PCI DSS Signatory Made Easy

SAQ D.pdf - PCI Security Standards Council - pcisecuritystandards form

buenos noches muchachos see muchachos welcome to another edition of whiteboard Wednesday I'm your host ethan goldstein security engineer at rapid7 today we're going to be talking about PCI compliance and covering some of the basics of what it means to be PCI compliant and what you should look for in a vendor first PCI compliance is a well known regulation that's aimed at protecting consumer credit card information from theft and disclosure there are many organizations that need to comply with PCI including any organization that's going to store process or transmit credit card information now the way PCI compliance works in answering the question what do you need to be compliant first of all there's a concept called levels PCI compliance levels one through four generally apply differently to the different cardholder brands like American Express Discover Visa and MasterCard but generally speaking these levels are dictated by the number of credit card transactions that you process per year now for a level one compliance and really all levels of compliance there are different modules that you need to meet for example level one compliance there are over twelve distinct modules that need to be met for PCI compliance which include but are not limited to things like segmenting your network your PCI cardholder data from the rest of your environment things like running quarterly or annual vulnerability scans and restricting user access to set information and applications these are just to name a few and again there are 12 modules within those 12 modules there are over 220 specific individual items that need to be met so there's a lot of different things that an organization needs to do to be compliant for the first time and to maintain compliance over time a couple things you really need to know about how to become PCI compliant is first of all that in addition to your internal staff and other members of your organization that may need to be certified for things like the ability to audit for PCI and test different areas of your network you also need to hire two distinct organizations to help you meet compliance the first of which is called AK USA or qualified security Assessor this is an organization that's been certified to really help you understand you need to do to meet compliance so they're kind of the keys to the kingdom for you they're going to dictate what modules you need to meet how stringent you need to actually be to meet them and they're going to audit and assess that over time this is a really important organization that you need to hire and usually it applies to level 1 and level 2 Merchants only another organization you need to hire is called an ASV or approved scanning vendor this is an organization that is certified by the PCI Council through stringent testing of their own to scan your perimeter and any cardholder assets so these are any assets that are facing the internet that either store process or transmit credit card information what you need to do is you need to actually have this organization run a quarterly scan or an annual scan depending on what organization you are so you have to have for passing scans per year many organizations will allow you to run more scans over time to do things like understand remediation and correct any issues that you may have but it's really important that you do have for passing scans within the year so there's a few questions that people ask me quite a bit one of which is what should I look for in a vendor first of which is vendor interaction one of the most challenging things that organizations that are trying to meet PCI compliance deal with is not really meeting compliance the first time which of course is a challenge but really the bigger challenge is how do I maintain compliance over time it can be really challenging to maintain as your organization changes as Network changes in infrastructure alter and as business needs change as well as hopefully grow so really having an organization that's going to be there for you and has the staff on hand to be able to interact with you and answer questions and help you solve problems is really really important so look for this in a vendor rather than someone who's just going to maybe run a scan or help you meet compliance once and then come in annually to just audit you next is expertise this also is really important an example of expertise is the PCI counsel has mandated a new program that makes individuals at your organization certified for PCI called QA SVS these are folks that again are certified in PCI compliance and understand the regulation you want to make sure that your ASV is and York USA is have these phone on staff people that are certified people again that are on call to be able to interact with you and answer questions and frankly know what they're talking about lastly is trust specifically in the ASV qsa relationship sometimes there are organizations that will do both for you and really it's you know to each his own what you choose to do but sometimes there can be a conflict of interest there when you have one organization telling you what you need to do to be compliant and then another organization configuring running your scans and giving you hopefully passing scores so make sure that there's no conflict of interest there and really hire the best vendors for you to be able to meet compliance keep in mind that for vulnerabilities they are measured by CBS s scores so any vulnerabilities above a four on the CBS s scale and it runs from one to ten those will fail you for compliance aside from a few individual issues that you might run into for example any of the OWASP top ten vulnerabilities those will fail you automatically regardless of score and also things like denial of service work the other way where any denial of service related vulnerability actually is a passing score but by and large you want to stay within those guidelines and you want to make sure you have a vendor that again has the expertise the trust and the interaction with you to help you meet and maintain compliance over time something to keep in mind about PCI compliance is that the cost of a breach adds up quickly usually it's on average thirty seven dollars per record and there can be anywhere from thousands to millions of Records per incident these costs add up when you think about the detection of the breach paying your staff to respond to that breach remediation costs and of course fines good luck and we'll see you next time