North Carolina Community College System IIPS Conference – Spring 2009 Jason Godfrey IT Security Manager (919)

 PCI Data Security Standard (DSS)  Latest Data Security Standard  Compliant Process  Becoming Compliant  Maintaining Compliance  Determining Which SAQ  General Tips  Prioritizing Milestones  Challenges  Additional Information  Q & A - Open forum

 Current version is 1.2  Released October 2008  Majority of changes are explanatory and clarifications  Three enhancements  Section – Testing requirements and wireless encryption standards  Appendix D: attestations and compliance forms  Appendix E: attestations and compliance forms

1. PCI DSS Scoping – determine what system components are governed by PCI DSS 2. Sampling – examine the compliance of a subset of system components in scope 3. Compensating Controls – QSA validates alternative control technologies/processes 4. Reporting – merchant/organization submits required documentation 5. Clarifications – merchant/organization clarifies/updates report statements (if applicable)

Remediate Report Assess

 Never store sensitive card data  Full content of the magnetic strip  Card validation codes and values  PIN blocks  Contact your POS vendor regarding PCI compliance  Don’t store card holder data if you don’t need it  Minimize scope  Prioritize requirements

1. Remove sensitive authentication data and limit data retention. 2. Protect the perimeter, internal, and wireless networks. 3. Secure payment card applications. 4. Monitor and control access to your systems. 5. Protect stored cardholder data (security classes). 6. Finalize remaining compliance efforts, and ensure all controls are in place. 1 The Prioritized Approach to Pursue PCI DSS Compliance

 Documenting policies, processes, and procedures  Storing backups in secured manner (off-site is preferable)  Separation of duties  Local payment card applications  Hardware and software  CCTV  File monitoring  Audit trails  Internal and external penetration tests  Training  Management buy-in and user acceptance

 PCI Council  PCI Council Navigating the SAQ ss.pdf  PCI Council Quick Guide  PCI Prioritized Approach PCI_DSS_1_2.pdf  Trustwave  General Questions – (800) 

 System Office – contact the CIS Help Desk  US CERT  SANS Institute  NC ITS State-wide Security Manual n_Security_Manual.asp  Open Source applications  Network Security Tool (NST)  Snort  Untangle  Zenoss

Q & A