Introduction to Payment Card Industry Data Security Standard Simon Pugh 21st Annual ECI Conference

History of PCI Security Standards Council Responsible for development, management education and awareness of PCI Security Standards Formed by American Express, Discover, JCB, MasterCard and Visa in 2006 Its genesis dates back to work underway during the dot-com boom a decade ago 21st Annual ECI Conference

Three Components of PCI Source: PCI Security Standards Council 21st Annual ECI Conference

PCI DSS – 6 Goals, 12 Requirements Build and Maintain a Secure Network 1. Install and maintain a firewall configuration to protect cardholder data 2. Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data 3. Protect Stored Data 4. Encrypt transmission of cardholder data across open, public networks Maintain a Vulnerability Management Program 5. Use and regularly update anti-virus software 6. Develop and maintain secure systems and applications Implement Strong Access Control Measures 7. Restrict access to cardholder data by business need-to-know 8. Assign a unique ID to each person with computer access 9. Restrict physical access to cardholder data Regularly Monitor and Test Networks 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes Maintain an Information Security Policy 12. Maintain a policy that addresses information security 21st Annual ECI Conference

Applicability of PCI DSS Data Element Storage Permitted Protection Required Cardholder Data Primary Account Number (PAN) Yes Cardholder Name Yes* Service Code Expiration Date Sensitive Authentication Data (Post Authorization) Full Magnetic Stripe Data No N/A CAV2/CVC2/CVV2/CID PIN/PIN Block Source: PCI Security Standards Council * If stored in conjunction with the PAN 21st Annual ECI Conference

Six steps to PCI DSS Compliance If you don’t need it, don’t store it Secure the perimeter Secure applications Control access to systems Protect stored cardholder data Finalize remaining compliance efforts, and ensure all controls are in place 21st Annual ECI Conference

A Simple view of a Payment Transaction Source: MasterCard Worldwide 21st Annual ECI Conference

The Retailer’s View 21st Annual ECI Conference

PCI DSS - Concluding Thoughts PCI DSS seems simple in theory – compliance is far more challenging and expensive Not complying can be far more costly though! Technologies such as Chip+PIN may reduce the value of compromised cardholder data but don’t simplify the burden of compliance – today. 21st Annual ECI Conference