pci dss and pa dss
TRANSCRIPT
PCI DSS & PA DSSBy Kishor Vaswani – CEO, ControlCase
Agenda
• About PCI DSS
• Overview of changes in version 3 and beyond
• Segmentation and Penetration Testing
• Card Data Discovery and Memory
• Q&A
1
About PCI DSS
What is PCI DSS?
Payment Card Industry Data Security Standard:
• Guidelines for securely processing, storing, or transmitting payment card account data
• Established by leading payment card issuers• Maintained by the PCI Security Standards Council
(PCI SSC)
2
PCI DSS RequirementsControl Objectives Requirements
Build and maintain a secure network 1. Install and maintain a firewall configuration to protect cardholder data
2. Do not use vendor-supplied defaults for system passwords and other security parameters
Protect cardholder data 3. Protect stored cardholder data4. Encrypt transmission of cardholder data across open, public
networks
Maintain a vulnerability management program
5. Use and regularly update anti-virus software on all systems commonly affected by malware
6. Develop and maintain secure systems and applications
Implement strong access control measures
7. Restrict access to cardholder data by business need-to-know8. Assign a unique ID to each person with computer access9. Restrict physical access to cardholder data
Regularly monitor and test networks 10. Track and monitor all access to network resources and cardholder data
11. Regularly test security systems and processes
Maintain an information security policy
12. Maintain a policy that addresses information security
3
PCI DSS 3.0 and 3.1
4
• PCI DSS 3.0 in place starting last year i.e. 2015
• PCI DSS 3.1 outlined that SSL and early TLS not secure
• Some requirements such as SSL/TLS migration requirements are set for June 2018
Overview of changes in PCI 3.0
Overview
5
Segmentation• Adequacy of segmentation• Penetration test
Third parties/Service providers• Must validate PCI DSS compliance; OR• Must participate is customers PCI DSS
compliance audit
Overview contd…
6
PCI DSS as Business as Usual• Monitoring of security controls• Review changes to environment• Review changes to org structure• Periodic review of controls vs. during audit• Separation of duties (operational vs. security)
Physical protection of POS, ATM and Kiosks• Maintain inventory• Periodic inspection for tampering• Train personnel
Segmentation and Penetration Testing
What is Network Segmentation
• In the context of PCI DSS, Network Segmentation is a process where you isolate the CDE systems (Systems storing, processing & transmitting the CHD) from non-CDE systems.
• Key thing to Note: Network Segmentation is not mandatory requirement.
7
Network Segmentation & Scoping Guidelines
Store
Process
Transmit
CDE
Connected To
Impact Security
Provide Security
ProvideSegmentation
People, Process and Technology
8
Flat Network Example
Users
Cardholder Servers
Infrastructure servers
Development Servers
Since there is no segmentation done all the Systems will fall in PCI
DSS scope
9
Segmented Network Example
Other Users
Cardholder Servers
Infrastructure servers
Development Servers
Segmented Network using Firewall/Core Switch, ensure that traffic is limited to finance users and scope is reduces to only finance users,
Cardholder servers and infrastructure servers
Finance Users
Firewall/Core Switch
10
• A method of evaluating the security of a computer system, network or application by simulating an attack by a malicious hacker.
• Involves an active analysis of the system for any weaknesses, technical flaws or vulnerabilities.
• Carried out from the position of a potential attacker, and involves an active exploitation of security vulnerabilities.
• Performed from outside the external perimeter or from within the internal network.
What is a Penetration Test?
11
• To determine whether and how a malicious user can gain unauthorized access to assets and eventually sensitive data
• To confirm that the applicable PCI DSS controls, such as configuration standards, vulnerability management, and segmentation are in place.
Why is it important?
12
• Entire CDE perimeter
• Any critical systems that may impact the security of the CDE
• External perimeter (public-facing attack surfaces)
• Segmentation and scope-reduction controls
What should we include in the test?
13
• 11.3.4 - CDE Segmentation Verification› Applicable if segmentation is used to isolate CDE from
other networks› Verifies that segmentation methods are operational and
effective, and isolate all out-of-scope systems from in-scope systems
› Must provide tester documentation of segmentation technologies
› Testing against CDE systems from outside CDE› Testing against out-of-scope systems within the CDE
Segmentation Verification – PCI DSS 3.1
14
• Based on the best practices from Open-Source Security Testing Methodology Manual (OSSTMM), Open Web Application Security Project (OWASP) and NIST SP800-115
• Includes coverage of the CDE perimeter and critical systems
• Includes testing from both inside and outside the network• Includes testing from non CDE internal network to CDE
internal network• Includes testing to validate any segmentation and scope-
reduction controls
Methodology
15
Example Segmentation PT Result
• Segmentation Failed› If we note that firewall is configured to allow unrestricted
access (any ports and services) from the store/corporate General Network into the store POS Network (CDE)
• Segmentation Passed› If there is no access detected for any of the ports and
services from the store General Network into the store POS Network (CDE).
16
Best Practices to Pass Segmentation PT• Rule-set review shall be done to verify the rules against the business
requirements.
• All unused rules shall be removed
• All ACLs shall be configured in a way that they do not allow access from Non-CDE to CDE.
• All changes in network shall be done through change management process and in line with the “Network Segmentation” policy and procedure.
• If non-CDE segments have access into the CDE, either the organization needs to restrict that access or a full network-layer penetration test should be performed to characterize the access.
17
Card Data Discovery & Memory
What is Data Discovery
• Ability to identify and pinpoint sensitive data across› File Shares› Servers› Databases› Email› Log files› Etc.
18
Why is it important
• CIA focuses on confidentiality, integrity and availability
• Confidentiality is always focused on “Data”• Data that is sensitive must be protected, however
the first step of that is to know where the data resides
• Hence, it is important to identify where sensitive data resides
19
Requirement 3: Protect Stored Cardholder Data
You must ensure stored data is encrypted and protected.
20
PCI Council Advisory…
• Importance of Updating Scope for PCI DSS Assessments
There have been a number of high profile data compromises in the press recently. These reports serve as a daily reminder of the damage caused by compromises and of the need to keep business environments secure. Businesses evolve and change over time, and the scope of an entity's cardholder data environment must be reviewed and verified each time a PCI DSS assessment is undertaken. As has always been the case, many compromises are the result of businesses having data they weren't aware of. Please remember that scoping an assessment includes verifying that no cardholder data exists outside of the defined cardholder data environment. By ensuring the scope of an assessment is appropriate, the risk of data compromise is greatly reduced - a benefit to everyone involved.
21
Methods for Data Discovery
• DLP Solutions (McAfee etc.)• Card Data Discovery Solutions (ControlCase etc.)• Manual Scripts and Regular Expressions• Forensic Technology (EnCase etc.)
22
Data Discovery Planning Considerations
• Deployment and agents› Can get expensive› Technologically complicated› Long deployment cycles› Databases are a challenge
• False Positives› Luhn’s formula narrows down but is not full proof› Many schemes use Luhn’s formula to generate numbers› Separators and delimiters change
23
Planning Considerations contd…
• Performance within production environments› Database load› Large number of records in databases› Active directory scanning› Emails storing cardholder data
• Tokenization› Differentiation between tokens and real card numbers
• Exclusions› Directories› Files› Extension types› Tables/Columns
24
PA DSS and Card Data in Memory
• PA DSS has two requirements around card data storage in memory› Sensitive data (CVV, PIN) cannot be stored in memory per Requirement 1› Coding techniques must include how PAN and sensitive data is handled
in memory per requirement 5
• Test for data in memory using memory dump tools such as Winhex
• Cardholder Data in volatile memory must be handled securely to avoid Memory-Scraping Attacks
• POS devices are primary targets• Applications must rewrite memory with NULL once the
transaction authorization is completed
25
To Learn More About PCI Compliance…
• Visit www.controlcase.com
Thank You for Your Time