Making a Holiday Special For All The Right Reasons Jeremy King International Director PCI Security Standards Council

PCI Security Standards Council

I Need a Holiday!!!! Taxi or transfer Face to face Hotel Travel Agent On-line Flights Telephone Hire car Excursions and extras Credit card details sent to at least 6 different organisations Insurance

At the Airport Excess Baggage Fees Upgrades New Ticket Changes to Ticket Changes to Itinerary Duty Free Eating and Drinking

On the Aircraft Buying Food and Drink Buying Duty Free Other Products / Services Making a Phone Call Internet on Board

Problems Lost Luggage Damaged Luggage Delayed Flights Cancelled Flights Unexpected Diversions

Join the Loyalty Fraud Prevention Association, (LFPA) Today Buying Additional Loyalty Points Using Points and Value Join the Loyalty Fraud Prevention Association, (LFPA) Today

At the Hotel: Checking In Used to be so much easier. There was our side of the counter and your side. People knew where they stood, literally.

Check-in 21st Century

Services in the Hotel

One Hotel or a Chain Interlinked networks means criminals gaining access to just one site, gains access to the entire global hotel network.

So What Does All This Mean For Security?

PCI is Like Running an Aircraft It is all about Security, not just Compliance

Not Everything In Life Ends Up As You Originally Planned! However 640 years later: It is a tower It is still standing People can climb the tower It contains bells The bells ring It is still leaning

But You Cannot Always Defend Against Every Eventuality! But knowing the threat there can make a huge difference

Cloud Computing Can be great or just grey and confusing.

Encryption Is a great way to improve security.

So Where Does This All Leave Us People Process Technology And a bit of luck

Why PCI? The World is Under Cyber Attack

How Much Data Are We Losing… Source: Databreachindex.com

PCI Security Standards Council Standards, Best Practices, Training, Certification, Educational Resources Merchant & Payment Service Provider Environments Payment Equipment Payment Software Standards for payment equipment, payment software and standards for everyone in the ecosystem who handles payment information. To maintain trust and integrity that payments are secure, we certify the equipment used throughout the payments chain. We certify people who are responsible for maintaining secure environments – internal security people and external assessors and investigators. Our standards are: Effective: A third-party report investigated major data breaches over the past ten years and found none were compliant with PCI Standards at the time of breach. The PCI Standards work. Comprehensive: The Standards cover wide variety of payment security challenges, from password complexity to proper protection of EMV chip terminals, to e-commerce, and mobile payments. Industry-tested: PCI maintains lists of independent, lab-tested applications and devices to help organizations choose technology that is and verified to protect cardholder data. Certification – Equipment, Service Providers, Assessors, Investigators Training – Assessors, Investigators

New: Best Practises for Securing E-commerce

New: Best Practises for Cloud Computing Being Updated 2017 by Special Interest Group

PCI DSS Scoping and Network Segmentation Guide

PCI Guidance and Best Practices Building a security awareness program Protecting against malware Skimming prevention Defending against phishing attacks Working with third parties Maintaining PCI DSS compliance Accepting payments with a mobile phone PCI DSS compliance in the cloud All of our standards, best practices, FAQs are available on the website in our document library – Free to all that are interested in learning more and being a part of the solution. Continuously Developing documents and resources. Simplify security for the Small Business marketplace Including FAQs and tips for small merchant environments The U.S. National Institute for Standards and Technology found a vulnerability in the old software, which is used by about 90 percent of ecommerce merchants. There hasn’t been a major breach resulting from the vulnerability yet. But we expect some enterprising criminal will soon. And we don’t want anyone to be the one in the papers The Council published very specific guidance on interim risk mitigation approaches, migration recommendations and alternative options for strong cryptographic protocols. Available at: www.pcisecuritystandards.org

To Sum Up: Why PCI? You are a priority target Doing nothing is not an option PCI Standards are the best set of security requirements available This must start at the very top of your organisation Remember; People, Process and Technology is what matters Just buying the technology is not the answer