book

PCI Compliance, 5th Edition

Name: PCI Compliance, 5th Edition
ISBN: 9781000822342

by Branden Williams, James Adamson

December 2022

Intermediate to advanced

334 pages

14h 23m

English

CRC Press

Read now

Unlock full access

Cover
Half Title
Title
Copyright
Contents
Foreword
Acknowledgments
Authors
Chapter 1 About PCI DSS and This Book
Who Should Read This Book?How to Use the Book in Your Daily JobWhat This Book Is NotOrganization of the BookSummaryNotes
Chapter 2 Introduction to Fraud, Identity Theft, and Related Regulatory Mandates
SummaryNotes

Chapter 3 Why Is PCI Here?
What Is PCI DSS and Who Must Comply?Electronic Card Payment EcosystemGoal of PCI DSSApplicability of PCI DSSA Quick Note about Appendix A3PCI DSS in DepthCompliance DeadlinesCompliance and ValidationSomething New, the Customized ApproachHistory of PCI DSSPCI CouncilQSAsAdditional PCI SSC QualificationsPFIsPCIPsQIRsASVsQuick Overview of PCI RequirementsHow Changes to PCI DSS HappenWhat’s New in PCI DSS 4.0Customized ApproachExtra GuidanceNew CountermeasuresSkimmers and Web ContentAuthenticated Vulnerability ScanningInventory All the ThingsScope ReviewsIn Place With RemediationPCI DSS and RiskBenefits of ComplianceCase StudyThe Case of the Developing Security ProgramThe Case of the Confusing Validation RequirementsSummaryNotes
Chapter 4 Determining and Reducing Your PCI Scope
The Basics of PCI DSS ScopingConnected-To SystemsThe “Gotchas” of PCI ScopeScope Reduction TipsPlanning Your PCI ProjectCase StudyThe Case of the Leaky DataThe Case of the Entrenched EnterpriseSummaryNotes
Chapter 5 Building and Maintaining a Secure Network
Which PCI DSS Requirements Are in This Domain?Establish NSC Configuration StandardsDenying Traffic from Untrusted Networks and HostsRestricting ConnectionsHost or Network-Based Security ControlsMicro-SegmentationOther Considerations for Requirement 1The Oddball Requirement 11.5Requirement 2: Defaults and Other Security ParametersDevelop Configuration StandardsDefault PasswordsSimple Network Management Protocol DefaultsDelete Unnecessary AccountsImplement Single Purpose ServersConfigure System Security ParametersEncrypt Non-Console Administrative AccessWhat Else Can You Do to Be Secure?Tools and Best PracticesCommon Mistakes and PitfallsEgress FilteringDocumentationSystem DefaultsCase StudyThe Case of the Small, Flat Store NetworkThe Case of the Large, Flat Corporate NetworkThe Case of the Do OverSummary
Chapter 6 Strong Access Controls
Which PCI DSS Requirements Are in This Domain?Principles of Access ControlConfidentialityIntegrityAvailabilityRequirement 7: How Much Access Should a User Have?Databases and Requirement 7.2.6Requirement 8: Authentication BasicsIdentification, Authentication, and Requirements 8.2.4–8.2.8 and 8.3.1–8.3.9Locking Users Out: Requirements 8.2.8 and 8.3.4Things Paired With UsernamesRendering Passwords Unreadable in Transit and StoragePassword Design for PCI DSS: Requirements 8.3.5–8.3.9 and 8.3.11MFA and Requirements 8.4–8.5A Brief Word on System Accounts and Requirement 8.6OAuth, OIDC, SSH Keys, and SSH Certs, OH MY!Educating UsersWindows and PCI ComplianceWindows File Access ControlFinding Inactive Accounts in Active DirectoryEnforcing Password Requirements in Windows on Standalone ComputersEnabling Password Protected Screen Savers on Standalone Windows ComputersSetting File Permissions on Standalone Windows ComputersPOSIX (UNIX/Linux Systems) Access ControlLinux Enforce Password Complexity RequirementsCisco and PCI RequirementsCisco Enforce Session TimeoutEncrypt Cisco PasswordsSetting Up SSH in a Cisco EnvironmentRequirement 9: Physical SecurityHandling Visitors: Requirement 9.3Media and Physical Data Entry Points: Requirements 9.4Protecting the Point of Interaction: Requirement 9.5What Else Can You Do to Be Secure?Tools and Best PracticesRandom Password for UsersCommon Mistakes and PitfallsPoor DocumentationLegacy SystemsCloud and PaaSPhysical Access MonitoringCase StudyThe Case of the Stolen DatabaseThe Case of the Loose PermissionsSummaryNote
Chapter 7 Protecting Cardholder Data
What Is Data Protection and Why Is It Needed?The Confidentiality, Integrity, and Availability TriadRequirements Addressed in This ChapterRequirement 3: Protect Stored Account DataRequirement 3 Walk-ThroughEncryption Methods for Data at RestFile- or Folder-Level EncryptionFull-Disk EncryptionDatabase (Table-, Column-, or Field-Level) EncryptionPCI and Key ManagementWhat Else Can You Do to Be Secure?Requirement 4 Walk-ThroughTransport Layer SecurityIPsec Virtual Private NetworksMiscellaneous Card Transmission RulesRequirement 12 Walk-ThroughHow to Become Compliant and SecureStep 1: Identify Business Processes With Card DataStep 2: Shrink the ScopeStep 3: Identify Where Data Is StoredStep 4: Determine What to Do About Your DataStep 5: Determine Who Needs AccessStep 6: Develop and Document PoliciesCommon Mistakes and PitfallsCase StudyThe Case of the Leaky DataThe Case of the Satellite LocationSummaryNotes
Chapter 8 Using Wireless Networking
What Is Wireless Network Security?Where Is Wireless Network Security in PCI DSS?Requirements 1, 11, and 12: DocumentationActual Security of Wireless Devices: Requirements 2, 4, and 9Logging and Wireless Networks: Requirement 10.3.3Testing for Unauthorized Wireless: Requirement 11.2Quarterly Sweeps or Wireless IDS/IPS: How to ChooseWhy Do We Need Wireless Network Security?Other Wireless TechnologiesTools and Best PracticesCommon Mistakes and PitfallsCase StudyThe Case of the Untethered LaptopThe Case of the Expansion PlanThe Case of the Double Secret Wireless NetworkThe Case of the Detached POSSummaryNote
Chapter 9 Vulnerability Management
PCI DSS Requirements CoveredVulnerability Management in PCIStages of Vulnerability Management ProcessPolicy DefinitionData AcquisitionPrioritizationMitigationRequirement 5 Walk-ThroughWhat to Do to Be Secure and Compliant?Requirement 6 Walk-ThroughPublic-Facing Web Application ProtectionWeb Application Scanning (WAS)Web Application Firewalls (WAFs)Payment PagesChange ManagementSoftware Supply Chain AttacksRequirement 11 Walk-ThroughExternal Vulnerability Scanning With ASVWhat Is an ASV?Considerations When Picking an ASVHow ASV Scanning WorksOperationalizing ASV ScanningWhat Should You Expect From an ASV?Internal Vulnerability ScanningPenetration TestingCommon PCI Vulnerability Management MistakesCase StudyPCI at a Retail ChainPCI at an E-Commerce SiteSummary
Chapter 10 Logging Events and Monitoring the Cardholder Data Environment
PCI Requirements CoveredWhy Logging and Monitoring in PCI DSS?Logging and Monitoring in DepthPCI Relevance of LogsLogging in PCI Requirement 10Monitoring Data and Log for Security IssuesLogging and Monitoring in PCI—All Other RequirementsPCI Dss Logging Policies and ProceduresBuilding an Initial Baseline ManuallyGuidance for Identifying “Known Bad” MessagesMain Workflow: Daily Log ReviewException Investigation and AnalysisValidation of Log ReviewPCI Compliance Evidence PackagePeriodic Operational Task SummaryDaily TasksTools for Logging in PCIOther Monitoring ToolsIntrusion Detection and PreventionIntegrity MonitoringCommon Mistakes and PitfallsCase StudyThe Case of the Risky Risk-Based ApproachThe Case of Tweaking to ComplySummary
Chapter 11 Cloud and Virtualization
Cloud BasicsWhat Is the Cloud?Cloud BadnessCloud Changes Everything! But Does It?Cloud Challenges and YouPCI Cloud ExamplesSo, Can I Use Cloud Resources in PCI DSS Environments?Containers and KubernetesMore Cloud for Better Security and Compliance?Maintaining and Assessing PCI DSS in the CloudEnter the MatrixTools and Best PracticesSummaryNotes
Chapter 12 Mobile
Where Is Mobility Addressed in PCI DSS 4.0?What Guidance Is Available?Deploying the Technology SafelyCase StudyThe Case of the Summer FestivalSummary
Chapter 13 PCI for the Small Business
The Risks of Credit Card AcceptanceNew Business ConsiderationsYour POS Is Like My POS!A Basic Scheme for SMB HardeningCase StudyThe Case of the Outsourcing DecisionSummary
Chapter 14 PCI DSS for the Service Provider
The Definition of a Service ProviderWhy Do Service Providers Have More Requirements?Variation on a Theme, or What Service Providers Should Care About?Service-Provider-Specific RequirementsProtect Account DataImplement Strong Access Control MeasuresRegularly Monitor and Test NetworksMaintain an Information Security PolicyAdditional PCI DSS Requirements for Multi-Tenant Service ProvidersOutdated SSL/TLS for Card-Present TerminalsCase StudySummary
Chapter 15 Managing a PCI DSS Project to Achieve Compliance
Justifying a Business Case for ComplianceFiguring Out If You Need to ComplyCompliance OverlapLevel of ValidationWhat Is the Cost for Non-Compliance?Penalties for Non-ComplianceBringing the Key Players to the TableObtaining Corporate SponsorshipForming Your Compliance TeamRoles and Responsibilities of Your TeamGetting Results FastNotes From the Front LineBudgeting Time and ResourcesSetting ExpectationsManagement’s ExpectationsEstablishing Goals and MilestonesStatus MeetingsEducating StaffTraining Your Compliance TeamTraining the Company on ComplianceSetting Up the Corporate Compliance Training ProgramProject Quickstart GuideThe StepsStep 1: Obtain Corporate SponsorshipStep 2: Identify and Establish Your TeamStep 3: Determine Your PCI Level and ScopeStep 4: Complete a PCI DSS SAQ or Hire a QSAStep 5: Set Up Quarterly External Network Scans From an Approved Scanning VendorStep 6: Get Validated by a QSA (or an ISA)Step 7: Perform a Gap AnalysisStep 8: Create PCI DSS Compliance PlanStep 9: Prepare for Annual Assessment of Compliance ValidationThe PCI DSS Prioritized ApproachThe Visa TIPSummaryNote
Chapter 16 Don’t Fear the Assessor
Remember, Assessors Are Generally There to HelpBalancing Remediation NeedsHow FAIL == WINDealing With Assessors’ MistakesPlanning for RemediationFun Ways to Use CVSSPlanning for Re-AssessingSummaryNotes
Chapter 17 The Art of Compensating Control
What Is a Compensating Control?Where Are Compensating Controls in PCI DSS?What a Compensating Control Is NotFunny Controls You Didn’t DesignHow to Create a Good Compensating ControlCase StudiesThe Case of the Newborn ConciergeThe Case of the Concierge Travel AgencySummary
Chapter 18 You’re Compliant, Now What?
Security Is a Process, Not an EventPlan for Periodic Review and TrainingPCI Requirements With Periodic MaintenanceBuild and Maintain a Secure Network and SystemsProtect Account DataMaintain a Vulnerability Management ProgramImplement Strong Access Control MeasuresRegularly Monitor and Test NetworksMaintain an Information Security PolicyPCI Self-AssessmentCase StudyThe Case of the Compliant CompanySummary
Chapter 19 Emerging Technology and Alternative Payment Schemes
Emerging Payment SchemesEMVMobileNear-Field Communication (A.K.A., Tap & Go)The Payment Account ReferenceSquare, Paypal, and IntuitGoogle Checkout, Paypal, and Stripe3-D SecureBitcoin, Ethereum, and CryptoPredictionsTaxonomy and TidbitsEMVEurope versus the US versus the Rest of the WorldOne-Time Use CardsCustomer ExperienceCase StudyThe Case of the Cashless Cover ChargeSummaryNote
Chapter 20 PCI DSS Myths and Misconceptions
Myth #1 PCI Doesn’t Apply to MeA Perfect Example of Myth #1 at Work!Myth #2 PCI Is Confusing and AmbiguousMyth #3 PCI DSS Is Too OnerousMyth #4 Breaches Prove PCI DSS to Be IrrelevantMyth #5 PCI Is All We Need for SecurityMyth #6 PCI DSS Is Really EasyMyth #7 My Tool Is PCI Compliant, Thus I Am CompliantMyth #8 PCI Is ToothlessCase StudyThe Case of the Cardless MerchantSummaryNotes
Chapter 21 Final Thoughts
A Quick SummaryTimelinesCompensating Controls and the Customized ApproachWe Play Catch-UpThe Challenging OnesOn Time TravelInteract With Us!
Index by Requirement
Alphabetical Index

Content preview from PCI Compliance, 5th Edition

16Don’t Fear the Assessor

DOI: 10.1201/9781003100300-16

Information in this chapter:

Remember, Assessors Are Generally There to Help
Dealing With Assessors’ Mistakes
Planning for Remediation
Planning for Re-Assessing
Summary

The title of this chapter might shock you a little bit. Why, you ask? Have you noticed that the words “audit” and “auditor” in reference to Payment Card Industry Data Security Standard (PCI DSS) are generally missing from this book? That’s because the correct terms are “assessment” and “assessor” when referring to PCI DSS. While your Qualified Security Assessor (QSA) may be a CPA, it is not a requirement and most QSAs are not; instead many come from the IT security domain and some may be IT auditors. The procedures ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781000822342

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

PCI Compliance, 5th Edition

by Branden Williams, James Adamson

16Don’t Fear the Assessor

Information in this chapter:

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.