1. Wake Forest University
Strategies for Complying with the Requirements of the Payment Card Industry Data Security Standards (PCIDSS)
Keith Conlee
College of DuPage
Joel Garmon
Wake Forest University

2. What is PCI-DSS?
PCI-DSS = Payment Card Industry Data Security Standard
Common set of industry tools and measurements to ensure safe handling of sensitive information.
The PCI-DSS is a multifaceted security standard that includes requirements for security management, policies, procedures, network architecture, software design and other critical protective measures.
Established by the credit card industry in response to an increase in identity theft and credit card fraud.
Every merchant who handles credit card data is responsible for safeguarding that information and can be held liable for security compromises and must comply with PCI-DSS.
Credit Card = Debit Card.

3. Scope of the Standard
Manual Credit Card Electronic
Handwritten Manual

4. Background 7/1/2006 - PCI DSS v1.0
1/1/2011 – PCI DSS v begin 3-year cycle)
1/1/2014 – PCI DSS v3.0
1/1/2017 (projected) – v4.0

5. Merchants Background (cont.)
Merchant Level
Description 1
Over 6M xacts/year (all acceptance channels)
Suffered a breach
Discretion (e.g. Visa)
Labelled Level-1 by other CC brand 2
1M-6M xacts/year 3
20K-1M ecommerce xacts/year 4
<20K ecommerce xacts/year
All others <1M xacts/year

6. Merchants Background (cont.)
Compliance Action
Validation Actions
Level
Comply w/ PCI DSS
On-Site PCI Security Audit
SAQ / ROC
Network Scan 1
Req’ed
Req’ed Annually
Req’ed Qtr’ly
2 & 3 4
Recommended Annually
Recommended Quarterly

7. Guidelines for Protecting Cardholder Data ElementsA C O U N T D
Data Element
Storage Permitted
Protection Required
If Allowed to Store- Must Render Unreadable
Cardholder Data
Primary Account Number (PAN)
YES
Yes
Cardholder Name NO
Service Code
Expiration Date
Sensitive Authentication Data
Full Magnetic Stripe Data
n/a
CAV2/CVC2/CVV2/CID
PIN / PIN Block

8. Merchant SAQs/AOCs - Background (cont.)
Eight (8) SAQs – A, A-EP, B, B-IP, C-VT, C, P2PE, D
Eight (8) AOC – one for each SAQ - Your company must attest it is complying w/ the PCI DSS annually

9. SAQ Eligibility Questions
Purpose it is measure a merchant’s risk
Eligibility section dictates which SAQ applies – by identifying your CDE infrastructure, business process, and technology used
Increased risk = increased cost to comply and vice versa.
In PCI terms - “scope” defines a level of risk.
A big scope = increased risk and cost to comply and vice versa
You want to work towards reducing your scope

10. Merchant SAQs - Background (cont.)
Must be able to answer Yes or n/a with comments
Document Compensating Controls
“meet the intent and rigor” of the original PCI DSS requirement.
“Provide similar level of defense”
See Appendix B “Compensating Controls” guidelines – PCI DSS 3.1
The Eligibility section of each SAQ is a measurement of your risk. It would be a good strategy to look at all 8 SAQ eligibility questions for each SAQ. Many will be able to qualify for more than one SAQ. If you qualify for multiple SAQs read the rest of the questions for each qualifying SAQ and pick the one that is the least burdensome to comply with (the least burdensome = the smallest scope in PCI language).
Many times at educational institutions you have a very secure cashier function (where the majority of in-person tuition payments are made). And all your online registration tuition payments are outsourced to a 3rd party (acquirer) which totally takes them off your network. And if you only had to answer questions about your cashier function and your online payment function your scope would be small (relatively). But somewhere else at your institution you have separate entities/departments, e.g. selling food, tickets, fund raising, needing mobile CC processing that expand your scope. So you need to look for ways to get everyone on board and make reasonable changes to these separate entities/depts that will reduce your scope. One entity/dept can blow your scope to the maximum.
Reasonable changes to reduce scope are measured by the increased cost to make the change vs. the reduce cost of complying by moving to a smaller scope.

11. SAQ vs ROC - Background (cont.)
If you “Self-Assess” you submit an SAQ
If you use a QSA to assess your compliance, the QSA must use the ROC for your institution

12. Executive Support Old cliché – Need executive buy-in
Socialize and network with different departments
Document card transactions
Total number and $$ amount by departments
Fees paid for PCI non-compliance
Split the infrastructure cost among the card merchants
Provide documentation on real higher education examples of PCI breach and associated costs
Average cost for higher education data breach $300/record (Reference: 2015 Cost of Data Breach Study: Global Analysis Benchmark research sponsored by IBM Independently conducted by Ponemon Institute LLC May 2015)
Finance
Legal
Compliance
Audit
Provost
Athletics
Bookstore
Advancement (Alumni Affairs)

13. Governance Model Executive Sponsorship PCI Committee
Individual such as CFO or existing committee of senior executive leadership
PCI Committee
Usually chaired by CISO and someone from Finance
Include all major areas that accept credit cards
Written policy and procedures – you will get push back
Training and education to key stakeholders
New merchant IDs reviewed and approved by PCI Committee

14. Getting Certified
Identify senior person in the department for each merchant ID
Can be responsible for multiple merchant IDs
Is responsible to insure all requirements are met and documented
Highly recommend using bank or QSA website to maintain documentation.
Keep copy on your systems as completed
Signs off on PCI certification
Signature of Merchant Executive Officer (signature block from PCI DSS Attestation of Compliance)
Highlights that this is a merchant requirement, not an IT requirement
IT Security
Assists merchants with understanding of requirements
Provides or coordinates any technical support required
Firewalls, patching, AV, …
Assists with documentation
Internal Security Assessor (ISA) also signs certification (if used)
Encourages use of P2PE where ever possible
Work closely with Finance since they already have a relationship with the departments / merchants
Progress should be monitored by PCI committee or other governance body

15. Determine What Questionnaire to Complete Per Merchant
Identify the applicable SAQ for your environment – refer to the Self-Assessment Questionnaire Instructions and Guidelines document on PCI SSC website for information.
SAQ A. Card-not-present merchants (e-commerce or mail/telephone-order), that have fully outsourced all cardholder data functions to PCI DSS compliant third-party service providers, with no electronic storage, processing, or transmission of any cardholder data on the merchant’s systems or premises.
Not applicable to face-to-face channels.
SAQ A-EP. E-commerce merchants who outsource all payment processing to PCI DSS validated third parties, and who have a website(s) that doesn’t directly receive cardholder data but that can impact the security of the payment transaction. No storage, processing, or transmission of cardholder data on merchant’s systems or premises.
Applicable only to e-commerce channels.
SAQ B. Merchants using only:
Imprint machines with no electronic cardholder data storage, and/or
Standalone, dial-out terminals with no electronic cardholder data storage.
Not applicable to e-commerce channels.

16. Determine What Questionnaire to Complete Per Merchant
SAQ B-IP. Merchants using only standalone, PIN Transaction Security (PTS) approved payment terminals with an IP connection to the payment processor with no electronic cardholder data storage. Not applicable to e-commerce channels.
SAQ C-VT. Merchants who manually enter a single transaction at a time via a keyboard into an Internet-based, virtual payment terminal solution that is provided and hosted by a PCI DSS validated third-party service provider. No electronic cardholder data storage. Not applicable to e-commerce channels.
SAQ C. Merchants with payment application systems connected to the Internet, no electronic cardholder data storage. Not applicable to e-commerce channels.
SAQ P2PE. Merchants using only hardware payment terminals included in and managed via a validated, PCI SSC-listed P2PE solution, with no electronic cardholder data storage. Not applicable to e-commerce merchants.
SAQ D All merchants not included in descriptions for the above SAQ types.

17. Requirements Overview
Sub-Requirements
Build and Maintain a Secure Network and Systems
Install and maintain a firewall configuration to protect cardholder data
Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data
Protect stored cardholder data
Encrypt transmission of cardholder data across open, public networks
Maintain a Vulnerability Management Program
Protect all systems against malware and regularly update anti-virus software or programs
Develop and maintain secure systems and applications
Implement Strong Access Control Measures
Restrict access to cardholder data by business need to know
Identify and authenticate access to system components
Restrict physical access to cardholder data
Regularly Monitor and Test Networks
Track and monitor all access to network resources and cardholder data
Regularly test security systems and processes
Maintain an Information Security Policy
Maintain a policy that addresses information security for all personnel
These 12 sub-requirements can be further refined into 240 requirements depending on the type of merchant.

18. Example -- SAQ B Information
Requirement
Total Number of Questions
3 - Protect stored cardholder data 5
4 - Encrypt transmission of cardholder data across open, public networks 1
7 - Restrict access to cardholder data by business need to know 3
9 - Restrict physical access to cardholder data 12
12 - Maintain a policy that addresses information security for all personnel 17
Total Questions 38
SAQ B only requires 38 out of the potential 240 questions to be answered

19. Additional Helpful Documents
PCI DSS (PCI Data Security Standard Requirements and Security Assessment Procedures)
Guidance on Scoping
Guidance on the intent of all PCI DSS Requirements
Details of testing procedures
Guidance on Compensating Controls
SAQ Instructions and Guidelines documents
Information about all SAQs and their eligibility criteria
How to determine which SAQ is right for your organization
PCI DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms
Descriptions and definitions of terms used in the PCI DSS and self-assessment questionnaires

20. Requirements for Compliance
Assess your environment for compliance with the PCI DSS.
Complete the Self-Assessment Questionnaire (SAQ A) according to the instructions in the Self Assessment Questionnaire Instructions and Guidelines.
Complete the Attestation of Compliance in its entirety.
Submit the SAQ and the Attestation of Compliance, along with any other requested documentation, to your acquirer, payment brand, or other requester
May also include
Regular network or web site scanning by an Approved Scanning Vendor
Report on Compliance by a Qualified Security Assessor (only needed by the very largest companies)

21. Discussion Questions
What is the difference between or relationship of PCI DSS and Europay, MasterCard® and Visa® (EMV) chip technology
How does P2PE assist with DSS
Are merchants using Council-listed P2PE solutions out of scope for PCI DSS
Are there card readers that are both P2PE and EMV compliant
Do I still have PCI requirements if I only take cards through a portal supported by another company
Do I have to use a QSA
Do I have to have 3rd party external network scans

22. Discussion Questions
What is a Payment Application Data Security Standard (PA-DSS) compliant application
How do I find if an application is PA-DSS certified
Is encrypted data still in scope for PCI DSS
Is VoIP in scope for PCI DSS
Are operating systems that are no longer supported by the vendor non- compliant with the PCI DSS
Can I fax payment card numbers and still be PCI DSS Compliant
Can an entity be PCI DSS compliant if they have performed quarterly scans, but do not have four “passing” scans

23. Discussion Questions
Can I store the security code (CAV2/CVC2/CVV2/CID) in paper format
Are hashed Primary Account Numbers (PAN) considered cardholder data that must be protected in accordance with PCI DSS
Does PCI DSS apply to debit cards, debit payments, and debit systems
Are digital images containing cardholder data and/or sensitive authentication data included in the scope of the PCI DSS
Can VLANS be used for network segmentation