1. Making a Holiday Special For All The Right Reasons
Jeremy King
International Director
PCI Security Standards Council

2. PCI Security Standards Council

3. I Need a Holiday!!!! Taxi or transfer Face to face Hotel Travel Agent
On-line
Flights
Telephone
Hire car
Excursions and extras
Credit card details sent to at least 6 different organisations
Insurance

4. At the Airport Excess Baggage Fees Upgrades New Ticket
Changes to Ticket
Changes to Itinerary
Duty Free
Eating and Drinking

5. On the Aircraft Buying Food and Drink Buying Duty Free
Other Products / Services
Making a Phone Call
Internet on Board

6. Problems Lost Luggage Damaged Luggage Delayed Flights
Cancelled Flights
Unexpected Diversions

7. Join the Loyalty Fraud Prevention Association, (LFPA) Today
Buying Additional Loyalty Points
Using Points and Value
Join the Loyalty Fraud Prevention Association, (LFPA) Today

8. At the Hotel: Checking In
Used to be so much easier.
There was our side of the counter and your side.
People knew where they stood, literally.

9. Check-in 21st Century

10. Services in the Hotel

11. One Hotel or a Chain
Interlinked networks means criminals gaining access to just one site, gains access to the entire global hotel network.

12. So What Does All This Mean For Security?

13. PCI is Like Running an Aircraft
It is all about Security, not just Compliance

14. Not Everything In Life Ends Up As You Originally Planned!
However 640 years later:
It is a tower
It is still standing
People can climb the tower
It contains bells
The bells ring
It is still leaning

15. But You Cannot Always Defend Against Every Eventuality!
But knowing the threat there can make a huge difference

16. Cloud Computing
Can be great or just grey and confusing.

17. Encryption
Is a great way to improve security.

18. So Where Does This All Leave Us
People
Process
Technology
And a bit of luck

19. Why PCI? The World is Under Cyber Attack

20. How Much Data Are We Losing…
Source: Databreachindex.com

21. PCI Security Standards Council
Standards, Best Practices, Training, Certification, Educational Resources
Merchant & Payment Service Provider Environments
Payment Equipment
Payment Software
Standards for payment equipment, payment software and standards for everyone in the ecosystem who handles payment information.
To maintain trust and integrity that payments are secure, we certify the equipment used throughout the payments chain.
We certify people who are responsible for maintaining secure environments – internal security people and external assessors and investigators.
Our standards are:
Effective: A third-party report investigated major data breaches over the past ten years and found none were compliant with PCI Standards at the time of breach. The PCI Standards work.
Comprehensive: The Standards cover wide variety of payment security challenges, from password complexity to proper protection of EMV chip terminals, to e-commerce, and mobile payments.
Industry-tested: PCI maintains lists of independent, lab-tested applications and devices to help organizations choose technology that is and verified to protect cardholder data.
Certification – Equipment, Service Providers, Assessors, Investigators
Training – Assessors, Investigators

22. New: Best Practises for Securing E-commerce

23. New: Best Practises for Cloud Computing
Being Updated 2017 by Special Interest Group

24. PCI DSS Scoping and Network Segmentation Guide

25. PCI Guidance and Best Practices
Building a security awareness program
Protecting against malware
Skimming prevention
Defending against phishing attacks
Working with third parties
Maintaining PCI DSS compliance
Accepting payments with a mobile phone
PCI DSS compliance in the cloud
All of our standards, best practices, FAQs are available on the website in our document library – Free to all that are interested in learning more and being a part of the solution.
Continuously Developing documents and resources.
Simplify security for the Small Business marketplace
Including FAQs and tips for small merchant environments
The U.S. National Institute for Standards and Technology found a vulnerability in the old software, which is used by about 90 percent of ecommerce merchants.
There hasn’t been a major breach resulting from the vulnerability yet. But we expect some enterprising criminal will soon. And we don’t want anyone to be the one in the papers
The Council published very specific guidance on interim risk mitigation approaches, migration recommendations and alternative options for strong cryptographic protocols.
Available at:

28. To Sum Up: Why PCI? You are a priority target
Doing nothing is not an option
PCI Standards are the best set of security requirements available
This must start at the very top of your organisation
Remember; People, Process and Technology is what matters
Just buying the technology is not the answer