PCI Compliance Technical Overview 2008

RM PCI Calendar Sept 2006: Official 15.1 PCI Release Sept 2006: 15.1 certified PCI Compliant Jan 2007: VISA approves certification May 2007: Official 16.0 PCI Release Dec 2007: 16.0 certified PCI Compliant Awaiting VISA certification approval

Terms and Definitions n PCI DSS: Payment Card Industry Data Security Standard n PABP: Payment Application Best Practices n RM is a validated payment application that meets the PCI PABP n So what is “PCI Compliance”? Hint: It’s not simply installing RM 15.1.

The PCI Compliant Site To be a fully PCI compliant site, there are 4 areas needing attention: n Use PABP validated applications  Install RM 15.1 or later n Proper configuration  RM and Reseller PCI Guidance Doc RM and Reseller PCI Guidance n Proper procedures  Server machine access  Remote access n Site guidelines  Physical machine access  Network / Wireless

Basic Network Internet

Network w/ WiFi Internet

Network w/ WiFi Internet Symbol WS2000

Network w/ web svcs Internet Symbol WS2000 DMZ for Online Ordering Rmbrowser Write-On Phone Central Manager

What’s a DMZ? n DMZ: “De-Militarized Zone” n Separate network isolated from RM network n DMZ exposed to internet n RM network isolated from internet n All enforced through firewall configuration rules

Network with DMZ Internet DMZ * RM *

Setting up DMZ Server n RM and Reseller PCI Guidance : RM and Reseller PCI Guidance  Install NetworkActiv AUTAPF port forwarder as a service  Configure single port forwarding rule  Configure OO/RMbrowser/WO Phone setup to go to DMZ machine and port

Firewall Rules Internet DMZ * RM * Limited to proxy

Setting up the Firewall n Symbol WS2000 configuration  Two subnets  1 for RM  1 for DMZ  Firewall Rules n Now we’ll show you how…

Questions?