1. 2013 PCI:DSS Meeting OSU Business Affairs
Process Improvement Team (PIT)
Dan Hough & Robin Whitlock
12/31/2013

2. Today’s Presentation What do you have to do? What is PCI DSS?
Why is it important?
Compliance Life Cycle
Cardholder Data/Storage
Goals & Requirements
Resources
Questions

3. Your to do list by January 31st:
Verify credit card merchant information with Business Affairs
Obtain 3rd Party PCI DSS Certificate of Compliance (if applicable)
Merchant managers complete and sign the Cover Page & SAQ (Annual PCI DSS Assessment must be completed for all Merchants).
Business Center Manager or FAM must review and sign.
Send to Dan Hough and Robin Whitlock
This is your to do list after this meeting. Keep it in mind as we go through the presentation.
Verify
The status report is a list of merchants by business Center and shows the merchant name, MID Type, MID #, the contact person, and which SAQ you must complete. A printed Status Report in back of room. Please take a moment to verify that everything is correct and that the correct contact person is listed. You can write any changes on it or them to me. You can also find the report on our website after the meeting.

4. What is PCI DSS? Payment Card Industry Data Security Standards
Administered by the PCI Security Standards Council, which was founded by the major credit card companies (VISA, MC, Disc…)
Mirror best security practices
Applies to all entities that store, process or transmit cardholder data (merchants, payment card issuing banks, processors, developers…)
That means you!
Define PCI
Developed by the leading credit card networks (Visa, MC, Discover)
Req’d for all entities that store, process, or transmit cardholder data
This means all of you!

5. Why Is Compliance Important?
Reputation protection (customers, acquirers and payment brands, OST)
Reduce potential legal liabilities
Avoid fines and legal costs
Avoid Investigative charges
Data compromise may result in higher PCI DSS validation level
Maintain MID
Understanding of information & risks
Continue accepting cards
Compliance is mandatory
(eCommerce Policy, Oregon State Treasury,PCI DSS).
Why do you all think compliance is important?
Reputation
Reduce legal liabilities
Avoid costs
Avoids additional work – if you have a breach you must now report at the highest validation level.
Maintain your Merchant ID (because this is mandatory)
Gives you a better understanding of the process and risks

6. Why PCI:DSS ? Educational institutions: 716 breaches (~17%)
4,139 breaches of sensitive information (>662 million records) since 2005
(Ref: PrivacyRights.org 12/31/13)
Educational institutions: 716 breaches (~17%)
Since 2005 there have been over 4000 breaches of sensitive information, 579 last year alone.
Educational institutions make up ~17% of these breaches since 2005 and 45 of them occurred last year!

7. Target Data Breach

8. Think it can’t happen here?
It already has!!!
In 2005 Hackers broke into the Bookstores online application and stole credit card data
Summer 2012 we discovered that a vendor had taken some information, it wasn’t credit card information but it was still sensitive information, from the cashiers office to use in development of their application. Though the data was not taken maliciously and we are confident that it was not shared with others it was still a breach and we had to respond to it.

9. Compliance Life Cycle Ongoing Compliance Monitoring PCI:DSS Validation
Pre-Assessment / Gap Analysis
Implement / Remediate
Ongoing Compliance Monitoring
Compare what you are doing to the requirements in your SAQ. Look for what’s broken or where you are not in compliance
Fix it
Complete and submit the PCI-DSS SAQ by January 31st.
1 Pre-Assessment/Gap Analysis and 2 Implement/Remediate are ongoing throughout the year. 3 is what we are doing now, but you still have a chance to remediate issues prior to submission.
If you find that you are not in compliance with standards and fix it before you submit the SAQ that is great. If you cant fix it before you submit the SAQ you must state when and how you are going to fix it on the SAQ.
The process isn’t done when you complete the SAQ. Now that you know what is expected you need to stay in compliance and watch out for weak spots in your processes.

10. Chip/Magnetic Strip Data
What is Cardholder Data?
Primary Account Number (PAN)
Expiration Date
Cardholder Name
So What are we trying to protect? We are protecting Cardholder Data
The Primary Account Number (PAN)
Expiration Date
Name
Chip/Magnetic Strip Data
3 digit code on the back of the card
It is preferred that you do not store any of this data, though you can store the PAN, Expiration, and Cardholder Name if it is protected.
You may never store the chip/magnetic strip data or the CVC2 #
Chip/Magnetic Strip Data
CAV2/CVC2/CVV2

11. Sensitive Authentication Data[2]
PCI Data Storage
Data Element
Storage
Permitted
Protection
Required
Cardholder Data
Primary Account Number (PAN)
Yes
Cardholder Name[1]
Yes[1]
Expiration Date[1]
Sensitive Authentication Data[2]
Full Magnetic Strip Data[3] No
N/A
CAV2/CVC2/CVV2
These data elements must be protected if stored in conjunction with the PAN.
Sensitive authentication data must not be stored after authorization (even if encrypted).
Magnetic stripe or chip.

12. PCI DSS Goals & Requirements
(digital dozen)
Build and Maintain a Secure Network (2)
Install and maintain a firewall configuration to protect cardholder data
Do not use vendor-supplied defaults for system passwords and other parameters
Protect Cardholder Data (2)
Protect stored cardholder data
Encrypt transmission of cardholder data across open, public networks
We attempt to protect this data by following the PCI:DSS
These are called the digital dozen and provide an overview of what you will be asked during the reporting process. Depending on how you accept credit cards some of these may not apply to you.
If you are using our network to transmit or process credit card data make sure that a firewall is in place to restrict who can get to it.
Don’t use default passwords. If you have a card swipe terminal and you need to enter a password to process refunds or to batch out, change it from 1234 so only authorized staff can access it.
Protect cardholder data. – if you must store it physically or electronically make sure its protected. When I say electronically it does not mean an excel file of account numbers its regarding the servers for those who use Micros and TouchNet
If you are using the network to transmit data make sure its encrypted and protected.

13. PCI DSS Goals & Requirements
Maintain a Vulnerability Management Program (2)
Use and regularly update anti-virus software
Develop and maintain secure systems and applications
Implement Strong Access Control Measures (3)
Restrict access to cardholder data by business need-to-know
Assign a unique ID to each person with computer access
Restrict physical access to cardholder data
Maintain
Use and update your antivirus software
Keep software and applications up to date and protected
Implement Strong
Restrict who can access the data to those who need to know
Use unique logins
If you store info in a file cabinet, (again not recommended!!!!) restrict who can get to it.

14. PCI DSS Goals & Requirements
Regularly Monitor and Test Networks (2)
Track and monitor all access to network resources and cardholder data
Regularly test security systems and processes
Maintain an Information Security Policy (1)
Maintain a policy that addresses information security
Monitor and test networks that transmit this data. Track who has access to it
Maintain a Information security policy.
You can tell some of these things are already provided in the OSU environment and some only apply to certain scenarios. If you don’t know ask your IT staff or ask us.

15. Misconceptions Self assessment means you’re compliant
Compliance means you won’t suffer a breach
Outsourcing takes away your need for compliance
PCI:DSS is just about IT
A single product can make you compliant
Compliance can be automated

16. What do we have to do? Level/ Tier Merchant Criteria
Validation Requirements 1
Merchants processing over 6 million Visa transactions annually (all channels)
Annual Report on Compliance by Qualified Security Assessor (“QSA”)
Quarterly network scan by Approved Scan Vendor (“ASV”)
Attestation of Compliance Form 2
Merchants processing 1 million to 6 million Visa transactions annually (all channels)
Annual Self-Assessment Questionnaire
Quarterly network scan by ASV 3
Merchants processing 20,000 to 1 million Visa e-commerce transactions annually
Annual SAQ 4
Merchants processing less than 20,000 Visa e-commerce transactions annually and all other merchants processing up to 1 million Visa transactions annually
Quarterly network scan by ASV if applicable
Requirements set by acquirer
We are tier 4 and must complete an annual SAQ. There are several different versions and the one you must complete is indicated on the status report.
The reason we put this up there is to show you how easy we have it. If you have a breach, you automatically go up to tier 1 which means more work and more costs!

17. Changes from Last Year..
TouchNet merchants must complete the cover page and the SAQ-A
Before we go into all the documents, for all of those who completed this last year here are a couple of changes…

18. Annual PCI DSS Assessment Documents
Documents due by January 31st, 2014:
OSU Cover Page
Self Assessment Questionnaire (SAQ A-D Appropriate to merchant)
3rd Party PCI DSS Certificate of Compliance (if applicable)
Resources available on our website:
Status Report by Business Center
SAQ Forms, Instructions, and guidelines
Navigating the PCI DSS
Glossary
Now lets take a look at what this entails.

19. PCI DSS Assessment Cover Page
The purpose of the cover page is to verify our records and to make any necessary updates.
You will be asked to provide contact info, how you are using your merchant ID, what hardware/software you are using.
Dan will speak to the detail of the form.
You may also consolidate similar merchants on this page.

20. Multiple Merchant Consolidation
Multiple merchants can be can be combined into a single submittal if:
The merchant IDs (MIDs) are of the same type (i.e. all POS, Web…)
All merchants are managed by same merchant manager
The same policies and procedures apply to all merchants
Strictest SAQ will apply (the one with the most questions)
List all merchants on cover page.
Overview.
Example UHDS

21. Self Assessment Questionnaire (SAQ)
Completed by the merchant manager
Subset of full requirements
Broken down by Goals & Requirements
Made up of Yes / No / Not Applicable responses
NA or “Compensating Control”- must be explained
No- Must have Remediation Date and Actions
Attestation Section
Fill out the Merchant Version
Do not complete the Service Provider Version

22. SAQ Example-Requirements
Made up of Yes / No / Not Applicable responses
If Yes, done with this question.
NA or “Compensating Control”- must be explained
No- Must have Remediation Date and Actions

23. Compliance Summary This example is a summary for an SAQ-A. Minimal.
If you say no to one question in the section you must report that you are not compliant for the entire section. You must provide the remediation date and actions on this page.

24. SAQ Example- Explanation of Non-Applicability
If you marked N/A, this is where you describe it.
Do not just call it requirement 12, include the specific sub-section being addressed, for example 12.8.

25. SAQ Example-Compensating Controls
If you think you have a compensating control this is where you explain it.
Yes – You are meeting the requirement but in a different way than what is described

26. SAQ Example-Attestation
There are two parts of Attestation of Compliance.
Make sure you complete the Merchant version, not Qualified Security Assessor Company version.
Complete “Merchant” version not Qualified Security Assessor Company version (if avail).
OSU does not use a Qualified Security Assessor Company

27. Your to do list by January 31st:
Verify credit card merchant information with Business Affairs
Obtain 3rd Party PCI DSS Certificate of Compliance (if applicable)
Merchant managers complete and sign the Cover Page & SAQ (Annual PCI DSS Assessment must be completed for all Merchants).
Business Center Manager or FAM must review and sign.
Send to Dan Hough and Robin Whitlock
Electronic submission is preferred.
This is your to do list after this meeting. Keep it in mind as we go through the presentation.
Verify
The status report is a list of merchants by business Center and shows the merchant name, MID Type, MID #, the contact person, and which SAQ you must complete. A printed Status Report in back of room. Please take a moment to verify that everything is correct and that the correct contact person is listed. You can write any changes on it or them to me. You can also find the report on our website after the meeting.

28. Resources
PCI Compliance for OSU Credit Card Merchants (instructions & forms)
OSU FIS Manual
OUS Policy Guideline for Electronic Commerce
Oregon Accounting Manual - Credit Card Acceptance for Payment
Oregon State Treasury Cash Management Policy
Payment Card Industry Data Security Standards
We will also you a link to this presentation, which will be posted on the OSU PCI website.

29. Business Affairs Contacts
Thank You
Business Affairs Contacts
Robin Whitlock
Dan Hough
For those of you that have done this before, what advice to you have for others or what questions do you still have?