Payment Card Industry (PCI) Compliance 3/31/2017 9:47 PM Payment Card Industry (PCI) Compliance Jay Baucom, Chief Information Officer Arthur Hohnsbehn, Director of Information Technology Jason Godfrey, Security Manager North Carolina Community College System

Payment Card Industry (PCI) Compliance The PCI Security Standards Council is an open global forum for the ongoing development, enhancement, storage, dissemination and implementation of security standards for account data protection.

Payment Card Industry (PCI) Compliance The PCI Security Standards Council’s mission is to enhance payment account data security by driving education and awareness of the PCI Security Standards. The organization was founded by American Express, Discover Financial Services, JCB International, MasterCard Worldwide, and Visa, Inc.

Payment Card Industry (PCI) Compliance PCI Documentation Payment Card Industry (PCI) Data Security Standard (DSS) Navigating PCI DSS – Understanding the Intent of the Requirements (version 1.1, February 2008) Payment Card Industry (PCI) Data Security Standard (DSS) Self–Assessment Questionnaire – Instructions and Guidelines (version 1.1, February 2008) Payment Card Industry (PCI) Data Security Standard (DSS) Self–Assessment Questionnaire D and Attestation of Compliance All other Merchants and all SAQ-Eligible Service Providers (version 1.1, February 2008) Payment Card Industry (PCI) Data Security Standard (DSS) Glossary, Abbreviations and Acronyms

Payment Card Industry (PCI) Compliance Common Terms 3/31/2017 9:47 PM Payment Card Industry (PCI) Compliance Common Terms Account Number or PAN (Primary Account Number): payment card number that identifies the issuer and card holder. Acquirer: Bankcard association member that initiates and maintains relationships with the merchants that accept payment cards. Cardholder data: Full magnetic strip or the PAN plus any of the following: Cardholder name Expiration date Service Code

Payment Card Industry (PCI) Compliance Common Terms - Continued 3/31/2017 9:47 PM Payment Card Industry (PCI) Compliance Common Terms - Continued DSS: Data Security Standard Penetration Test: Security-oriented probing of computer system or network to seek out vulnerabilities that an attacker could exploit. Threat: Condition that may cause information or information processing resources to be intentionally or accidentally lost, modified, exposed, made inaccessible, or otherwise affected to the detriment of the organization.

Payment Card Industry (PCI) Compliance Common Terms - Continued 3/31/2017 9:47 PM Payment Card Industry (PCI) Compliance Common Terms - Continued Vulnerability: Weakness in system security procedures, system design, implementation, or internal controls that could be exploited to violate system security policy. Vulnerability Scan: Scans used to identify vulnerabilities in operating systems, services, and devices that could be used by hackers to target the company’s private network. Payment Provider: PayPal (Verisign) or Official Payments (OPC).

Payment Card Industry (PCI) Compliance Trustwave Services 3/31/2017 9:47 PM Payment Card Industry (PCI) Compliance Trustwave Services The Office of State Controller (OSC) has a master service agreement with Trustwave to perform vulnerability scans, online SAQ and answer general questions. 30 of the 58 colleges participate in the OSC’s master agreement. Colleges work directly with the OSC for portal access, service delivery, and remediation. The acquirer (bank) is SunTrust. The remaining 28 colleges are offered services through a supplemental agreement under the OSC master agreement. Colleges work directly with the NCCCS for portal access, service delivery, and remediation. The acquirer (bank) is selected by the college.

Payment Card Industry (PCI) Compliance Basic Steps to Compliance 3/31/2017 9:47 PM Payment Card Industry (PCI) Compliance Basic Steps to Compliance Compliance (Process\Procedures) Validation (SAQ\ Vulnerability Scans) Compliance – Jason Godfrey Attestation

Payment Card Industry (PCI) Compliance Datatel Colleague e-Commerce Datatel defines any payment card transaction processed via Colleague to a payment provider (PayPal\OPC) as an e-Commerce transaction. Payment card information is processed and transmitted, but never stored. Datatel defines any payment card information entered into Colleague (CREN) as a Non e-Commerce transaction. This information is encrypted.

Payment Card Industry (PCI) Compliance Datatel Colleague e-Commerce Datatel e-Commerce requires: Licensing e-Commerce Installing e-Commerce (InstallShield) Enabling e-Commerce CORE – ECS (e-Commerce Setup) ECPR – e-Commerce Providers ECPA – e-Commerce Provider Account EPAM - e-Comm Provider Acct Mapping ST – FIWP (Financial Web Parameters)

Payment Card Industry (PCI) Compliance e-Commerce Documentation e-Commerce 3.7 Release Highlights (Release18.0) (September 18, 2006) e-Commerce Installation and Administration (August 5, 2008)

Determining My PCI Validation Type - SAQ 3/31/2017 9:47 PM Payment Card Industry (PCI) Compliance Validation Type Determining My PCI Validation Type - SAQ

Payment Card Industry (PCI) Compliance Validation Types 3/31/2017 9:47 PM Payment Card Industry (PCI) Compliance Validation Types Type 1 (SAQ A) – All cardholder data is outsourced. Type 2 (SAQ B) – Imprint only, no electronic cardholder data is stored. Type 3 (SAQ B) – Standalone dial-out terminals only, no electronic cardholder data is stored. Type 4 (SAQ C) – POS or payment system connected to the Internet, no electronic cardholder data is stored. Type 5 (SAQ D) – All other merchants and all service providers.

3/31/2017 9:47 PM Payment Card Industry (PCI) Compliance Validation Types - Continued Conclusion: With exception of payment card transactions processed utilizing a stand alone dial-up terminal where paper receipts are kept for refund purposes; all other payment card transactions within Colleague (CREN) or utilizing Datatel’s e-Commerce would require a college to submit SAQ D.

Payment Card Industry (PCI) Compliance Impact of Validation Type D 3/31/2017 9:47 PM Payment Card Industry (PCI) Compliance Impact of Validation Type D What is the impact to the colleges? Arthur to provide some insight to what the colleges will be doing in addition to their normal processes.

Accepting Payment via Telephone (TREG) 3/31/2017 9:47 PM Payment Card Industry (PCI) Compliance Datatel Colleague Environment Scenario 1 CC Clearing House Payment Verification Internet Colleague Server via DMI EPOS (TREG) Server Accepting Payment via Telephone (TREG)

Accepting Payment via WebAdvisor (WA) 3/31/2017 9:47 PM Payment Card Industry (PCI) Compliance Datatel Colleague Environment Scenario 2 CC Clearing House Payment Verification Internet WA Server Colleague Server via DMI Accepting Payment via WebAdvisor (WA)

Accepting Payment via Colleague (CREN) 3/31/2017 9:47 PM Payment Card Industry (PCI) Compliance Datatel Colleague Environment Scenario 3 CC Clearing House Payment Verification Internet Side Terminal (CC entered via CREN) Colleague Server via DMI Accepting Payment via Colleague (CREN)

Payment Card Industry (PCI) Compliance Datatel Best Practices 3/31/2017 9:47 PM Payment Card Industry (PCI) Compliance Datatel Best Practices Develop a policy for maintaining payment card data. Non e-Commerce should be purged via COCD. Purge payment card information in Production before cloning the Production environment to Test using COCD. If troubleshooting e-Commerce with the DMI listener in debug ( -t –v options), remove the log immediately after the debug information has been obtained. You are not compliant with debug turned on. Work with your Bookstore provider to determine compliance.

Payment Card Industry (PCI) Compliance Additional Information 3/31/2017 9:47 PM Payment Card Industry (PCI) Compliance Additional Information PCI Security Standards Council https://www.pcisecuritystandards.org/ https://www.pcisecuritystandards.org/education/webinars.shtml (webinars) Datatel AnswerNet Document #4397 - How to remove sensitive credit card data for PCI Compliance http://www.datatel.com NC Office of the State Controller http://www.ncosc.net/programs/risk_mitigation_pci.html

3/31/2017 9:47 PM Payment Card Industry (PCI) Compliance Contact Information NC Office of State Controller http://www.ncosc.net/SECP/SECP_PCIOverview.html NCCCS System Office Jay Baucom - (919) 807-6988 baucomj@nccommunitycolleges.edu Jason Godfrey - (919) 807-7054 godfreyj@nccommunitycolleges.edu Kim Van Metre - (919) 807-7071 vanmetrek@nccommunitycolleges.edu Trustwave General Questions – (800) 363-1621 support@trustwave.com

Q & A Payment Card Industry (PCI) Compliance Additional Information 3/31/2017 9:47 PM Payment Card Industry (PCI) Compliance Additional Information Q & A