A PCI Journey with Wichita State University

Transcription

1 A PCI Journey with Wichita State University Blaine Linehan System Software Analyst III Financial Operations & Business Technology Division of Administration & Finance 1

2 Question #1 How many of you know what PCI is? 2

3 Question #2 How many of you are involved in becoming PCI compliant on your campus? 3

4 Glossary PCI Payment Card Industry CDE Cardholder Data Environment SAQ Self Assessment Questionnaire QSA Qualified Security Assessor 4

5 What is PCI DSS? The PCI Data Security Standard represents a common set of industry tools and measurements to help ensure the safe handling of sensitive information. [ ] 1. Compliance is mandatory, not optional Acquiring bank is ultimately responsible for compliance Acquiring bank answers to card brands (VISA, MasterCard ) Industry-Data-Security-Standard-PCI-DSS/?q=definition+of+PCI+dss&l=en_US&fs=Search&pn=1

6 Why You Should Be Proactive Compliance with the PCI DSS means that your systems are as secure as possible, and customers can trust you with their sensitive payment card information. Just one incident can severely damage your reputation and your ability to conduct business effectively, far into the future. Account data breaches can lead to catastrophic loss of sales, relationships and standing in your community. Lose the ability to take specific card brands. Lose alumni and foundation donations 6

7 Target Could be liable for up for $3.6 billion. 1 $90 fine per compromise 40 million compromises 90 x 40,000,000 = 3,600,000,

8 8 First Things First

9 9 Merchant Levels

10 The PCI Committee Associate Director of Business Technology Software Analyst Manager of Technical Services Manager of Data Operations and Network Services Manager of Server Teams Department Managers 10

11 Initial Steps Identified how and where we take credit cards Decided to NOT store any credit card numbers anywhere on campus Determined areas of greatest risk to determine our approach, rather that the compliance requirements order Started working our on scope 11

12 Scope Scope is comprised of people, processes and technology that handle cardholder data All system components included in or connected to the cardholder data environment All systems involved in managing the security of other in-scope systems (i.e. authentication servers, log management servers, IDS management consoles, etc.) 12

13 Validated Payment Application A Validated Payment Application is an application that has been validated by a Payment Application Qualified Security Assessor. It is validated by them against the current Payment Application Data Security Standard

14 What happened? We discovered that installing our Validated Payment Application put most of our network into scope because the payment terminals were layer 2 adjacent to every other PC in the subnet. 14

15 15 Problem!

16 16 Problem!

17 17 Problem!

18 What did we do? Our solution was to segment the payment terminals away from the regular campus computers. "Without proper network segmentation to isolate the systems that store, process or transmit cardholder data from those that do not, all system components in that network are considered part of the cardholder data environment, the entire network is in scope for PCI DSS, and all PCI DSS requirements apply

19 19 Solution? Segmentation!

20 20 Solution? Segmentation!

21 And then. Any company that stores, processes, or transmits cardholder data on behalf of another entity is defined to be a Service Provider by the Payment Card Industry (PCI) guidelines

22 22

23 We hired a QSA Went through a gap analysis We ARE a service provider Affiliated business organizations for which we provide network and hardware support Is it a bad thing? SAQ C 139 questions SAQ D-SP 347 questions 23

24 WSU Today 85 dedicated payment machines on campus Dedicated active directory, DNS, anti-virus, Windows updates Share DHCP with campus All system components included in or connected to the cardholder data environment are in scope 24

25 25 Associated Devices

26 26 Associated Devices

27 27 Associated Devices

28 After Segmentation Internal & external vulnerability scanning SAQ D-SP 11.2 File integrity monitoring SAQ D-SP 11.5 (A) Event log monitoring SAQ D-SP 10.6 Network connection monitoring 28

29 Scanning for data at rest The final step in proving the extent of the CDE is for the organization to scan their entire network to confirm that cardholder data is not stored anywhere outside of the CDE. 1 Asset inventory reviews & annual audits

30 On the Horizon P2PE Point to Point Encryption Encrypt cardholder data at the point of swipe 30

31 What We ve Learned Compliance never ends You have to take it seriously and be proactive Reduce scope as much as possible Centralize services Hire a QSA for questions We re not perfect 31

32 Contact Information Blaine Linehan Box Fairmount St Wichita KS