PCI: As complicated as it sounds? Gerry Lawrence CTO

Background ► Experts in business critical hosting ► Wide range of customers ► …including many e-commerce sites

Growth of e-commerce Source: UK National Statistics Office

Card fraud Source: UK Card Association Reduction due to: Sophisticated fraud screening Cardholder authentication Awareness campaign PCI compliance improvements

Card fraud Source: Home Office statistics (534 businesses polled) At some point every business website will suffer an attempted attack in a year. In burglary's took place in the UK according to Home Office statistics yet the number of hacks that occur far outweigh this figure. According to Information Security Breaches survey % of business respondents suffered a security breach

Card fraud Source: Home Office statistics (534 businesses polled) ► PCI awareness increased ► PCI standards more organised more specific and tougher ► Banks now following through on non-compliance

Time/resource ► Many skills only needed some of the time ► Monitoring is very time consuming ► Monitoring needs to happen 24x7

Skills ► Deep understanding of the compliance and regulatory framework ► Secure network design ► Systems design ► Detailed log analysis ► Incident response

Typical system Internet Primary datacentre Secondary datacentre Firewalls Firewall Web servers Database servers Backup server Web server Database server Backup server SAN Load balanced

Choosing the right partner Selection criteria: ► Security industry expertise to compliment our own ► Specific PCI compliance experience ► Pro-active 24 hour monitoring and response service ► Cultural fit and great attitude

Build and Maintain a Secure Network Requirement 1:Install and maintain a firewall configuration to protect cardholder data Requirement 2:Do not use vendor-supplied defaults for system passwords and other security parameters 12 steps to achieve PCI Compliance

Build and Maintain a Secure Network Requirement 1:Install and maintain a firewall configuration to protect cardholder data Requirement 2:Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data Requirement 3:Protect stored cardholder data Requirement 4:Encrypt transmission of cardholder data across open, public networks 12 steps to achieve PCI Compliance

Build and Maintain a Secure Network Requirement 1:Install and maintain a firewall configuration to protect cardholder data Requirement 2:Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data Requirement 3:Protect stored cardholder data Requirement 4:Encrypt transmission of cardholder data across open, public networks Maintain a Vulnerability Management Program Requirement 5:Use and regularly update anti-virus software Requirement 6: Develop and maintain secure systems and applications 12 steps to achieve PCI Compliance

Build and Maintain a Secure Network Requirement 1:Install and maintain a firewall configuration to protect cardholder data Requirement 2:Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data Requirement 3:Protect stored cardholder data Requirement 4:Encrypt transmission of cardholder data across open, public networks Maintain a Vulnerability Management Program Requirement 5:Use and regularly update anti-virus software Requirement 6: Develop and maintain secure systems and applications Implement Strong Access Control Measures Requirement 7:Restrict access to cardholder data by business need-to-know Requirement 8:Assign a unique ID to each person with computer access Requirement 9:Restrict physical access to cardholder data 12 steps to achieve PCI Compliance

Build and Maintain a Secure Network Requirement 1:Install and maintain a firewall configuration to protect cardholder data Requirement 2:Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data Requirement 3:Protect stored cardholder data Requirement 4:Encrypt transmission of cardholder data across open, public networks Maintain a Vulnerability Management Program Requirement 5:Use and regularly update anti-virus software Requirement 6: Develop and maintain secure systems and applications Implement Strong Access Control Measures Requirement 7:Restrict access to cardholder data by business need-to-know Requirement 8:Assign a unique ID to each person with computer access Requirement 9:Restrict physical access to cardholder data Regularly Monitor and Test Networks Requirement 10:Track and monitor all access to network resources and cardholder data Requirement 11:Regularly test security systems and processes 12 steps to achieve PCI Compliance

Build and Maintain a Secure Network Requirement 1:Install and maintain a firewall configuration to protect cardholder data Requirement 2:Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data Requirement 3:Protect stored cardholder data Requirement 4:Encrypt transmission of cardholder data across open, public networks Maintain a Vulnerability Management Program Requirement 5:Use and regularly update anti-virus software Requirement 6: Develop and maintain secure systems and applications Implement Strong Access Control Measures Requirement 7:Restrict access to cardholder data by business need-to-know Requirement 8:Assign a unique ID to each person with computer access Requirement 9:Restrict physical access to cardholder data Regularly Monitor and Test Networks Requirement 10:Track and monitor all access to network resources and cardholder data Requirement 11:Regularly test security systems and processes Maintain an Information Security Policy Requirement 12:Maintain a policy that addresses information security 12 steps to achieve PCI Compliance

12 steps to achieve PCI Compliance PCI compliance… Does it apply to me? No, because I use a 3 rd party payment provider…. ?

12 steps to achieve PCI Compliance PCI compliance… Does it apply to me? No, because I use a 3 rd party payment provider…. ….ever heard of ‘Man in the Middle’? ?

12 steps to avoid Snakes & Hackers What are the risks? ► Huge Fines ► Banks may refuse your business ► More expose to repeat hacking attacks ► Brand reputation ?

12 steps to avoid Snakes & Hackers How can NetBenefit help?

NetBenefit is located at Stand 930 ► Pick up our PCI whitepaper ► Speak to our PCI experts ► Happy to answer any questions

Working together