book

PCI Compliance, 4th Edition

by Branden R. Williams, Anton Chuvakin

November 2014

Intermediate to advanced

386 pages

13h 5m

English

Syngress

Read now

Unlock full access

AbstractWho should read this book?How to use the book in your daily jobWhat this book is notOrganization of the bookSummary
AbstractSummary
AbstractWhat is PCI DSS and who must comply?PCI DSS in depthQuick overview of PCI requirementsPCI DSS and riskBenefits of complianceCase studySummary
AbstractThe basics of PCI DSS scopingThe “gotchas” of PCI scopeScope reduction tipsPlanning your PCI projectCase studySummary

AbstractWhich PCI DSS requirements are in this domain?What else can you do to be secure?Tools and best practicesCommon mistakes and pitfallsCase studySummary
AbstractWhich PCI DSS requirements are in this domain?What else can you do to be secure?Tools and best practicesCommon mistakes and pitfallsCase studySummary
AbstractWhat is data protection and why is it needed?Requirements addressed in this chapterPCI requirement 3: Protect stored cardholder dataRequirement 3 walk-throughWhat else can you do to be secure?PCI requirement 4 walk-throughRequirement 12 walk-throughAppendix A of PCI DSSHow to become compliant and secureCommon mistakes and pitfallsCase studySummary
AbstractWhat is wireless network security?Where is wireless network security in PCI DSS?Why do we need wireless network security?Tools and best practicesCommon mistakes and pitfallsCase studySummary
AbstractPCI DSS requirements coveredVulnerability management in PCIRequirement 5 walk-throughRequirement 6 walk-throughRequirement 11 walk-throughInternal vulnerability scanningCommon PCI vulnerability management mistakesCase studySummary
AbstractPCI requirements coveredWhy logging and monitoring in PCI DSS?Logging and monitoring in depthPCI relevance of logsLogging in PCI requirement 10Monitoring data and log for security issuesLogging and monitoring in PCI—all other requirementsPCI DSS logging policies and proceduresTools for logging in PCIOther monitoring toolsIntrusion detection and preventionIntegrity monitoringCommon mistakes and pitfallsCase studySummary
AbstractCloud basicsPCI cloud examplesSo, can I use cloud resources in PCI DSS environments?More cloud for better security and compliance?Maintaining and assessing PCI DSS in the cloudCloud and PCI DSS in depthSummary
AbstractWhere is mobility addressed in PCI DSS 3.0?What guidance is available?How does PA-DSS 3.0 fit?Deploying the technology safelyCase studySummary
AbstractThe risks of credit card acceptanceNew business considerationsYour POS is like my POS!A basic scheme for SMB hardeningCase studySummary
AbstractJustifying a business case for complianceBringing the key players to the tableBudgeting time and resourcesEducating staffProject quickstart guideThe PCI DSS prioritized approachThe visa TIPSummary
AbstractRemember, assessors are there to helpDealing with assessors’ mistakesPlanning for remediationPlanning for reassessingSummary
AbstractWhat is a compensating control?Where are compensating controls in PCI DSS?What a compensating control is notFunny controls you didn’t designHow to create a good compensating controlCase studiesSummary
AbstractSecurity is a process, not an eventPlan for periodic review and trainingPCI requirements with periodic maintenancePCI self-assessmentCase studySummary
AbstractNew payment schemesPredictionsTaxonomy and tidbitsCase studySummary
AbstractMyth #1 PCI doesn’t apply to meMYTH #2 PCI is confusing and ambiguousMyth #3 PCI DSS is too onerousMyth #4 breaches prove PCI DSS irrelevantMyth #5 PCI is all we need for securityMyth #6 PCI DSS is really easyMyth #7 my tool is PCI compliant thus I am compliantMyth #8 PCI is toothlessCase studySummary