changes that have an impact on schools Questions and Answers Contact Information

Coalfire Services

Coalfire Regional Offices Over 300 employees

About Coalfire QSA for the state of North Carolina Agencies, Departments, Colleges and Universities are all set up on Coalfire’s Navis platform for scans and SAQs. Coalfire as a division set up just to handle state and local government as well as higher education and large diverse hospital systems. Coalfire successfully manages projects for small stand alone colleges as well as large diverse multi campus University systems. Coalfire is a leader in PCI, HIPAA, FERPA, FISMA, GLBA and Personal information auditing and assessments. Coalfire is vendor agnostic so they don’t care who you use for any hardware, software, managed services or card processing. They work for their customers as a trusted partner and advisor.

First Breach?

Where did this all start? In December of 2004, VISA and MasterCard aligned their programs under the banner PCI Data Security Standard (PCI DSS) American Express, Discover, JCB and Diners endorsed this new standard as well VISA initially managed and coordinated the PCI DSS Card brands created the PCI Security Standards Council (SSC) to assume management of the program PCI SSC managed by Executive and Management Committees made up of senior representatives from the card brands End Result Common security requirements for securing card data.

Who Does What? 1. Develops Standards 2. Establishes compliance requirements 3. Enforces requirements on merchants 4. Merchant

What you signed up for

We don’t want to just check a box

What are We Protecting Cardholder Verification Number (CVN) PAN Cardholder Verification Number (CVN) Visa/Discover's Card Verification Value (CVV) Mastercard's Card Validation Code (CVC) Called Prohibited Data – can not retain after authorization Primary Account Number (PAN) CVN

What does this have to do with business? Income Easier No bounced checks The decision to take cards was made in the business office The contracts were signed by the business office The part in the contract about always being PCI compliant was signed by the business office

IT Department Install and configure the hardware and software Segment and maintain the network Monitor what is happening Implement changes Work with the business office, merchants and vendors to maintain a secure cardholder date environment.

Just a thought or action isn’t enough.

Overkill

SAQ Validation Types

Penetration Test Required V3.0 SAQ Validation Types SAQ Validation Type Description # of Questions v3.0 Change # from v2.0 ASV Scan Required v3.0 Penetration Test Required V3.0 A Card-not-present merchants: All payment processing functions fully outsourced, no electronic cardholder data storage 14 +1 No A-EP E-commerce merchants re-directing to a third-party website for payment processing, no electronic cardholder data storage 139 NEW Yes B Merchants with only imprint machines or only standalone dial-out payment terminals: No e- commerce or electronic cardholder data storage 41 +12 B-IP Merchants with standalone, IP-connected payment terminals: No e-commerce or electronic cardholder data storage 83 C Merchants with payment application systems connected to the Internet: No e-commerce or electronic cardholder data storage +59 C-VT Merchants with web-based virtual payment terminals: No e-commerce or electronic cardholder data storage 73 +22 D-MER All other SAQ-eligible merchants 326 +38 D-SP SAQ-eligible service providers 347 P2PE Hardware payment terminals in a validated PCI P2PE solution only: No e-commerce or electronic cardholder data storage 35

The “Bucket” Approach SAQ A’s SAQ B’s SAQ C’s MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID SAQ A’s MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID MID SAQ B’s SAQ C’s From this to…………………………………………….this

PCI DSS 3.1: Goals The PCI SSC is pushing the concept of ongoing or continuous compliance management Monitoring of security controls Detect and respond to failures in security controls Review all changes to the environment Organization structure changes Periodic reviews Annual hardware/software review

Some of the new requirements to keep in mind. Dataflow diagrams Requirement 2.4 Inventory of all in-scope system components Requirement 5.1.2 Risk-based malware review for systems not commonly affected by malicious software Requirement 8.1.3.b Termination processes must include all physical authentication methods in addition to systems

PCI DSS 3.1: New Requirements New requirement to maintain information about which PCI DSS requirements are managed by the service provider.

PCI DSS 3.1: Requirement(s) 9.9.x New (merchant) requirements to protect point-of-sale devices that capture payment card data from tampering or unauthorized modification or substitution.

Expanded requirements/expectations for penetration testing controls. PCI DSS 3.1 Requirement 11.3.X Expanded requirements/expectations for penetration testing controls.

PCI DSS 3.1 Requirement 12.9 Service providers acknowledge in writing to customers that they are responsible for the security of cardholder data.

Questions about the changes?

Thanks for attending! Jon Bonham, CISA, QSA JBONHAM@COALFIRE.COM