Wake Forest University Strategies for Complying with the Requirements of the Payment Card Industry Data Security Standards (PCIDSS) Keith Conlee conlee@cod.edu College of DuPage Joel Garmon garmonjs@wfu.edu Wake Forest University

What is PCI-DSS? PCI-DSS = Payment Card Industry Data Security Standard Common set of industry tools and measurements to ensure safe handling of sensitive information. The PCI-DSS is a multifaceted security standard that includes requirements for security management, policies, procedures, network architecture, software design and other critical protective measures. Established by the credit card industry in response to an increase in identity theft and credit card fraud. Every merchant who handles credit card data is responsible for safeguarding that information and can be held liable for security compromises and must comply with PCI-DSS. Credit Card = Debit Card.

Scope of the Standard Manual Credit Card Electronic Handwritten Manual

Background 7/1/2006 - PCI DSS v1.0 1/1/2011 – PCI DSS v2.0 - begin 3-year cycle) 1/1/2014 – PCI DSS v3.0 1/1/2017 (projected) – v4.0

Merchants Background (cont.) Merchant Level Description 1 Over 6M xacts/year (all acceptance channels) Suffered a breach Discretion (e.g. Visa) Labelled Level-1 by other CC brand 2 1M-6M xacts/year 3 20K-1M ecommerce xacts/year 4 <20K ecommerce xacts/year All others <1M xacts/year

Merchants Background (cont.) Compliance Action Validation Actions Level Comply w/ PCI DSS On-Site PCI Security Audit SAQ / ROC Network Scan 1 Req’ed Req’ed Annually Req’ed Qtr’ly 2 & 3 4 Recommended Annually Recommended Quarterly

Guidelines for Protecting Cardholder Data Elements   A C O U N T D Data Element Storage Permitted Protection Required If Allowed to Store- Must Render Unreadable Cardholder Data Primary Account Number (PAN) YES Yes Cardholder Name NO Service Code Expiration Date Sensitive Authentication Data Full Magnetic Stripe Data n/a CAV2/CVC2/CVV2/CID PIN / PIN Block

Merchant SAQs/AOCs - Background (cont.) Eight (8) SAQs – A, A-EP, B, B-IP, C-VT, C, P2PE, D Eight (8) AOC – one for each SAQ - Your company must attest it is complying w/ the PCI DSS annually

SAQ Eligibility Questions Purpose it is measure a merchant’s risk Eligibility section dictates which SAQ applies – by identifying your CDE infrastructure, business process, and technology used Increased risk = increased cost to comply and vice versa. In PCI terms - “scope” defines a level of risk. A big scope = increased risk and cost to comply and vice versa You want to work towards reducing your scope

Merchant SAQs - Background (cont.) Must be able to answer Yes or n/a with comments Document Compensating Controls “meet the intent and rigor” of the original PCI DSS requirement. “Provide similar level of defense” See Appendix B “Compensating Controls” guidelines – PCI DSS 3.1 The Eligibility section of each SAQ is a measurement of your risk. It would be a good strategy to look at all 8 SAQ eligibility questions for each SAQ. Many will be able to qualify for more than one SAQ. If you qualify for multiple SAQs read the rest of the questions for each qualifying SAQ and pick the one that is the least burdensome to comply with (the least burdensome = the smallest scope in PCI language). Many times at educational institutions you have a very secure cashier function (where the majority of in-person tuition payments are made). And all your online registration tuition payments are outsourced to a 3rd party (acquirer) which totally takes them off your network. And if you only had to answer questions about your cashier function and your online payment function your scope would be small (relatively). But somewhere else at your institution you have separate entities/departments, e.g. selling food, tickets, fund raising, needing mobile CC processing that expand your scope. So you need to look for ways to get everyone on board and make reasonable changes to these separate entities/depts that will reduce your scope. One entity/dept can blow your scope to the maximum. Reasonable changes to reduce scope are measured by the increased cost to make the change vs. the reduce cost of complying by moving to a smaller scope.

SAQ vs ROC - Background (cont.) If you “Self-Assess” you submit an SAQ If you use a QSA to assess your compliance, the QSA must use the ROC for your institution

Executive Support Old cliché – Need executive buy-in Socialize and network with different departments Document card transactions Total number and $$ amount by departments Fees paid for PCI non-compliance Split the infrastructure cost among the card merchants Provide documentation on real higher education examples of PCI breach and associated costs Average cost for higher education data breach $300/record (Reference: 2015 Cost of Data Breach Study: Global Analysis Benchmark research sponsored by IBM Independently conducted by Ponemon Institute LLC May 2015) Finance Legal Compliance Audit Provost Athletics Bookstore Advancement (Alumni Affairs)

Governance Model Executive Sponsorship PCI Committee Individual such as CFO or existing committee of senior executive leadership PCI Committee Usually chaired by CISO and someone from Finance Include all major areas that accept credit cards Written policy and procedures – you will get push back Training and education to key stakeholders New merchant IDs reviewed and approved by PCI Committee

Getting Certified Identify senior person in the department for each merchant ID Can be responsible for multiple merchant IDs Is responsible to insure all requirements are met and documented Highly recommend using bank or QSA website to maintain documentation. Keep copy on your systems as completed Signs off on PCI certification Signature of Merchant Executive Officer (signature block from PCI DSS Attestation of Compliance) Highlights that this is a merchant requirement, not an IT requirement IT Security Assists merchants with understanding of requirements Provides or coordinates any technical support required Firewalls, patching, AV, … Assists with documentation Internal Security Assessor (ISA) also signs certification (if used) Encourages use of P2PE where ever possible Work closely with Finance since they already have a relationship with the departments / merchants Progress should be monitored by PCI committee or other governance body

Determine What Questionnaire to Complete Per Merchant Identify the applicable SAQ for your environment – refer to the Self-Assessment Questionnaire Instructions and Guidelines document on PCI SSC website for information. SAQ A. Card-not-present merchants (e-commerce or mail/telephone-order), that have fully outsourced all cardholder data functions to PCI DSS compliant third-party service providers, with no electronic storage, processing, or transmission of any cardholder data on the merchant’s systems or premises. Not applicable to face-to-face channels. SAQ A-EP. E-commerce merchants who outsource all payment processing to PCI DSS validated third parties, and who have a website(s) that doesn’t directly receive cardholder data but that can impact the security of the payment transaction. No storage, processing, or transmission of cardholder data on merchant’s systems or premises. Applicable only to e-commerce channels. SAQ B. Merchants using only: Imprint machines with no electronic cardholder data storage, and/or Standalone, dial-out terminals with no electronic cardholder data storage. Not applicable to e-commerce channels.

Determine What Questionnaire to Complete Per Merchant SAQ B-IP. Merchants using only standalone, PIN Transaction Security (PTS) approved payment terminals with an IP connection to the payment processor with no electronic cardholder data storage. Not applicable to e-commerce channels. SAQ C-VT. Merchants who manually enter a single transaction at a time via a keyboard into an Internet-based, virtual payment terminal solution that is provided and hosted by a PCI DSS validated third-party service provider. No electronic cardholder data storage. Not applicable to e-commerce channels. SAQ C. Merchants with payment application systems connected to the Internet, no electronic cardholder data storage. Not applicable to e-commerce channels. SAQ P2PE. Merchants using only hardware payment terminals included in and managed via a validated, PCI SSC-listed P2PE solution, with no electronic cardholder data storage. Not applicable to e-commerce merchants. SAQ D All merchants not included in descriptions for the above SAQ types.

Requirements Overview Sub-Requirements Build and Maintain a Secure Network and Systems Install and maintain a firewall configuration to protect cardholder data Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data Protect stored cardholder data Encrypt transmission of cardholder data across open, public networks Maintain a Vulnerability Management Program Protect all systems against malware and regularly update anti-virus software or programs Develop and maintain secure systems and applications Implement Strong Access Control Measures Restrict access to cardholder data by business need to know Identify and authenticate access to system components Restrict physical access to cardholder data Regularly Monitor and Test Networks   Track and monitor all access to network resources and cardholder data Regularly test security systems and processes Maintain an Information Security Policy Maintain a policy that addresses information security for all personnel These 12 sub-requirements can be further refined into 240 requirements depending on the type of merchant.

Example -- SAQ B Information Requirement Total Number of Questions 3 - Protect stored cardholder data 5 4 - Encrypt transmission of cardholder data across open, public networks 1 7 - Restrict access to cardholder data by business need to know 3 9 - Restrict physical access to cardholder data 12 12 - Maintain a policy that addresses information security for all personnel   17 Total Questions 38 SAQ B only requires 38 out of the potential 240 questions to be answered

Additional Helpful Documents PCI DSS (PCI Data Security Standard Requirements and Security Assessment Procedures) Guidance on Scoping Guidance on the intent of all PCI DSS Requirements Details of testing procedures Guidance on Compensating Controls SAQ Instructions and Guidelines documents Information about all SAQs and their eligibility criteria How to determine which SAQ is right for your organization PCI DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms Descriptions and definitions of terms used in the PCI DSS and self-assessment questionnaires

Requirements for Compliance Assess your environment for compliance with the PCI DSS. Complete the Self-Assessment Questionnaire (SAQ A) according to the instructions in the Self Assessment Questionnaire Instructions and Guidelines. Complete the Attestation of Compliance in its entirety. Submit the SAQ and the Attestation of Compliance, along with any other requested documentation, to your acquirer, payment brand, or other requester May also include Regular network or web site scanning by an Approved Scanning Vendor Report on Compliance by a Qualified Security Assessor (only needed by the very largest companies)

Discussion Questions What is the difference between or relationship of PCI DSS and Europay, MasterCard® and Visa® (EMV) chip technology How does P2PE assist with DSS Are merchants using Council-listed P2PE solutions out of scope for PCI DSS Are there card readers that are both P2PE and EMV compliant Do I still have PCI requirements if I only take cards through a portal supported by another company Do I have to use a QSA Do I have to have 3rd party external network scans

Discussion Questions What is a Payment Application Data Security Standard (PA-DSS) compliant application How do I find if an application is PA-DSS certified www.pcisecuritystandards.org/assessors_and_solutions/payment_applications Is encrypted data still in scope for PCI DSS Is VoIP in scope for PCI DSS Are operating systems that are no longer supported by the vendor non- compliant with the PCI DSS Can I fax payment card numbers and still be PCI DSS Compliant Can an entity be PCI DSS compliant if they have performed quarterly scans, but do not have four “passing” scans

Discussion Questions Can I store the security code (CAV2/CVC2/CVV2/CID) in paper format Are hashed Primary Account Numbers (PAN) considered cardholder data that must be protected in accordance with PCI DSS Does PCI DSS apply to debit cards, debit payments, and debit systems Are digital images containing cardholder data and/or sensitive authentication data included in the scope of the PCI DSS Can VLANS be used for network segmentation