1. Payment Card Industry (PCI) Compliance
3/31/2017 9:47 PM
Payment Card Industry (PCI) Compliance
Jay Baucom, Chief Information Officer
Arthur Hohnsbehn, Director of Information Technology
Jason Godfrey, Security Manager
North Carolina Community College System

2. Payment Card Industry (PCI) Compliance
The PCI Security Standards Council is
an open global forum for the ongoing
development, enhancement, storage,
dissemination and implementation of
security standards for account
data protection.

3. Payment Card Industry (PCI) Compliance
The PCI Security Standards Council’s
mission is to enhance payment
account data security by driving
education and awareness of the PCI
Security Standards. The organization
was founded by American Express,
Discover Financial Services, JCB
International, MasterCard Worldwide,
and Visa, Inc.

4. Payment Card Industry (PCI) Compliance PCI Documentation
Payment Card Industry (PCI) Data Security Standard (DSS) Navigating PCI DSS – Understanding the Intent of the Requirements (version 1.1, February 2008)
Payment Card Industry (PCI) Data Security Standard (DSS) Self–Assessment Questionnaire – Instructions and Guidelines (version 1.1, February 2008)
Payment Card Industry (PCI) Data Security Standard (DSS) Self–Assessment Questionnaire D and Attestation of Compliance All other Merchants and all SAQ-Eligible Service Providers (version 1.1, February 2008)
Payment Card Industry (PCI) Data Security Standard (DSS) Glossary, Abbreviations and Acronyms

5. Payment Card Industry (PCI) Compliance Common Terms
3/31/2017 9:47 PM
Payment Card Industry (PCI) Compliance Common Terms
Account Number or PAN (Primary Account Number): payment card number that identifies the issuer and card holder.
Acquirer: Bankcard association member that initiates and maintains relationships with the merchants that accept payment cards.
Cardholder data: Full magnetic strip or the PAN plus any of the following:
Cardholder name
Expiration date
Service Code

6. Payment Card Industry (PCI) Compliance Common Terms - Continued
3/31/2017 9:47 PM
Payment Card Industry (PCI) Compliance Common Terms - Continued
DSS: Data Security Standard
Penetration Test: Security-oriented probing of computer system or network to seek out vulnerabilities that an attacker could exploit.
Threat: Condition that may cause information or information processing resources to be intentionally or accidentally lost, modified, exposed, made inaccessible, or otherwise affected to the detriment of the organization.

7. Payment Card Industry (PCI) Compliance Common Terms - Continued
3/31/2017 9:47 PM
Payment Card Industry (PCI) Compliance Common Terms - Continued
Vulnerability: Weakness in system security procedures, system design, implementation, or internal controls that could be exploited to violate system security policy.
Vulnerability Scan: Scans used to identify vulnerabilities in operating systems, services, and devices that could be used by hackers to target the company’s private network.
Payment Provider: PayPal (Verisign) or Official Payments (OPC).

8. Payment Card Industry (PCI) Compliance Trustwave Services
3/31/2017 9:47 PM
Payment Card Industry (PCI) Compliance Trustwave Services
The Office of State Controller (OSC) has a master service agreement with Trustwave to perform vulnerability scans, online SAQ and answer general questions.
30 of the 58 colleges participate in the OSC’s master agreement. Colleges work directly with the OSC for portal access, service delivery, and remediation. The acquirer (bank) is SunTrust.
The remaining 28 colleges are offered services through a supplemental agreement under the OSC master agreement. Colleges work directly with the NCCCS for portal access, service delivery, and remediation. The acquirer (bank) is selected by the college.

9. Payment Card Industry (PCI) Compliance Basic Steps to Compliance
3/31/2017 9:47 PM
Payment Card Industry (PCI) Compliance Basic Steps to Compliance
Compliance (Process\Procedures)
Validation (SAQ\ Vulnerability Scans)
Compliance – Jason Godfrey
Attestation

10. Payment Card Industry (PCI) Compliance Datatel Colleague e-Commerce
Datatel defines any payment card transaction processed via Colleague to a payment provider (PayPal\OPC) as an e-Commerce transaction. Payment card information is processed and transmitted, but never stored.
Datatel defines any payment card information entered into Colleague (CREN) as a Non e-Commerce transaction. This information is encrypted.

11. Payment Card Industry (PCI) Compliance Datatel Colleague e-Commerce
Datatel e-Commerce requires:
Licensing e-Commerce
Installing e-Commerce (InstallShield)
Enabling e-Commerce
CORE – ECS (e-Commerce Setup)
ECPR – e-Commerce Providers
ECPA – e-Commerce Provider Account
EPAM - e-Comm Provider Acct Mapping
ST – FIWP (Financial Web Parameters)

12. Payment Card Industry (PCI) Compliance e-Commerce Documentation
e-Commerce 3.7 Release Highlights (Release18.0) (September 18, 2006)
e-Commerce Installation and Administration (August 5, 2008)

13. Determining My PCI Validation Type - SAQ
3/31/2017 9:47 PM
Payment Card Industry (PCI) Compliance Validation Type
Determining My PCI Validation Type - SAQ

14. Payment Card Industry (PCI) Compliance Validation Types
3/31/2017 9:47 PM
Payment Card Industry (PCI) Compliance Validation Types
Type 1 (SAQ A) – All cardholder data is outsourced.
Type 2 (SAQ B) – Imprint only, no electronic cardholder data is stored.
Type 3 (SAQ B) – Standalone dial-out terminals only, no electronic cardholder data is stored.
Type 4 (SAQ C) – POS or payment system connected to the Internet, no electronic cardholder data is stored.
Type 5 (SAQ D) – All other merchants and all service providers.

15. 3/31/2017 9:47 PM
Payment Card Industry (PCI) Compliance Validation Types - Continued
Conclusion:
With exception of payment card transactions processed utilizing a stand alone dial-up terminal where paper receipts are kept for refund purposes; all other payment card transactions within Colleague (CREN) or utilizing Datatel’s e-Commerce would require a college to submit SAQ D.

16. Payment Card Industry (PCI) Compliance Impact of Validation Type D
3/31/2017 9:47 PM
Payment Card Industry (PCI) Compliance Impact of Validation Type D
What is the impact to the colleges?
Arthur to provide some insight to what the colleges will be doing in addition to their normal processes.

17. Accepting Payment via Telephone (TREG)
3/31/2017 9:47 PM
Payment Card Industry (PCI) Compliance Datatel Colleague Environment
Scenario 1
CC Clearing
House
Payment Verification
Internet
Colleague
Server via DMI
EPOS (TREG)
Server
Accepting Payment via Telephone (TREG)

18. Accepting Payment via WebAdvisor (WA)
3/31/2017 9:47 PM
Payment Card Industry (PCI) Compliance Datatel Colleague Environment
Scenario 2
CC Clearing
House
Payment Verification
Internet
WA Server
Colleague
Server via DMI
Accepting Payment via WebAdvisor (WA)

19. Accepting Payment via Colleague (CREN)
3/31/2017 9:47 PM
Payment Card Industry (PCI) Compliance Datatel Colleague Environment
Scenario 3
CC Clearing
House
Payment Verification
Internet
Side Terminal (CC entered via CREN)
Colleague
Server via DMI
Accepting Payment via Colleague (CREN)

20. Payment Card Industry (PCI) Compliance Datatel Best Practices
3/31/2017 9:47 PM
Payment Card Industry (PCI) Compliance Datatel Best Practices
Develop a policy for maintaining payment card data. Non e-Commerce should be purged via COCD.
Purge payment card information in Production before cloning the Production environment to Test using COCD.
If troubleshooting e-Commerce with the DMI listener in debug ( -t –v options), remove the log immediately after the debug information has been obtained. You are not compliant with debug turned on.
Work with your Bookstore provider to determine compliance.

21. Payment Card Industry (PCI) Compliance Additional Information
3/31/2017 9:47 PM
Payment Card Industry (PCI) Compliance Additional Information
PCI Security Standards Council
(webinars)
Datatel AnswerNet Document # How to remove sensitive credit card data for PCI Compliance
NC Office of the State Controller

22. 3/31/2017 9:47 PM
Payment Card Industry (PCI) Compliance Contact Information
NC Office of State Controller
NCCCS System Office
Jay Baucom - (919)
Jason Godfrey - (919)
Kim Van Metre - (919)
Trustwave
General Questions – (800)

23. Q & A Payment Card Industry (PCI) Compliance Additional Information
3/31/2017 9:47 PM
Payment Card Industry (PCI) Compliance Additional Information
Q & A