Prepared by Jerod Brennen For ISACA – Central Ohio Chapter Meeting 12/9/2010

Overview  Summary of Changes  Operational Perspective  Details of Changes  Observations

Summary of Changes (136)  Clarifications 119 total Wording portrays intent  Additional Guidance 15 total Increase understanding  Evolving Requirements 2 total Emerging threats and changes

Operational Perspective  Informational 61 total  Moderate Impact 41 total  Significant Impact 34 total Subjective (your mileage may vary)

Details - General  Operations Staff PCI DSS Applicability Information ○ Account Data = Cardholder Data + Sensitive Authentication Data Scope of Assessment for Compliance with PCI DSS Requirements ○ Added “virtualization components” to the definition of “system components” Policies, Procedures, Standards, etc.  Auditors Sampling of Business Facilities and System Components ○ Criteria that must be documented when sampling ○ Sampling rationale must be (re)validated with each audit Instructions and Content for Report on Compliance ○ Pp > detailed instructions for the RoC Consistency (QSA selection) How much will the Summary of Changes alter QSA procedures?

Details – Section 1  Moderate Impact 1 > “system components providing firewall functionality” to be treated as firewalls > examples of insecure services, protocols, & ports (FTP, Telnet, POP3, IMAP, SNMP) > removed specification of port scanner use > testing procedure applies to “any type of cardholder data storage” (i.e., files)  Significant Impact 1.4.b > “personal firewall software should not be alterable by employee-owned computer users” ○ Local admin rights?

Details – Section 2  Moderate Impact a-e > removed reference to WPA ○ WPA cracked in late > added sources for hardening standards ○ CIS, ISO, SANS, NIST 2.2b > linked system configuration standards to vulnerabilities (was in in 6.2.b) a-b > only enable “necessary and secure” services 2.3.a-c > “strong” cryptography is required ○ Need for agility (point-in-time)  Significant Impact > clarified intent of “one primary function per server” and use of virtualization ○ Web, Database, DNS; functions that require different security levels b > optional testing procedure for virtualization technologies

Details – Section 3  Moderate Impact 3.4 > Deleted note on compensation controls ○ “may be applicable for most PCI DSS requirements” c > Clarification on encryption removable media ○ Rendered unreadable through encryption or some other method 3.5 > “Any” keys used to secure cardholder data must be secured > Clarification around key management operations ○ “manual clear-text cryptographic key mgmt operations” > Key custodians formal acknowledgment (writing or electronic)  Significant Impact 3 > Introductory Paragraph, don’t send PAN’s via end-user messaging tech ( , IM) ○ Enforcement? 3.2 > business justification for storing “sensitive authentication data” > Increased frequency of key changes, per “defined cryptoperiod” > New testing procedures for retired keys

Details – Section 4  Moderate Impact 4.1.c > Protocol “must be implemented” to use only secure configurations (i.e., encrypted)  Significant Impact > 6/3/2010 has passed; no more WEP 4.2 > PANs should never be sent by end- user messaging technologies (see section 3)

Details – Section 5  Moderate Impact none  Significant Impact 5.2 > AV must be generating audit logs, and not just “capable of generating” logs

Details – Section 6  Moderate Impact > clarified scope to include non-web applications a-b > addresses security patches and software modifications ○ Details to include in change documentation > documentation of impact is required 6.5 > broadened to include OWASP, SANS CWE, & CERT > again, OWASP + CWE + CERT  Significant Impact * 6.2 > evolving req, rank vulnerabilities according to risk 6.3.a-d > added types of software apps to be tested (scope) ○ Security in “written software development proceses” a-b > requires security testing for application changes * > new req regarding high-risk vulnerabilities ○ Best Practice through 6/30/2012

Details – Section 7  Moderate Impact none  Significant Impact none

Details – Section 8  Moderate Impact 8 > POS access to one card number at a time ○ Aligned with PA-DSS requirement > clarified intent of multi-factor authentication ○ Know, Have, Are ○ No clarification on physical vs. virtual here > password resets (unique value, immediate change) a-b > clarified “access” by vendors ○ Disabled by default, enabled only when needed ○ Monitored while being used > password management for “non-consumer users” ○ For service providers only  Significant Impact 8.5.2/7/8/13 > allow for authentication mechanisms outside of passwords a-d > restricting user queries against databases ○ Closer review of database config

Details – Section 9  Moderate Impact > restrict physical access to ”networking / communications hardware and telecommunications lines” > visitors are not permitted unescorted physical access to areas that store cardholder data 9.6 > changed “paper and electronic media” to “all media” ○ Computers, removable electronic media, paper receipts, paper reports, faces, etc.  Significant Impact > intent is to determine sensitivity of data on media ○ “Verify that all media is classified…”

Details – Section 10  Moderate Impact > changes to time settings are authorized > time is received from industry accepted sources  Significant Impact 10.7.b > processes to “immediately restore” log data (vs. “immediately available)

Details – Section 11  Moderate Impact none  Significant Impact 11.1 > “detect unauthorized wireless access points on a quarterly basis” (vs. real-time) 11.1.a-e > detect & alert on unauthorized wireless access points > internal & external scans must be verified (ASV) a-c > scans must be repeated & verified until all high vulnerabilities have been resolved a-b > ref to ASV Program Guide Requirements a-c > keep scanning until high vulnerabilities are resolved > vulnerability scanning must encompass all application types in-scope (see 6.5) 11.4 > IDS/IPS at the perimeter and at key points inside the CDE

Details – Section 12  Moderate Impact > replaced “once a year” with “annually” 12.3 > added “tablet” to example technologies a-b > flexibility to limit prohibitions to those “personnel without authorization” 12.7 > “potential personnel to be hired for certain positions” ○ Recommendation if personnel can only access one card number at a time  Significant Impact > test should verify risk assessment documentation > monitor service providers’ PCI compliance at least annually > designated personnel should be available 24/7 for incident response

Details – Appendices  Moderate Impact Appendix E is now “Attestation of Compliance – Service Providers” ○ options for list of services not covered by PCI DSS assessment Appendix D > Segmentation and Sampling of Business Facilities / system Components ○ was Appendix F ○ aligns with new introduction  Significant Impact none

Observations  Perception Revised vs. New  Should vs. Must 27 vs. 77  Effective Date  Risk-Based  New Technologies Wireless Virtualization Encryption (future-state)  Better Log Management  Opportunities Fresh Document Auditors can help Operations achieve compliance Budget

Questions? Jerod Brennen