1. Jon Bonham, CISA, QSA Director, ERC JBonham@Coalfire.com
PCI, What is it all about?
Jon Bonham, CISA, QSA
Director, ERC
Fayetteville Fort Bragg

2. Agenda Introduction of Coalfire PCI 101
Is it for the Business Office or IT Department
Some changes that have an impact on schools
Questions and Answers
Contact Information

3. Coalfire Services

4. Coalfire Regional Offices Over 300 employees

5. About Coalfire QSA for the state of North Carolina
Agencies, Departments, Colleges and Universities are all set up on Coalfire’s Navis platform for scans and SAQs.
Coalfire as a division set up just to handle state and local government as well as higher education and large diverse hospital systems.
Coalfire successfully manages projects for small stand alone colleges as well as large diverse multi campus University systems.
Coalfire is a leader in PCI, HIPAA, FERPA, FISMA, GLBA and Personal information auditing and assessments.
Coalfire is vendor agnostic so they don’t care who you use for any hardware, software, managed services or card processing. They work for their customers as a trusted partner and advisor.

7. First Breach?

8. Where did this all start?
In December of 2004, VISA and MasterCard aligned their programs under the banner PCI Data Security Standard (PCI DSS)
American Express, Discover, JCB and Diners endorsed this new standard as well
VISA initially managed and coordinated the PCI DSS
Card brands created the PCI Security Standards Council (SSC) to assume management of the program
PCI SSC managed by Executive and Management Committees made up of senior representatives from the card brands
End Result
Common security requirements for securing card data.

9. Who Does What? 1. Develops Standards
2. Establishes compliance requirements
3. Enforces requirements on merchants
4. Merchant

10. What you signed up for

11. We don’t want to just check a box

12. What are We Protecting Cardholder Verification Number (CVN)
PAN
Cardholder Verification Number (CVN)
Visa/Discover's Card Verification Value (CVV)
Mastercard's Card Validation Code (CVC)
Called Prohibited Data – can not retain after authorization
Primary Account Number (PAN)
CVN

13. What does this have to do with business?
Income
Easier
No bounced checks
The decision to take cards was made in the business office
The contracts were signed by the business office
The part in the contract about always being PCI compliant was signed by the business office

14. IT Department Install and configure the hardware and software
Segment and maintain the network
Monitor what is happening
Implement changes
Work with the business office, merchants and vendors to maintain a secure cardholder date environment.

15. Just a thought or action isn’t enough.

16. Overkill

17. SAQ Validation Types

18. Penetration Test Required V3.0
SAQ Validation Types
SAQ Validation Type
Description
# of Questions v3.0
Change # from v2.0
ASV Scan Required v3.0
Penetration Test Required V3.0 A
Card-not-present merchants: All payment processing functions fully outsourced, no electronic cardholder data storage 14 +1 No
A-EP
E-commerce merchants re-directing to a third-party website for payment processing, no electronic cardholder data storage
139
NEW
Yes B
Merchants with only imprint machines or only standalone dial-out payment terminals: No e- commerce or electronic cardholder data storage 41
+12
B-IP
Merchants with standalone, IP-connected payment terminals: No e-commerce or electronic cardholder data storage 83 C
Merchants with payment application systems connected to the Internet: No e-commerce or electronic cardholder data storage
+59
C-VT
Merchants with web-based virtual payment terminals: No e-commerce or electronic cardholder data storage 73
+22
D-MER
All other SAQ-eligible merchants
326
+38
D-SP
SAQ-eligible service providers
347
P2PE
Hardware payment terminals in a validated PCI P2PE solution only: No e-commerce or electronic cardholder data storage 35

19. The “Bucket” Approach SAQ A’s SAQ B’s SAQ C’s
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
SAQ A’s
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
MID
SAQ B’s
SAQ C’s
From this to…………………………………………….this

20. PCI DSS 3.1: Goals
The PCI SSC is pushing the concept of ongoing or continuous compliance management
Monitoring of security controls
Detect and respond to failures in security controls
Review all changes to the environment
Organization structure changes
Periodic reviews
Annual hardware/software review

21. Some of the new requirements to keep in mind.
Dataflow diagrams
Requirement 2.4
Inventory of all in-scope system components
Requirement 5.1.2
Risk-based malware review for systems not commonly affected by malicious software
Requirement b
Termination processes must include all physical authentication methods in addition to systems

22. PCI DSS 3.1: New Requirements
New requirement to maintain information about which PCI DSS requirements are managed by the service provider.

23. PCI DSS 3.1:
Requirement(s) 9.9.x
New (merchant) requirements to protect point-of-sale devices that capture payment card data from tampering or unauthorized modification or substitution.

24. Expanded requirements/expectations for penetration testing controls.
PCI DSS 3.1
Requirement 11.3.X
Expanded requirements/expectations for penetration testing controls.

25. PCI DSS 3.1
Requirement 12.9
Service providers acknowledge in writing to customers that they are responsible for the security of cardholder data.

26. Questions about the changes?

27. Thanks for attending!
Jon Bonham, CISA, QSA