1. Introduction to Payment Card Industry Data Security Standard
Simon Pugh
21st Annual ECI Conference

2. History of PCI Security Standards Council
Responsible for development, management education and awareness of PCI Security Standards
Formed by American Express, Discover, JCB, MasterCard and Visa in 2006
Its genesis dates back to work underway during the dot-com boom a decade ago
21st Annual ECI Conference

3. Three Components of PCI
Source: PCI Security Standards Council
21st Annual ECI Conference

4. PCI DSS – 6 Goals, 12 Requirements
Build and Maintain a Secure Network
1. Install and maintain a firewall configuration to protect cardholder data
2. Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data
3. Protect Stored Data
4. Encrypt transmission of cardholder data across open, public networks
Maintain a Vulnerability Management Program
5. Use and regularly update anti-virus software
6. Develop and maintain secure systems and applications
Implement Strong Access Control Measures
7. Restrict access to cardholder data by business need-to-know
8. Assign a unique ID to each person with computer access
9. Restrict physical access to cardholder data
Regularly Monitor and Test Networks
10. Track and monitor all access to network resources and cardholder data
11. Regularly test security systems and processes
Maintain an Information Security Policy
12. Maintain a policy that addresses information security
21st Annual ECI Conference

5. Applicability of PCI DSS
Data Element
Storage Permitted
Protection Required
Cardholder Data
Primary Account Number (PAN)
Yes
Cardholder Name
Yes*
Service Code
Expiration Date
Sensitive Authentication Data (Post Authorization)
Full Magnetic Stripe Data No
N/A
CAV2/CVC2/CVV2/CID
PIN/PIN Block
Source: PCI Security Standards Council
* If stored in conjunction with the PAN
21st Annual ECI Conference

6. Six steps to PCI DSS Compliance
If you don’t need it, don’t store it
Secure the perimeter
Secure applications
Control access to systems
Protect stored cardholder data
Finalize remaining compliance efforts, and ensure all controls are in place
21st Annual ECI Conference

7. A Simple view of a Payment Transaction
Source: MasterCard Worldwide
21st Annual ECI Conference

8. The Retailer’s View
21st Annual ECI Conference

9. PCI DSS - Concluding Thoughts
PCI DSS seems simple in theory – compliance is far more challenging and expensive
Not complying can be far more costly though!
Technologies such as Chip+PIN may reduce the value of compromised cardholder data but don’t simplify the burden of compliance – today.
21st Annual ECI Conference