1. Jeff Williams Information Security Officer CSU, Sacramento
PCI DSS Roundtable
Jeff Williams
Information Security Officer
CSU, Sacramento

2. Agenda What is PCI DSS? What are the financial impacts?
What are the requirements?
How do I become compliant?

3. PCI DSS Payment Card Industry Data Security Standard
Standard that is applied to:
Merchants (You)
Service Providers (Third Third-party vendor, gateways)
Systems (Hardware, software)
That:
Stores cardholder data
Transmits cardholder data
Processes cardholder data
Applies to:
Electronic Transactions
Paper Transactions

4. The Financial Impact Forced service outage during incidents
Forced service suspension
Loss of brand processing
Fines as high as $5,000 per card per day
Pay for independent investigation (entry fee of ~$30,000)
Fines up to $500,000
Large breaches…

5. Combined fines for all three
The Financial Impact
$50,000,000
$10,000,000
Combined fines for all three
$60,590,000
$590,000

6. Business Impact Assessment
Consider highest total cards processed in one day (disclaimer, numbers picked for easy math, optimistic and assume pre-incident self-assessment and mitigation) 100 total cards $50 per card for notification/communication $100 fine per card $30,000 investigation fee Single Loss Expectancy $45,000 Annualized Rate of Occurrence .10 Annualized Loss Expectancy $4,500

7. Business Impact Assessment
Consider highest total cards processed in one day (disclaimer, numbers picked for easy math, optimistic and assume little to no self-assessment and mitigation activities) 100 total cards $50 per card for notification/communication $1,000 fine per card $30,000 investigation fee Single Loss Expectancy $180,000 Annualized Rate of Occurrence .20 Annualized Loss Expectancy $36,000

8. Business Impact Assessment
Consider
Your highest number of cards processed day
A multi-day event
You are out of compliance and store all cards processed
Maximum fines
Impact to your reputation/fundraising
Impact to your operations

9. 12 High Level Security Requirements
Build and Maintain a Secure Network
1. Use firewalls and NAT to protect data
2. Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data
3. Protect physical stored data
4. Encrypt transmission of cardholder data and sensitive information across public networks
Maintain a Vulnerability Management Program
5. Use and regularly update antivirus software
6. Develop and maintain secure systems and applications

10. 12 High Level Security Requirements
Implement Strong Access Control Measures
7. Restrict access to data by business need-to-know
8. Assign a unique ID to each person
9. Restrict physical access to cardholder data
Regularly Monitor and Test Networks
10. Track and monitor all access to network resources and cardholder data
11. Routinely test security systems and processes
Maintain an Information Security Policy
12. Establish high-level security principles and procedures

11. How do I become compliant?
It all starts with a Self Assessment
Identify and close your gaps
html
Bottom of the webpage has a matrix of examples, guides, resources and templates
PCI Website -

12. Questions and Comments
Thank you, Jeff Williams