Visa PIN Security Program Webinar May Alan Low PIN Risk Representative AP and CEMEA. Visa Public
|
|
|
- Lesley Foster
- 10 years ago
- Views:
Transcription
1 Visa PIN Security Program Webinar May 2015 Alan Low PIN Risk Representative AP and CEMEA
2 Disclaimer The information or recommendations contained herein are provided "AS IS" and are intended to be information about Visa s PIN Security program only. When implementing any new strategy or compliance program, you should consult with your internal experts and legal counsel to determine what Visa Rules, laws, and regulations may apply to your specific circumstances. The actual benefits of these recommendations or programs may vary based upon your specific business needs. Visa is not responsible for your use of the information contained herein (including errors, omissions, inaccuracy or non-timeliness of any kind) or any assumptions or conclusions you might draw from its use. Visa makes no warranty, express or implied, and explicitly disclaims the warranties of merchantability and fitness for a particular purpose, any warranty of non-infringement of any third party's intellectual property rights, any warranty that the information will meet the requirements of a client, or any warranty that the information is updated and will be error free. To the extent permitted by applicable law, Visa shall not be liable for any damages under any theory of law, including, without limitation, any special, consequential, incidental or punitive damages, nor any damages for loss of business profits, business interruption, loss of business information, or other monetary loss, even if advised of the possibility of such damages. 2 Visa PIN Security Program May 2015
3 Agenda Objectives Visa Rules on PIN Security Visa s PIN Security Program Framework PIN Security Program Participants PIN Security Program Requirements Visa Approved Security Assessors Global Registry of Service Providers Summary Validation Deadlines PIN Security Program Enforcement Plan Plan Outline Remediation Options Additional Resources Q&A 3 Visa PIN Security Program May 2015
4 Objectives To review components of Visa PIN Security Program framework Ensure your understanding of validation requirements for 2015 Examine the PIN Program requirements At a high level compare the PCI PIN Security Requirements V1 vs V2 Revisit the Visa PED requirements and mandates Introduce the PIN Security Program enforcement plan 4 Visa PIN Security Program May 2015
5 The Importance of PIN Security Cardholder Trust Loyalty Confidence 5 Visa PIN Security Program May 2015
6 Visa Rules on PIN Security
7 Visa Core Rules on PIN Security PIN Security Program Requirements An Acquirer or its agent processing PINs for Visa Transactions must comply with the security requirements specified in the PIN Management Requirements Documents and Visa PIN Security Program Guide. ID#: See "PIN Security Non-Compliance Assessments" for noncompliance assessments for failure to comply. Visa Rules are publically available: Public.pdf Visa PIN Security Program Guide available on 7 Visa PIN Security Program May 2015
8 Visa PIN Security Program Framework
9 PIN Security Program Requirements Visa Approved Security Assessors Compliance Validation PIN Program Participants Visa s PIN Security Program Visa s Global Registry of Service Providers 9 Visa PIN Security Program May 2015
10 PIN Program Participants PIN Acquiring Third-Party VisaNet Processor (VNP)* A third party VNP entity that is directly connected to VisaNet and provides acquiring PIN processing services to members. PIN Acquiring Client VNP acting as a Service Provider* A Visa member or member-owned entity that is directly connected to VisaNet and provides PIN acquiring processing services to members. PIN Acquiring Third-Party Servicers (TPS)* A third-party agent that stores, processes, or transmits Visa account numbers and PINs on behalf of Visa members. Encryption and Support Organizations (ESO) A non-member organization that deploys ATM, POS, or kiosk PIN acceptance devices which process and accept cardholder PINs and/or manage encryption keys (i.e., key injection facilities (KIFs)). *These entities must validate PCI-DSS annually If you are unsure of your status please contact your regional PIN Risk representative 10 Visa PIN Security Program May 2015
11 PIN Security Program Requirements Visa Approved Security Assessors Compliance Validation PIN Program Participants Visa s PIN Security Program Visa s Global Registry of Service Providers 11 Visa PIN Security Program May 2015
12 PIN Security Program Requirements PCI PIN Security Requirements Visa PIN Entry Device (PED) Requirements PCI-PTS Approved Devices PCI PIN Transaction Security Point of Interaction (POI) Modular Security Device Requirements Visa Triple Data Encryption Standard (TDES) Requirements 12 Visa PIN Security Program May 2015
13 PCI PIN Security Requirements The minimum security requirements for PIN-based interchange transactions including minimum acceptable requirements for securing PINs and encryption keys Core requirements and additional information for Remote Key Distribution, Certification Authorities and Key-injection Facilities Latest Version 2 includes Testing Procedures document to assist with assessments The PCI PIN Requirements are maintained by PCI Security Standards Council Can be found on the PCI SSC website: Select PCI Standards & Documents > Documents Library> PTS Questions?? Send an to [email protected] 13 Visa PIN Security Program May 2015
14 PCI PIN Requirements Version Timeline PCI PIN Security Requirements v1 PCI PIN Security Requirements v2 1 January 2015 From 1 July 2015 Timeline set by Visa Improvements to Version 2 1. Detailed testing procedures to ensure consistent validation 2. Enhanced requirements for deployed points-of-interaction (POI) devices 3. Improved organization of Remote Key Distribution Using Asymmetric Techniques Operations and Certification and Registration Authority Operations requirements 14 Visa PIN Security Program May 2015
15 Visa PIN Entry Device (PED) Requirements Device / Expiration Purchase Deployment and Usage Visa Inc. Sunset Mandate PCI PED V1.x April 2014 No Recommend device replacement PCI PED V2.x April 2017 PCI PTS POI V3.x April 2020 PCI PTS POI V4.x April 2023 Yes Yes Yes Allowed if purchased prior expiration date Recommend device replacement Full Visa PED Requirements can be found at Review the Visa Compromised PIN Entry Device List 15 Visa PIN Security Program May 2015
16 PCI-PTS Version 1 Devices Expired PCI PTS POI V1 PED devices should be removed from the payment system as soon as possible. V1 PEDs were introduced in 2004 and built to address attacks that were known over 10 years ago. They are no longer able to withstand current attack vectors. A number of device compromises reported. Pre-PCI PED devices, just say no! Mandated sunset date has passed, 31 December 2014 *Note to Security Assessors If there are version 1 devices for organizations you assess ensure you check purchase dates on receipts are prior to 30 April Visa PIN Security Program May 2015
17 PCI PIN Transaction Security Point of Interaction Modular Security Device Requirements (PCI PIN, PTS POI ) Complete list of security requirements that terminals are evaluated against to obtain Payment Card Industry (PCI) PIN Transaction Security (PTS) Point of Interaction (POI) device approval Latest Version 4 of PCI PTS POI released June 2013 Pertinent to the Device Testing and Approval Program Approved PTS Device List Always refer to the list when investing in new equipment. n_security.php 17 Visa PIN Security Program May 2015
18 Visa TDES Requirements All ATMs and POS PIN acceptance devices must use TDES to protect PINs US only - Effective 1 July 2010, Automated Fuel Dispensers (AFDs) must use Tripe DES or Single DES Derived Unique Key Per Transaction to protect PINs. Sunset dates for SDES DUKPT to be decided Note: It is not too early to start thinking about AES. 18 Visa PIN Security Program May 2015
19 PIN Security Program Requirements Visa Approved Security Assessors Compliance Validation PIN Program Participants Visa s PIN Security Program Visa s Global Registry of Service Providers 19 Visa PIN Security Program May 2015
20 Visa Approved Security Assessors Who are they? Companies that Visa has approved for onsite PIN assessments Experienced security professionals What they can do Perform onsite PIN security assessments Provide consultation on improving your security position and track remediation outstanding issues What they cannot do Market or sell services that influence the results of your onsite PIN assessment Where can I find them? 20 Visa PIN Security Program May 2015
21 PIN Security Program Requirements Visa Approved Security Assessors Compliance Validation PIN Program Participants Visa s PIN Security Program Visa s Global Registry of Service Providers 21 Visa PIN Security Program May 2015
22 Compliance Validation Visa PIN Program participants Onsite assessment every 24 months Onsite assessment performed by Visa approved security assessor identified on the Visa Approved Security Assessor (SA) list SA sends Visa Attestation of Compliance to Visa 22 Visa PIN Security Program May 2015
23 Compliance Validation Non-PIN Program Participants Must comply with the program requirements Performs self-assessment. Internal or external resource knowledgeable with PCI PIN security requirements. Does not need to be a Visa approved security assessor Not required to submit validation materials to Visa but must retain results as evidence of compliance Visa reserves the right to request evidence of PIN compliance at any time 23 Visa PIN Security Program May 2015
24 PIN Security Program Requirements Visa Approved Security Assessors Compliance Validation PIN Program Participants Visa s PIN Security Program Visa s Global Registry of Service Providers 24 Visa PIN Security Program May 2015
25 Visa s Global Registry of Service Providers Key Features and Benefits Business information and type of services offered by agents Compliance validation details for agents Visa s Global Registry of Service Providers 25 Visa PIN Security Program May 2015
26 Steps to get on the Visa s Global Registry of Service Providers List Visa s Global Registry of Service Providers No Visa VMM 6 Yes 5 Visa Client 4 26 Visa PIN Security Program May 2015
27 Summary Visa PIN Security Program PCI PIN Requirements Visa PED Rules TDES Non-PIN Program Participants Must comply May use internal or external auditor or perform PIN assessment PIN Program Participants Visa s PIN Compliance Program Bi-annual assessments with Visa approved SA Validate compliance Listed on Service Provider registry Approved Security Assessors Visa 27 Visa PIN Security Program May 2015
28 Validation Deadlines for Visa PIN Program Participants
29 Validation Deadlines for Visa PIN Program Participants Criteria Validation Deadline Have not performed a PIN Security onsite review before 31 December 2015 Performed an onsite review prior to 2013 OR Performed an onsite review in 2013 but did not complete remediation efforts Performed an onsite review in 2013 AND Achieved compliance 31 December months from date that compliance was achieved Performed an onsite review from 2014 onwards 24 months from the Visa Attestation of Compliance (VAOC) was issued All others OR in doubt? Check with Regional PIN Security Program Managers 29 Visa PIN Security Program May 2015
30 PIN Security Program Enforcement Plan
31 PIN Security Program Enforcement Plan Outline of the enforcement plan Effective 1 January 2016 Affects PIN Program Participants who: Do not have a VAOC, remediation plan, or compliance validation plan on file with Visa Are not in compliance with the PIN Security Program Requirements, including PIN Security, Visa PED requirements and TDES requirements Noncompliance assessments will be applied to any client using a noncompliant agent on a monthly basis *Note PIN Security Program Enforcement Plan does not supersede assessments pursuant to the Visa Rules for PIN Security noncompliance in the event of a PIN Compromise. 31 Visa PIN Security Program May 2015
32 PIN Security Program Enforcement Plan Remediation and Compliance Validation Plan Options Need to be submitted before validation deadline to avoid noncompliance assessments Visa client will review and accept the remediation plan and provide a copy of the documentation to Visa PIN Risk representative Visa reserves the right to review and reject remediation plans Remediation Plan Identifies areas of noncompliance determined by the Visa Approved Security Assessor and action plan to correct Includes dates and when noncompliance will be corrected. Compliance Validation Plan Identifies date when the compliance validation review will be performed Specifies the Visa Approved Security Assessor s name that is contracted to perform the review 32 Visa PIN Security Program May 2015
33 Additional Resources
34 Additional Resources PIN Security Website PIN Security News Important Visa PIN Documentation PIN Security Program requirement documentation PCI PIN Training through the Visa Business School Visa PIN Program Contacts Canada and US: AP & CEMEA: Latin America: 34 Visa PIN Security Program May 2015
35 Thank you for attending! Questions?
Webinar - Skimming and Fraud Protection for Petroleum Merchants. November 14 th 2013
Webinar - Skimming and Fraud Protection for Petroleum Merchants November 14 th 2013 Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes
Visa Inc. PIN Entry Device Requirements
Visa Inc. PIN Entry Device Requirements The following information is applicable for Visa Inc. regions. Visa Inc. regions include Asia-Pacific (AP); Central and Eastern Europe, Middle East and Africa (CEMEA);
Data Security Basics for Small Merchants
Data Security Basics for Small Merchants 28 October 2015 Stan Hui Director, Merchant Risk Lester Chan Director, Merchant Risk Disclaimer The information or recommendations contained herein are provided
Third Party Risk Management Basics. Webinar. 26 February 2015
Third Party Risk Management Basics Webinar 26 February 2015 Stan Hui Payment System Security Oscar Munoz Third Party Risk Roxanne Baumann Third Party Risk Disclaimer The information or recommendations
THIRD PARTY AGENT REGISTRATION PROGRAM
THIRD PARTY AGENT REGISTRATION PROGRAM Frequently Asked Questions For the U.S., Canada and Latin America & Caribbean Regions General Information Q. What is the Third Party Agent Registration Program? A.
Agent Registration. Program Guide. (For use in Asia Pacific, Central Europe, Middle East, Africa)
Agent Registration Program Guide (For use in Asia Pacific, Central Europe, Middle East, Africa) Version 1 April 2014 Contents 1 INTRODUCTION... 3 1.1 ABOUT THIS GUIDE... 3 1.2 WHO NEEDS TO BE REGISTERED?...
Third Party Agent Registration Program Frequently Asked Questions
Third Party Agent Registration Program Frequently Asked Questions U.S., Canada and Latin America & Caribbean Regions General Information What is the Third Party Agent Registration Program? The Third Party
Implement Effective Penetration Testing
Implement Effective Penetration Testing Ed Verdurmen Visa - Moderator Navid Jam FireEye Rob Chahin & Kevin Dunn NCC Group Ryan Wakeham & Scott Sutherland netspi August 25, 2015 Notice of Disclaimer The
Securing The Data. Payment System Forum Bank Negara Malaysia. 27 th November 2014. Murugesh Krishnan Head of Risk, South & Southeast Asia
Securing The Data Payment System Forum Bank Negara Malaysia 27 th November 2014 Murugesh Krishnan Head of Risk, South & Southeast Asia Disclaimer Case studies, statistics, research and recommendations
Introduction to PCI DSS Compliance. May 18, 2009 1:15 p.m. 2:15 p.m.
Introduction to PCI DSS Compliance May 18, 2009 1:15 p.m. 2:15 p.m. Disclaimer The opinions of the contributors expressed herein do not necessarily state or reflect those of the National Association of
Agent Registration. Program Guidelines. (For use in Asia Pacific, Central Europe, Middle East and Africa)
(For use in Asia Pacific, Central Europe, Middle East and Africa) January 2012 Contents 1 INTRODUCTION... 3 1.1 BACKGROUND... 3 1.2 PURPOSE OF DOCUMENT... 4 1.3 WHO NEEDS TO BE REGISTERED?... 5 1.4 WHY
Breach Findings for Large Merchants. 28 January 2015 Glen Jones Cyber Intelligence and Investigation Lester Chan Payment System Security
Breach Findings for Large Merchants 28 January 2015 Glen Jones Cyber Intelligence and Investigation Lester Chan Payment System Security Disclaimer The information or recommendations contained herein are
Don Roeber Vice President, PCI Compliance Manager. Lisa Tedeschi Assistant Vice President, Compliance Officer
Complying with the PCI DSS All the Moving Parts Don Roeber Vice President, PCI Compliance Manager Lisa Tedeschi Assistant Vice President, Compliance Officer Types of Risk Operational Risk Normal fraud
MasterCard PCI & Site Data Protection (SDP) Program Update. Academy of Risk Management Innovate. Collaborate. Educate.
MasterCard PCI & Site Data Protection (SDP) Program Update Academy of Risk Management Innovate. Collaborate. Educate. The Payment Card Industry Security Standards Council (PCI SSC) Open, Global Forum Founded
MITIGATING LARGE MERCHANT DATA BREACHES
MITIGATING LARGE MERCHANT DATA BREACHES Tia D. Ilori Ed Verdurmen January 2014 1 DISCLAIMER The information or recommendations contained herein are provided "AS IS" and intended for informational purposes
Effectively Managing Data Breaches
Effectively Managing Data Breaches May 27, 2015 Stoddard Lambertson Cyber Intelligence and Investigations Justina Jow Cyber Intelligence and Investigations Disclaimer The information or recommendations
Visa MasterCard Registration Procedures
Effective May Visa Term Definition Registration Requirements Forms Initial Registration Annual Renewal An organization or individual, which is not a Member, whose *Enhanced /Service Provider bankcard-related
How To Ensure Account Information Security
Global PCI DSS Framework Emöke Bitter Business Leader, Risk Management 26 February 2009 Agenda Introduction Merchants Service Providers Registry of Service Providers Payment Applications Resources Information
A Compliance Overview for the Payment Card Industry (PCI)
A Compliance Overview for the Payment Card Industry (PCI) Many organizations are aware of the Payment Card Industry (PCI) and PCI compliance but are unsure if they are doing everything necessary. This
PCI DSS Overview. By Kishor Vaswani CEO, ControlCase
PCI DSS Overview By Kishor Vaswani CEO, ControlCase Agenda About PCI DSS PCI DSS Applicability to Banks, Merchants and Service Providers PCI DSS Technical Requirements Overview of PCI DSS 3.0 Changes Key
PCI Compliance Workshop. NACS PEI October 21, 2009 10:45 a.m. 11:45 a.m.
PCI Compliance Workshop NACS PEI October 21, 2009 10:45 a.m. 11:45 a.m. Presenters Scott McDowell, Director of Marketing, Dispenser Applications, Gilbarco Veeder-Root Mike Tyler, Director of Marketing,
2015 Visa Payment Security Symposium Webinar
The Power of Partnership AUGUST 12-13 HYATT REGENCY BURLINGAME, CA 2015 Visa Payment Security Symposium Webinar Diana Greenhaw Sr. Director, Global Data Security and Third Party Risk Lester Chan Director,
Introduction to. May 18, 2009 1:15 p.m. 2:15 p.m.
Introduction to PCI DSS Compliance May 18, 2009 1:15 p.m. 2:15 p.m. Disclaimer The opinions of the contributors expressed herein do not necessarily state or reflect those of the National Association of
Payment Card Industry Compliance Overview
January 31, 2014 11:30am 12:30pm Central Hosted by: Texas.gov Presented by: Jayne Holland Barbara Brinson Payment Card Industry Compliance Overview Securing Government Payments Audio Dial In: 866-740-1260
Your Compliance Classification Level and What it Means
General Information What are the Payment Card Industry (PCI) Data Security Standards? The PCI Data Security Standards represents a common set of industry tools and measurements to help ensure the safe
Cyber - Security and Investigations. Ingrid Beierly August 18, 2008
Cyber - Security and Investigations Ingrid Beierly August 18, 2008 Agenda Visa Cyber - Security and Investigations Today s Targets Recent Attack Patterns Hacking Statistics (removed) Top Merchant Vulnerabilities
Payment Card Industry (PCI) Point-to-Point Encryption
Payment Card Industry (PCI) Point-to-Point Encryption Solution Requirements and : Encryption, Decryption, and Key Management within Secure Cryptographic Devices (Hardware/Hardware) Version 1.1.1 July 2013
Point-to-Point Encryption (P2PE)
Payment Card Industry (PCI) Point-to-Point Encryption (P2PE) Frequently Asked Questions for PCI Point-to- Point Encryption (P2PE) August 2012 Frequently Asked Questions (FAQs) For PCI Point-to-Point Encryption
Project Title slide Project: PCI. Are You At Risk?
Blank slide Project Title slide Project: PCI Are You At Risk? Agenda Are You At Risk? Video What is the PCI SSC? Agenda What are the requirements of the PCI DSS? What Steps Can You Take? Available Services
PDQ Guide for the PCI Data Security Standard Self-Assessment Questionnaire C (Version 1.1)
PDQ has created an Answer Guide for the Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire C to help wash operators complete questionnaires. Part of the Access Customer Management
Registry of Service Providers
Registry of Service Providers Program Guide Contents 1 2 1.1 What is the Registry of Service Providers? 2 1.2 Who can register? 3 1.3 Why register with Visa? 3 1.4 Implications for Visa Clients 4 2 5 2.1
Payment Card Data and Protected Health Information Security Practices
Payment Card Data and Protected Health Information Security Practices Andrew Sierra Merchant Risk Lester Chan Merchant Security August 5, 2015 Disclaimer The information or recommendations contained herein
The PCI DSS Compliance Guide For Small Business
PCI DSS Compliance in a hosted infrastructure A Rackspace White Paper Spring 2010 Summary The Payment Card Industry Data Security Standard (PCI DSS) is a global information security standard defined by
FREQUENTLY ASKED QUESTIONS The MasterCard Site Data Protection (SDP) Program
FREQUENTLY ASKED QUESTIONS The MasterCard Site Data Protection (SDP) Program MERCHANTS Can Level 1 merchants currently use internal auditors to perform an onsite assessment? Yes. However, after June 30,
Q: What is PCI? Q: To whom does PCI apply? Q: Where can I find the PCI Data Security Standards (PCI DSS)? Q: What are the PCI compliance deadlines?
Q: What is PCI? A: The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements designed to ensure that ALL companies that process, store or transmit credit card information maintain
Payment Card Industry Security Standards PCI DSS, PCI-PTS and PA-DSS
The PCI Security Standards Council http://www.pcisecuritystandards.org The OWASP Foundation http://www.owasp.org Payment Card Industry Security Standards PCI DSS, PCI-PTS and PA-DSS Omar F. Khandaker,
Third Party Agent (TPA) Registration Program - TPA Types and Functional Descriptions
Third Party Agent (TPA) Registration Program - TPA Types and Functional Descriptions Independent Sales Organizations (ISO) ISO Merchant (ISO M) Conducts merchant account or transaction processing solicitation,
Payment Card Industry (PCI) Point-to-Point Encryption
Payment Card Industry (PCI) Point-to-Point Encryption Solution Requirements and Version 2.0 June 2015 Document Changes Date Version Description 14 September 2011 1.0 April 2012 1.1 June 2014 2.0 Initial
PCI DSS Security Awareness Training for University of Tennessee Credit Card Merchants. UT System Administration Information Security Office
PCI DSS Security Awareness Training for University of Tennessee Credit Card Merchants UT System Administration Information Security Office Agenda Overview of PCI DSS Compliance versus Non-Compliance PCI
American Express Data Security Operating Policy United States
American Express Data Security Operating Policy United States As a leader in consumer protection, American Express has a long-standing commitment to protect Cardmember Information, ensuring that it is
University Policy Accepting Credit Cards to Conduct University Business
BROWN UNIVERSITY University Policy Accepting Credit Cards to Conduct University Business Purpose Brown University requires all departments that are involved with credit card handling to do so in compliance
HOW SECURE IS YOUR PAYMENT CARD DATA? COMPLYING WITH PCI DSS
HOW SECURE IS YOUR PAYMENT CARD DATA? COMPLYING WITH PCI DSS August 23, 2011 MOSS ADAMS LLP 1 TODAY S PRESENTERS Presenters Francis Tam, CPA, CISA, CISM, CITP, CRISC, PCI QSA Managing Director, IT Security
To ensure independence, PSC does not represent, resell or receive commissions from any third party hardware, software or solutions vendors.
About PSC With offices in the USA, Canada, UK and Australia, PSC is a leading PCI, PA DSS, and P2PE assessor, PCI Forensics Company and Approved Scanning Vendor. PSC is one of an elite few companies qualified
Registration and PCI DSS compliance validation
Visa Europe A Guide for Third Party Agents Registration and PCI DSS compliance validation October 2015 Version 1.1 Visa Europe 2015 Contents 1 Introduction... 4 1.1 Definitions of Agents... 4 2 Registration
This appendix is a supplement to the Local Government Information Security: Getting Started Guide, a non-technical reference essential for elected
This appendix is a supplement to the Local Government Information Security: Getting Started Guide, a non-technical reference essential for elected officials, administrative officials and business managers.
PROTECTION OF OUR MERCHANTS AND REFERRAL PARTNERS IS OUR FIRST CONCERN
PCI Q: What is PCI? A: The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements designed to ensure that ALL companies that process, store or transmit credit card information
What To Do if Compromised. Visa USA Fraud Investigations and Incident Management Procedures
What To Do if Compromised Visa USA Fraud Investigations and Incident Management Procedures Table of Contents Introduction......................................................... 1 Security Breach Reporting............................................
It is important to note, the payment brands and acquirers are responsible for enforcing compliance, not the PCI council.
PCI FAQ And MYTHS FREQUENTLY ASKED QUESTIONS (FAQ): Q: What is PCI? A: The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements designed to ensure that ALL companies that process,
* Any merchant that has suffered a hack that resulted in an account data compromise may be escalated to a higher validation level.
Q: What is PCI? A: The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements designed to ensure that ALL companies that process, store or transmit credit card information maintain
PCI DSS. CollectorSolutions, Incorporated
PCI DSS Robert Cothran President CollectorSolutions www.collectorsolutions.com CollectorSolutions, Incorporated Founded as Florida C corporation in 1999 Approximately 235 clients in 35 states Targeted
PCI Standards: A Banking Perspective
Slide 1 PCI Standards: A Banking Perspective Bob Brown, CISSP Wachovia Corporate Information Security Slide 2 Agenda 1. Payment Card Initiative History 2. Description of the Industry 3. PCI-DSS Control
mobile payment acceptance Solutions Visa security best practices version 3.0
mobile payment acceptance Visa security best practices version 3.0 Visa Security Best Practices for, Version 3.0 Since Visa s first release of this best practices document in 2011, we have seen a rapid
The Petroleum Marketer s PCI compliance Reference Guide
The Petroleum Marketer s PCI compliance Reference Guide 1. Become familiar with the 12 standards of card data security: Build and maintain a secure network Requirement 1 Install and maintain a firewall
FREQUENTLY ASKED QUESTIONS The MasterCard Site Data Protection (SDP) Program
FREQUENTLY ASKED QUESTIONS The MasterCard Site Data Protection (SDP) Program MERCHANTS Can Level 1 merchants currently use internal auditors to perform an onsite assessment? Yes. However, after June 30,
GLOSSARY OF MOST COMMONLY USED TERMS IN THE MERCHANT SERVICES INDUSTRY
GLOSSARY OF MOST COMMONLY USED TERMS IN THE MERCHANT SERVICES INDUSTRY Acquiring Bank The bank or financial institution that accepts credit and/or debit card payments for products or services on behalf
Cyber Security: Secure Credit Card Payment Process Payment Card Industry Standard Compliance
Cyber Security: Secure Credit Card Payment Process Payment Card Industry Standard Compliance A Non-Technical Guide Essential for Business Managers Office Managers Operations Managers Compliant? Bank Name
IT Security Compliance PCI DSS FOR MERCHANTS THE PAYMENT CARD INDUSTRY DATE SECURITY STANDARD WHITE PAPER
July 9 th, 2012 Prepared By: Mark Akins PCI QSA, CISSP, CISA WHITE PAPER IT Security Compliance PCI DSS FOR MERCHANTS THE PAYMENT CARD INDUSTRY DATE SECURITY STANDARD PCI DSS for Merchants The Payment
MEETING PCI COMPLIANCE WITH SONICWALL GLOBAL MANAGEMENT SYSTEM
MEETING PCI COMPLIANCE WITH SONICWALL GLOBAL MANAGEMENT SYSTEM PCI DSS 1.1 compliance requirements demand a new level of administration and oversight for merchants, banks and service providers to maintain
Credit Card Processing, Point of Sale, ecommerce
Credit Card Processing, Point of Sale, ecommerce Compliance, Self Auditing, and More John Benson Kurt Willey HACKS REGULATIONS Greater Risk for Merchants Topics Compliance Changes Scans Self Audits
Security Breaches and Vulnerability Experiences Overview of PCI DSS Initiative and CISP Payment Application Best Practices Questions and Comments
Security in the Payment Card Industry OWASP AppSec Seattle Oct 2006 Hap Huynh, Information Security Specialist, Visa USA [email protected] Copyright 2006 - The OWASP Foundation Permission is granted to copy,
WHITE PAPER. PCI Basics: What it Takes to Be Compliant
WHITE PAPER PCI Basics: What it Takes to Be Compliant Introduction A long-running worldwide advertising campaign by Visa states that the card is accepted everywhere you want to be. Unfortunately, and through
Two Approaches to PCI-DSS Compliance
Disclaimer Copyright Michael Chapple and Jane Drews, 2006. This work is the intellectual property of the authors. Permission is granted for this material to be shared for non-commercial, educational purposes,
What To Do if Compromised. Visa USA Fraud Investigations and Incident Management Procedures
What To Do if Compromised Visa USA Fraud Investigations and Incident Management Procedures Table of Contents Introduction......................................................... 1 Identifying and Detecting
Third Party Agent Registration and PCI DSS Compliance Validation Guide
Visa Europe Third Party Agent Registration and PCI DSS Compliance Validation Guide May 2016 Version 1.3 Visa Europe 2015 Contents 1 Introduction... 4 1.1 Definitions of Agents... 4 2 Registration Process...
PAYMENT CARD INDUSTRY (PCI) ANNUAL TRAINING DECEMBER 10, 2009 WESTERN ILLINOIS UNIVERSITY OFFICE OF THE CTSO & BUSINESS SERVICES
PAYMENT CARD INDUSTRY (PCI) ANNUAL TRAINING DECEMBER 10, 2009 WESTERN ILLINOIS UNIVERSITY OFFICE OF THE CTSO & BUSINESS SERVICES AGENDA PCI Players and Roles Merchant Requirements Keys To Successful PCI
Why Is Compliance with PCI DSS Important?
Why Is Compliance with PCI DSS Important? The members of PCI Security Standards Council (American Express, Discover, JCB, MasterCard, and Visa) continually monitor cases of account data compromise. These
Need to be PCI DSS compliant and reduce the risk of fraud?
Need to be PCI DSS compliant and reduce the risk of fraud? NCR Security lessens your PCI compliance burden and protects the integrity of your network An NCR White Paper Experience a new world of interaction
Key Steps to Meeting PCI DSS 2.0 Requirements Using Sensitive Data Discovery and Masking
Key Steps to Meeting PCI DSS 2.0 Requirements Using Sensitive Data Discovery and Masking SUMMARY The Payment Card Industry Data Security Standard (PCI DSS) defines 12 high-level security requirements directed
PCI Compliance for Cloud Applications
What Is It? The Payment Card Industry Data Security Standard (PCIDSS), in particular v3.0, aims to reduce credit card fraud by minimizing the risks associated with the transmission, processing, and storage
SECTION: SUBJECT: PCI-DSS General Guidelines and Procedures
1. Introduction 1.1. Purpose and Background 1.2. Central Coordinator Contact 1.3. Payment Card Industry Data Security Standards (PCI-DSS) High Level Overview 2. PCI-DSS Guidelines - Division of Responsibilities
Payment Card Industry Data Security Standard
Payment Card Industry Data Security Standard Office of the State Treasurer Ryan Pitroff Banking Services Manager [email protected] PCI-DSS A common set of industry tools and measurements to help
EMV mobile Point of Sale (mpos) Initial Considerations
EMV mobile Point of Sale EMV mobile Point of Sale (mpos) Initial Considerations Version 1.1 June 2014 2014 EMVCo, LLC ( EMVCo ). All rights reserved. Any and all uses of the EMV Specifications ( Materials
Payment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.0 February 2014 Section 1: Assessment Information Instructions for Submission
Understanding Payment Card Industry (PCI) Data Security
Understanding Payment Card Industry (PCI) Data Security Office of the State Controller November 2010 State of North Carolina The Enemy Major Security Breaches TJ-Max Heartland Hannaford Foods BJ s Wholesale
PCI DSS Compliance. 2015 Information Pack for Merchants
PCI DSS Compliance 2015 Information Pack for Merchants This pack contains general information regarding PCI DSS compliance and does not take into account your business' particular requirements. ANZ recommends
Your Reference Guide to EMV Integration: Understanding the Liability Shift
Your Reference Guide to EMV Integration: Understanding the Liability Shift UNDERSTANDING EMV EMVCo was formed in February 1999 by Europay, MasterCard and Visa to establish and maintain global interoperability
Point-to-Point Encryption
Payment Card Industry (PCI) Point-to-Point Encryption Solution Requirements: Encryption, Decryption, and Key Management within Secure Cryptographic Devices (Hardware/Hardware) Initial Release: Version
Merchant guide to PCI DSS
Merchant guide to PCI DSS Contents What is PCI DSS and why was it introduced?... 3 Who needs to become PCI DSS compliant?... 3 BOIPA Simple PCI DSS - 3 step approach to helping businesses... 3 What does
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire B and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire B and Attestation of Compliance Merchants with Only Imprint Machines or Only Standalone, Dial-out Terminals Electronic Cardholder
Payment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.0 February 2014 Section 1: Assessment Information Instructions for Submission
HOW SECURE IS YOUR PAYMENT CARD DATA?
HOW SECURE IS YOUR PAYMENT CARD DATA? October 27, 2011 MOSS ADAMS LLP 1 TODAY S PRESENTERS Francis Tam, CPA, CISA, CISM, CITP, CRISC, PCI QSA Managing Director PCI Practice Leader Kevin Villanueva,, CISSP,
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire A and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire A and Attestation of Compliance Card-not-present Merchants, All Cardholder Data Functions Fully Outsourced Version 3.0 February