PCI 3.0 Boot Camp Payment Card Industry Data Security Standards 3.0

INTRODUCTIONS PCI 3.0 Boot Camp - March 20152

PURPOSE Why am I here? PCI 3.0 Boot Camp - March 20153

Changes in SAQs Added two new SAQs A-EP – merchants whose payment page begins at their website or who have some control over the payment page B-IP – merchants using stand-alone credit card terminals via Internet SAQ B, C and C-VT all specifically state they cannot be used if merchant uses ecommerce channels PCI 3.0 Boot Camp - March 20154

Trustwave Portal Answering Multiple SAQs Merchants accepting in more than one environment will answer an SAQ to address each environment. Cash Management will open additional Trustwave account for each “hybrid” merchant. The new account will address the lesser involved SAQ (A, A-EP or B) Merchants have the option to terminate the activity related to multiple payment channel PCI 3.0 Boot Camp - March 20155

UPDATES TO REQUIREMENTS PCI 3.0 Boot Camp - March 20156

Penetration Testing What? An attack on a computer system with the intention of finding security weaknesses, potentially gaining access to it, its functionality and data (Short form known as a Pen Test) Do I need one? PCI 3.0 Boot Camp - March 2015

Anti-Virus Updates Requirement #5 Clarified Requirement – Protect all systems against malware New Requirements – Evaluate evolving malware threats – Anti-Virus solutions actively run, used, and managed – Must be logged in accordance with req. 10 How to Implement Change – Build into computer imaging and deployment process – Use centrally managed tools, Like LANDesk, where available – Work with technical contact to come up with a process – HUIT IT Security and Support Services are there to help PCI 3.0 Boot Camp - March 20158

Log Review Updates Requirement #10 Clarified Requirements – Granular audit trails linking users to system actions – What access is logged – Log all sec events & system components that deal with CHD – Log review – Store logs for at least one year How to Implement Change – Build into computer imaging and deployment process – Use central logging server where available (Splunk in the FAS) – Work with technical contact to come up with process – HUIT IT Support Services and Info Sec can help PCI 3.0 Boot Camp - March 20159

Cardholder Data Requirement #3 Clarified Requirements – Handling of sensitive authentication data – Logical access for disk encryption – Key management procedures How to Implement Change – Limit cardholder storage and retention time. Purge at least quarterly – Do not store sensitive authentication data – Render PAN unreadable – Document and implement procedures to protect encryption keys – Document and implement key management processes and procedures for encrypting cardholder data PCI 3.0 Boot Camp - March

Point of Sale Devices Requirement #9 New Requirement – Protect devices from tampering or substitution – Maintain list of devices and inspect periodically – Train personnel to be aware of suspicious behavior and to report tampering of devices How to Implement Change – Place sticker on side/joint of terminal – Request new or replacement terminals from Cash Management for inventory control – Provide employee training to address suspicious behavior or tampering of devices PCI 3.0 Boot Camp - March

Service Providers Requirement #12 New Requirement – Document which PCI DSS requirements are managed by each service provider, and which are managed by merchant. – Service providers provide the written acknowledgement to their customers of services provided and security of card data. How to Implement Change – Incorporate delineation of responsibilities within service agreement (eg., application updates) – All service providers must include Harvard PCI Rider and HRCI Rider in Service Agreement – Service Providers must submit Attestation of Compliance from QSA PCI 3.0 Boot Camp - March

MORE INFORMATION PCI 3.0 Boot Camp - March

Resources – – SAQs ocuments.php?category=saqs ocuments.php?category=saqs – Harvard Support/Questions – Trustwave QSA – Cash Management will arrange teleconference – otm.finance.harvard.edu otm.finance.harvard.edu PCI 3.0 Boot Camp - March