1. PCI Compliance Technical Overview 2008

2. RM PCI Calendar Sept 2006: Official 15.1 PCI Release Sept 2006: 15.1 certified PCI Compliant Jan 2007: VISA approves certification May 2007: Official 16.0 PCI Release Dec 2007: 16.0 certified PCI Compliant Awaiting VISA certification approval

3. Terms and Definitions n PCI DSS: Payment Card Industry Data Security Standard n PABP: Payment Application Best Practices n RM is a validated payment application that meets the PCI PABP n So what is “PCI Compliance”? Hint: It’s not simply installing RM 15.1.

4. The PCI Compliant Site To be a fully PCI compliant site, there are 4 areas needing attention: n Use PABP validated applications  Install RM 15.1 or later n Proper configuration  RM and Reseller PCI Guidance Doc RM and Reseller PCI Guidance n Proper procedures  Server machine access  Remote access n Site guidelines  Physical machine access  Network / Wireless

5. Basic Network Internet

6. Network w/ WiFi Internet

7. Network w/ WiFi Internet Symbol WS2000

8. Network w/ web svcs Internet Symbol WS2000 DMZ for Online Ordering Rmbrowser Write-On Phone Central Manager

9. What’s a DMZ? n DMZ: “De-Militarized Zone” n Separate network isolated from RM network n DMZ exposed to internet n RM network isolated from internet n All enforced through firewall configuration rules

10. Network with DMZ Internet DMZ 10.1.1.* RM 10.1.0.* 10.1.1.1 10.1.0.1 10.1.1.254 10.1.0.254

11. Setting up DMZ Server n RM and Reseller PCI Guidance : RM and Reseller PCI Guidance  Install NetworkActiv AUTAPF port forwarder as a service  Configure single port forwarding rule  Configure OO/RMbrowser/WO Phone setup to go to DMZ machine and port

12. Firewall Rules Internet DMZ 10.1.1.* RM 10.1.0.* Limited to proxy

13. Setting up the Firewall n Symbol WS2000 configuration  Two subnets  1 for RM  1 for DMZ  Firewall Rules n Now we’ll show you how…

14. Questions?