The ABC’s of PCI DSS Eric Beschinski Relationship Manager Utility Payment Conference Kay Limbaugh Specialist, Electronic Bills & Payments &

A wareness B enefits & C onsequences

What is PCI Compliance? Misnomer… PCI DSS v2.0 Comprehensive security standards –QRG is 34 pages –Official Document is 75 pages PCI SSC Standards endorsed by the card brands

Moving Target Snapshot (point in time) Requires continual monitoring One minor change could remove the organization from compliance

What isn’t PCI Compliance? Not legislation Not a “one-time-deal” Not just your processor or POS provider’s problem Not a one-size-fits-all scenario –Different for each merchant –Different for each card brand

PCI DSS Overview Goals: Build & Maintain a secure Network Protect Cardholder Data Maintain a Vulnerability Management Program Requirements: 1.Firewall 2.Change all passwords from system defaults 3.Protect stored cardholder data 4.Encrypt transmission of cardholder data across open, public networks (the Internet) 5.Use updated antivirus software 6.Develop and maintain secure systems & applications

PCI DSS Overview Goals: Implement Strong Access Control Measures Regularly Monitor & Test Networks Maintain an Information Security Policy Requirements: 7.Restrict access to cardholder data by “need-to-know” 8.Assign a unique ID to each person with computer access 9.Restrict physical access to cardholder data 10.Track & monitor all access to network resources and cardholder data 11.Regularly test security systems and processes 12.Maintain a policy that addresses information security for all personnel

Big Picture A ccountability B est Practices C onsumer Safety

Steps Assess ↔ Remediate ↔ Report

You are not compliant if you don’t… 1.Complete the SAQ annually ( 2.Have your network scanned for vulnerabilities quarterly by an ASV (for processing via system connected to the internet) 3.QSA or Internal audit

Who really knows if you’re compliant? Only top-level management (and maybe a QSA) NOT… –Your processor –Your POS provider –Your IT company –A sales person Nobody without a SAQ

Enforcement? Lacking No problem until there’s a problem Like the Health Dept... From those in authority, it’s enforcement after-the-fact Up to you to be proactively self- enforced to prevent a breach

Why be concerned? Investigative fees Fines Cost to upgrade/fix the problem Lawsuits Blacklist Media Customer confidence Very, very expensive!

A nother B reach & C ounting… 333 breaches as of 8/1 with almost 23M records affected including –Sony –Epsilon –Citigroup –Lockheed Martin 603 breaches in 2010 affecting over 12M records Since 2005, over 2600 breaches affecting over 535M records Data provided by PrivacyRights.org

Top 10 Breaches 10. TD Ameritrade Holding Corp (2007) 9. Fidelity National Information Services/Certegy Check Services Inc. (2007) 8. Sony, PlayStation Network (PSN), Sony Online Entertainment (SOE) (2011) 7. Bank of New York Mellon (2008) 6.Countrywide Financial Corp. (2008) 5.US Dept. of Veterans Affairs (2006) 4.CardSystems (2005) 3. US Military Veterans (2009) 2. TJ Stores (2007) 1. Heartland (2009)

Heartland Certified compliant just weeks before the breach Security breach discovered in Jan 2009 (had been in place for possibly 6 months prior) De-certified post-breach Hundreds of Millions in fines/fees/lawsuits Bad press

Turning it around Re-certified May 2009 Proactive response Good press National Restaurant Association Launched E3 May 2010 Earnings up Stronger than ever

Lessons to be learned from the Heartland breach PCI DSS is a good minimum standard but will not guarantee safety If your company is big enough you will become a target No security is fail-proof Criminals working continually to break- in

Who is most at risk? All merchants –Level 1 & 2 (High Value) –Level 3 (High Risk) –Level 4 (High Success / Quick Return)

Then What Good is PCI DSS? Ensures that you are not an EASY target (low-hanging fruit) Common sense security measures Possibly some protection from fines/lawsuits –Good faith argument –Responsible party argument

Key Issues for Utility Industry A pplications: Software –POS –Antivirus –Firewall –Web/Payment Gateway Hardware –Firewall –POS –Pin Pads B usiness Procedures –Recording calls –Storing card data –Access Control C onnection –VOIP –Encryption

Myths 1.One vendor/product will make us compliant 2.Outsourcing card processing will make us compliant 3.Compliance is an IT project 4.Compliance will make us secure 5.PCI DSS is unreasonable; it requires too much

Myths 6.PCI DSS requires us to hire a QSA 7.We don’t take enough credit cards to require compliance 8.We completed a SAQ so we’re compliant 9.PCI DSS makes us store cardholder data 10.PCI DSS is too hard

In Conclusion A lways BeBe C ompliant!

Alphabet Soup AOC – Attestation of Compliance ASV – Approved Scanning Vendor DSS – Data Security Standards ISA – Internal Security Assessor PA-DSS – Payment Application Data Security Standards PAN – Primary Account Number PCI – Payment Card Industry PED – PIN Entry Device PFI – PCI Forensic Investigator PIN – Personal Identification Number PTS – PIN Transaction Security (formerly PED) QRG – Quick Reference Guide QSA – Qualified Security Assessor ROC – Report On Compliance SAQ – Self Assessment Questionnaire SSC – Security Standards Council

Q & A Eric Beschinski Relationship Manager Heartland Payment Systems Kay Limbaugh Specialist, Electronic Bills & Payments Portland General Electric