How Can I Sign New Mexico Banking Word

How can i industry sign banking new mexico word secure

a couple of quick samples here on the network segmentation if that wasn't clear there here we have a sample diagram just typical environment the server's highlighted in red down along the bottom indicate those systems that are in this case are handling credit card data directly storing it transmitting it etc so you have some application servers and database servers etc those are the ones touching card data in this kind of an environment the scope of PCI compliance would look something like this in other words everything would be in scope why remember that connected systems rule all these various connected systems they're in those same segments automatically in scope and even these satellite offices because there's connected by a point-to-point router and in this case we're saying that that does not have a firewall feature set on it so the tech use online that would be considered a flat network and they are in scope if everything is firewalled neatly in segmented then you have different options so in this case we would not recommend just going ahead and starting to remediate we would say let's first improve our segmentation let's hang a couple of new interfaces off of our firewall or maybe deploy some new firewalls and let's statement out those systems that are handling card data and we can then reduce our scope potentially to something like this now it's not that simple and you have to talk to all these specifics of maybe for example how are these end-users dealing with card data if they are they can get hold in the scope but then there's things like thin client solutions that you can use to then again keep them out of scope we don't have time to get into all that today but the point is segmentation done right can drastically reduce scope and then the cost for PCI so it's well worth working on data tokenization is also well worth considering this is a rapidly evolving field you will find many people offering this now I've listed out some of the players here this is just a very short list there are many others a couple of the ones that we've dealt a lot with lately you know Chase Paymentech is gotten a lot into this Braintree deals heavily with this shift for those the guys that kind of pioneered it authorize.net and Akamai our two guys are getting a lot of play lately so a lot of a lot of players getting into this a lot more every day we're not certainly recommending or or you know backing anybody here just kind of listing some examples that you can go and check out for yourselves but there's a lot of people we always recommend by the way that you start with your acquiring bank or processor whoever you're already doing business with because there's a good chance that they're already offering something like this or will be soon and you want to leverage your distal relationship and fee structure as much as you can so just a quick overview if you haven't heard of or if you're not familiar with tokenization it's basically about redirecting hard data so that it does not go through your environment typical environment it might go through your website for example and an e-commerce set up that card data might be stored everything's in scope that with tokenization you're using a third party in a way that the card data is going from the end-user browser straight to the third party and all your web server is getting back is an authorization code card data never hits your server you can actually keep your stuff out of scope when you do this that's about all we're going to be able to get into that today because we are gonna have to keep this high-level but it is something well worth exploring there is also in-house tokenization that can be explored which lets you do the same thing but centrally tokenize to a single centralized data store internally these are all things we can talk about in more detail to follow up if you'd like but data tokenization is a rapidly evolving technology and service that's well worth looking at if you haven't already end-to-end encryption is also a very popular and rapidly evolving option worth taking a look at not as far along as data tokenization so you need to be careful but it's very encouraging in terms of its potential of what it can do when it's implemented right this deals with encrypting the card data right at the point of light in the card swipe terminal in a manner where you don't have the keys on-premises to decrypt that data a third party has the keys and that way you can actually keep all the systems in that environment aside from the terminals themselves out of scope because and this is the only thing I'll point out here this is important the council has basically rendered an unofficial opinion here saying that if you have card data that's encrypted in a way that you do not have the keys on premises to decrypt it that can be considered not to be card data so that can be a very attractive option for people who do have a processor and terminals that would support and end encryption you need to have all the right pieces for that to work okay I'm gonna have to move on quickly here so we can cover the last couple of slides as I mentioned you're going to want to use the prioritized approach which the council makes available when we can get you some links of the follow up here but that's going to help you to prioritize what you're doing first second third etc that breaks down into six prioritized milestones which you see here not going to spend time on those because again this is all available on the council's website for you and then ultimately what you want to build towards is some kind of a program where you have ongoing maintenance of controls you want to have some kind of ongoing assessing remediation as needed some ongoing validation checks whether you need an on-site assessment or maybe this is an internal assessment you're going to want to have an ongoing program search view of activities happening throughout the year to ensure compliance and to ensure that these things are being maintained the form of that will of course vary across the organization but think about this as a program not a project so I have to wrap up with section three very quickly because we're already coming up on time here so I'm just going to cover in a couple of minutes here some of the recent developments but unfortunately we'll have to save some of this for a future session where we'll be getting more focused on these individual topics the good news is not a lot has changed for version 2 for those of you who are looking forward to hearing a lot about that a lot of clarifications of language some I would say more benefits than otherwise in other words the changes work more to your advantage than the reverse there are several requirements that give you a little bit more flexibility in terms of how you apply the requirement especially around the coverage of intrusion detection which they've backed off on a little bit and regarding how you control outbound traffic from from section 1 of the DSS those are a couple of key areas that they really kind of made a little easier for you based on industry feedback they also added in a lot of language around virtualization basically it's clarifying that it's okay to do VM stuff but PCI certainly still applies in a virtualized environment one thing that I definitely want to touch on briefly is mastercards new rules if you're a level 2 merchant this especially applies to you as of June 30th of 2011 for right now and I'll follow up on that in a moment level 2 merchants who we can do a self-assessment that's all changing at the end of this month okay if you're a level two merchant you are going to have to then have an on-site assessment by a qsa or have internal staff go through this new training program by the council and maintain this certification of internal security assessor much like the qsa but for organizations internally now the current deadline is June 30 at the end of this month that's a big deal for any of you level twos out there now if you're in that position the first thing I recommend is that you reach out to your acquiring bank a quick strategy for you I recommend that you talk to them about can I submit a self-assessment prior to the end of this cycle prior to the end of June will that will you then allow me to reset my deadline in other words give me until a year from then to do this on-site validation I've seen a lot of banks approve that approach if the banks that have to approve that it's up to them so you might want to ask about that but the other thing to be aware of here is that verbally we have been told by internal MasterCard employees that they are getting ready to announce that this deadline is going to be pushed back by a year so probably none of you have heard this yet but if that is true I cannot guarantee it because it has not been published yet but we have been told by somebody currently employed on the MasterCard compliance team that they will be publishing this notice soon and that this deadline will get respected June 30th of 2012 you can't rely on that yet until it's official but start talking to your acquiring bank about your options if you're in this level-2 category okay states are implementing laws are on PCI I don't have time to go into this but the one thing I do want to touch on is Nevada is got a very strong law mandating full PCI compliance for anyone doing business with anyone in that state Washington state is a little unique for a different reason this is the one that really actually helps you guys it basically says that if you can show compliance by means of having validated it gets you off the hook to some degree it says that the banks cannot come after you for certain fines and penalties the interesting things there is that they do not necessarily recognize in the law the difference between the validation and actually being compliant kind of the flaw in my mind but the current language is that if you have the like paperwork to show that you were validated that's going to work to your advantage based on the Washington law so just an interesting note there so we don't have time for anything else today we are have we have some useful links here that will be made available to you as a follow up if you'd like to reach out to Kris here and request that information and at this point I'm going to hand this over to Kris Lane who will kind of wrap things up and talk to you about how to get all of us for any follow-ups great thank you very much Jeremy excellent presentation so my name is Chris Klein and I know we've covered a lot of ground today and just want to be respectful respectful of everyone's time and if people would like to send specific questions or comments to me directly my email address and telephone number are on the screen I'm more than happy to put you in touch with the right people or get you the answers that you need and if those of you that are still around would like to stay for a question and answer session we can get to that now