PCI DSS & PA DSSBy Kishor Vaswani – CEO, ControlCase

Agenda

• About PCI DSS

• Overview of changes in version 3 and beyond

• Segmentation and Penetration Testing

• Card Data Discovery and Memory

• Q&A

1

About PCI DSS

What is PCI DSS?

Payment Card Industry Data Security Standard:

• Guidelines for securely processing, storing, or transmitting payment card account data

• Established by leading payment card issuers• Maintained by the PCI Security Standards Council

(PCI SSC)

2

PCI DSS RequirementsControl Objectives Requirements

Build and maintain a secure network 1. Install and maintain a firewall configuration to protect cardholder data

2. Do not use vendor-supplied defaults for system passwords and other security parameters

Protect cardholder data 3. Protect stored cardholder data4. Encrypt transmission of cardholder data across open, public

networks

Maintain a vulnerability management program

5. Use and regularly update anti-virus software on all systems commonly affected by malware

6. Develop and maintain secure systems and applications

Implement strong access control measures

7. Restrict access to cardholder data by business need-to-know8. Assign a unique ID to each person with computer access9. Restrict physical access to cardholder data

Regularly monitor and test networks 10. Track and monitor all access to network resources and cardholder data

11. Regularly test security systems and processes

Maintain an information security policy

12. Maintain a policy that addresses information security

3

PCI DSS 3.0 and 3.1

4

• PCI DSS 3.0 in place starting last year i.e. 2015

• PCI DSS 3.1 outlined that SSL and early TLS not secure

• Some requirements such as SSL/TLS migration requirements are set for June 2018

Overview of changes in PCI 3.0

Overview

5

Segmentation• Adequacy of segmentation• Penetration test

Third parties/Service providers• Must validate PCI DSS compliance; OR• Must participate is customers PCI DSS

compliance audit

Overview contd…

6

PCI DSS as Business as Usual• Monitoring of security controls• Review changes to environment• Review changes to org structure• Periodic review of controls vs. during audit• Separation of duties (operational vs. security)

Physical protection of POS, ATM and Kiosks• Maintain inventory• Periodic inspection for tampering• Train personnel

Segmentation and Penetration Testing

What is Network Segmentation

• In the context of PCI DSS, Network Segmentation is a process where you isolate the CDE systems (Systems storing, processing & transmitting the CHD) from non-CDE systems.

• Key thing to Note: Network Segmentation is not mandatory requirement.

7

Network Segmentation & Scoping Guidelines

Store

Process

Transmit

CDE

Connected To

Impact Security

Provide Security

ProvideSegmentation

People, Process and Technology

8

Flat Network Example

Users

Cardholder Servers

Infrastructure servers

Development Servers

Since there is no segmentation done all the Systems will fall in PCI

DSS scope

9

Segmented Network Example

Other Users

Cardholder Servers

Infrastructure servers

Development Servers

Segmented Network using Firewall/Core Switch, ensure that traffic is limited to finance users and scope is reduces to only finance users,

Cardholder servers and infrastructure servers

Finance Users

Firewall/Core Switch

10

• A method of evaluating the security of a computer system, network or application by simulating an attack by a malicious hacker.

• Involves an active analysis of the system for any weaknesses, technical flaws or vulnerabilities.

• Carried out from the position of a potential attacker, and involves an active exploitation of security vulnerabilities.

• Performed from outside the external perimeter or from within the internal network.

What is a Penetration Test?

11

• To determine whether and how a malicious user can gain unauthorized access to assets and eventually sensitive data

• To confirm that the applicable PCI DSS controls, such as configuration standards, vulnerability management, and segmentation are in place.

Why is it important?

12

• Entire CDE perimeter

• Any critical systems that may impact the security of the CDE

• External perimeter (public-facing attack surfaces)

• Segmentation and scope-reduction controls

What should we include in the test?

13

• 11.3.4 - CDE Segmentation Verification› Applicable if segmentation is used to isolate CDE from

other networks› Verifies that segmentation methods are operational and

effective, and isolate all out-of-scope systems from in-scope systems

› Must provide tester documentation of segmentation technologies

› Testing against CDE systems from outside CDE› Testing against out-of-scope systems within the CDE

Segmentation Verification – PCI DSS 3.1

14

• Based on the best practices from Open-Source Security Testing Methodology Manual (OSSTMM), Open Web Application Security Project (OWASP) and NIST SP800-115

• Includes coverage of the CDE perimeter and critical systems

• Includes testing from both inside and outside the network• Includes testing from non CDE internal network to CDE

internal network• Includes testing to validate any segmentation and scope-

reduction controls

Methodology

15

Example Segmentation PT Result

• Segmentation Failed› If we note that firewall is configured to allow unrestricted

access (any ports and services) from the store/corporate General Network into the store POS Network (CDE)

• Segmentation Passed› If there is no access detected for any of the ports and

services from the store General Network into the store POS Network (CDE).

16

Best Practices to Pass Segmentation PT• Rule-set review shall be done to verify the rules against the business

requirements.

• All unused rules shall be removed

• All ACLs shall be configured in a way that they do not allow access from Non-CDE to CDE.

• All changes in network shall be done through change management process and in line with the “Network Segmentation” policy and procedure.

• If non-CDE segments have access into the CDE, either the organization needs to restrict that access or a full network-layer penetration test should be performed to characterize the access.

17

Card Data Discovery & Memory

What is Data Discovery

• Ability to identify and pinpoint sensitive data across› File Shares› Servers› Databases› Email› Log files› Etc.

18

Why is it important

• CIA focuses on confidentiality, integrity and availability

• Confidentiality is always focused on “Data”• Data that is sensitive must be protected, however

the first step of that is to know where the data resides

• Hence, it is important to identify where sensitive data resides

19

Requirement 3: Protect Stored Cardholder Data

You must ensure stored data is encrypted and protected.

20

PCI Council Advisory…

• Importance of Updating Scope for PCI DSS Assessments

There have been a number of high profile data compromises in the press recently. These reports serve as a daily reminder of the damage caused by compromises and of the need to keep business environments secure. Businesses evolve and change over time, and the scope of an entity's cardholder data environment must be reviewed and verified each time a PCI DSS assessment is undertaken. As has always been the case, many compromises are the result of businesses having data they weren't aware of. Please remember that scoping an assessment includes verifying that no cardholder data exists outside of the defined cardholder data environment. By ensuring the scope of an assessment is appropriate, the risk of data compromise is greatly reduced - a benefit to everyone involved.

21

Methods for Data Discovery

• DLP Solutions (McAfee etc.)• Card Data Discovery Solutions (ControlCase etc.)• Manual Scripts and Regular Expressions• Forensic Technology (EnCase etc.)

22

Data Discovery Planning Considerations

• Deployment and agents› Can get expensive› Technologically complicated› Long deployment cycles› Databases are a challenge

• False Positives› Luhn’s formula narrows down but is not full proof› Many schemes use Luhn’s formula to generate numbers› Separators and delimiters change

23

Planning Considerations contd…

• Performance within production environments› Database load› Large number of records in databases› Active directory scanning› Emails storing cardholder data

• Tokenization› Differentiation between tokens and real card numbers

• Exclusions› Directories› Files› Extension types› Tables/Columns

24

PA DSS and Card Data in Memory

• PA DSS has two requirements around card data storage in memory› Sensitive data (CVV, PIN) cannot be stored in memory per Requirement 1› Coding techniques must include how PAN and sensitive data is handled

in memory per requirement 5

• Test for data in memory using memory dump tools such as Winhex

• Cardholder Data in volatile memory must be handled securely to avoid Memory-Scraping Attacks

• POS devices are primary targets• Applications must rewrite memory with NULL once the

transaction authorization is completed

25

To Learn More About PCI Compliance…

• Visit www.controlcase.com

• contact@controlcase.com

Thank You for Your Time