Introduction To Plastic Card Industry (PCI) Data Security Standards (DSS) April 28,2012 Cathy Pettis, SVP ICUL Service Corporation

PCI Background PCI-DSS developed: –Encourage and enhance cardholder data security –Facilitate adoption of consistent data security measures globally –Provide a baseline of Operational and Technical requiremeents to protect data

Who does PCI-DSS Apply TO To ALL entities involved in Payment Card Processing –Merchants –Acquirers –Processors –Issuers –Service Providers

The Question is Do you STORE PROCESS Or TRANSMIT Cardholder Data?????

The Answer YES, if Store Cardholder Reports Card Data Module on your Data Processing System Process Card Files- Post Transactions Batch or On-line-ATM, Debit, Credit Transmit Files-PBF, Card Issuance, Online Authorizations

What are the Requirements Build and Maintain a Secure Network Protect Cardholder Data Maintain a Vulnerability Management Program Implement Strong Access Control Measures Regularly Monitor and Test Networks Maintain an Information Security Policy

Build and Maintain a Secure Network 1. Install and maintain a firewall configuration to maintain data 2. Do not uses vendor-supplied defaults for system passwords and other security parameters

Protect Cardholder Data 3. Protect stored cardholder data 4. Encrypt transmission of cardholder data across open,public networks

Maintain a Vulnerability Management Program 5. Use and regularly update anti-virus software and programs 6. Develop and maintain secure systems and applications

Implement Strong Access Control Measures 7. Restrict access to cardholder data and business NEED TO KNOW 8. Assign a unique ID to each person with computer and data access 9 Restrict physical access to cardholder data

Regularly Monitor and Test Networks 10. Track and Monitor all access to network resources and cardholder data 11. Regularly test security systems and processes

Maintain an Information Security Policy 12. Maintain a policy that addresses information security for all personnel

Requirements---Easy There are ONLY 12

PCI DSS Applicability Wherever account data is stored,processed or transmitted???? Account data is Cardholder Data PLUS sensitive Authentication Data: –Cardholder Data- Primary Account Number PAN –Cardholder Name –Expiration Date and Service Code

Applicability Information cont’d Sensitive Authentication Data includes: –Full magnetic stripe data or equivalent on a chip –CAV2/CVC2/CVV2/CID –PINs/PIN Blocks

Here’s THE Test

Is Storage Permitted PAN Yes Cardholder Name Yes Service Code Yes Expiration Date Yes Full Magnetic Stripe Data No CVV/CVC/CAV/CID No PIN/PIN Block No

If YES, now what? Stored data MUST be unreadable PAN YES Cardholder Name No Service Code No Expiration Date No Sensitive Authentication Data Cannot be stored period

What Next Perform a Risk Assessment Know what data you have, who has access and what you do with it Know how your network is secured Establish an Information Security Policy and Standards Document Engage the Board of Directors, Internal Auditor, External Auditor

What Next cont’d Make a Plan to become PCI Compliant Engage the services of a Qualified System Assessor (QSA) Validate your data providers are PCI Certified

Next Security Physical and Data is everyone’s responsibility Take it seriously and protect your member cardholder data

Questions???

Resources

THANK YOU Cathy Pettis, SVP