Scribd
Upload
78 views30 pages

PCI DSS Compliance Training: Matthew Packard, CCEP - Internal Auditing and Compliance

This document provides an overview of PCI DSS compliance training at the University of West Florida (UWF). It begins with an introduction to PCI DSS standards and explains that they were created by payment card brands to increase security of cardholder data. The training then covers the basics of credit cards and cardholder data, UWF policies regarding storage and access of sensitive data, and best practices for securing payment systems. Key responsibilities for employees processing payments are to keep credentials and cardholder data confidential, log off shared machines, and be vigilant against phishing attempts. Non-compliance could result in fines and damage the university's reputation.

Uploaded by

jldtecno
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
78 views30 pages

PCI DSS Compliance Training: Matthew Packard, CCEP - Internal Auditing and Compliance

This document provides an overview of PCI DSS compliance training at the University of West Florida (UWF). It begins with an introduction to PCI DSS standards and explains that they were created by payment card brands to increase security of cardholder data. The training then covers the basics of credit cards and cardholder data, UWF policies regarding storage and access of sensitive data, and best practices for securing payment systems. Key responsibilities for employees processing payments are to keep credentials and cardholder data confidential, log off shared machines, and be vigilant against phishing attempts. Non-compliance could result in fines and damage the university's reputation.

Uploaded by

jldtecno
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 30

PCI DSS Compliance Training

Matthew Packard, CCEP | Internal Auditing and Compliance


[email protected] | 850.857.6070
Agenda

☸ PCI DSS overview


☸ The Basics
☸ Your responsibilities
☸ University Policies
☸ Best Practices
So…what is PCI-DSS?
Payment Card Industry Data Security Standards
• Created by the PCI Data Security Council (Visa, MasterCard,
American Express, Discover, and JCB)
• Created a common set of industry standards developed to
increase the controls around cardholder data to reduce credit
card fraud.
• These standards consist of 6 goals and 12 Requirements…
PCI DSS Standards
6 Goals 12 Requirements
Why am I here???
Background Information

Over the past few decades…


• Increases in payment card usage
• Increases in e-commerce
• Increases in more “convenient” payment methods
Background Information
Continued
In our desire for convenience, we have left
ourselves vulnerable
PCI DSS @ UWF

As a public institution we have a


obligation to our students, vendors,
donors, stakeholders, and the
community at large to ensure that
there account information is safe
when processing credit card
payments @ UWF
PCI DSS—It Can Help
Prevent Data Breaches!
Non-Compliance—What’s at
Stake
Could result in the revocation of our ability to accept card
payments

Causes damage to consumer trust and our reputation

Fines our acquiring bank $5,000 to $100,000 per month*

$7.01 million = Average organizational cost of a data breach**

*The bank will likely pass this fine along…


**2016 Cost of Data Breach Study: Global Analysis, Ponemon Institute
Agenda

• PCI DSS overview


• The Basics
• Your responsibilities
• University Policies
• Best Practices
The Basics: Credit Card
Anatomy (Front)

EMV Chip
Holographic Security Emblem

Account Number

Expiration Date
Cardholder’s Name Card Logo
The Basics: Credit Card
Anatomy (Back)
Magnetic Stripe

Security code also known


as CVV2/CID*/CAV/CVC2

Signature Panel

The magnetic stripe contains CH name/address; account #;


expiration date; and security information to detect
fraudulent cards

*American Express refers to this code as the CID and it is located on the front of the card
What is Cardholder Data
(CHD)? …technically
Primary Account Number (PAN): Consists of the full
credit/debit card number

CHD consists of the PAN


plus any one of the
following:

Cardholder Expiration
Security Code
name date
The Last 4 Digits

Customer receipts should


not show more than the
last four digits of the
Storage of the last credit card number
four digits of a
credit card number
is allowed & does Computer systems and
not constitute CHD software used to process
credit card transactions
should not display more
than the last four digits of
the credit card number
Cardholder Data Procedures:
Magnetic Stripe/PIN/Code

The University does not


permit the storage of the
codes found on the magnetic
stripe, PIN/PIN block data, or
the card validation code.
Cardholder Data Procedures:
Access Control

All employees that have access to


CHD must keep this information in
the strictest confidence, and protect
it from unauthorized access or
disclosure.
Access to this information should be
on a need-to-know basis only.
Cardholder Data Procedures:
Electronic Records

CHD should NEVER be stored in


electronic format*

CHD should NEVER be included in


email or other electronic messages

*Entering CHD into e-market portals (Lumens/HigherOne/CashNet/etc.) does not qualify. As this data is not
being stored on our campus network.
Cardholder Data Procedures:
Paper Records Procedures

Paper documents must be protected,


stored securely, and disposed of securely.

If unavoidable, please refer


Avoid the use of to the paper document
standards/procedures
paper documents provided on the UWF
whenever possible. Financial Services PCI
Compliance webpage.
Agenda

• PCI DSS overview


• The Basics
• Your responsibilities
• University Policies
• Best Practices
Workstation Responsibilities

Each workstation must be


a dedicated, PCI Each user is required to
compliant, ITS have a unique login for
approved payment operating POS device
machine

Keep login credentials Secure the credit card


confidential and do not environment from non
share with others cashier personnel
Workstation Responsibilities
Continued
Log off another cashier
Log off whenever and login with your
stepping away from own credentials
machine when processing
transaction

Keep your
Turn off POS device workstation clear of
at night and secure any sensitive
area
materials
Agenda

• PCI DSS overview


• The Basics
• Your responsibilities
• University Policies
• Best Practices
UWF PCI DSS Policies
PCI DSS Security Policy
Technologies NOT allowed to access the cardholder
environment

Open or public WIFI (non VPN)

Removable electronic media


(USBs, etc.)

Laptops

Tablets

Smartphones
PCI DSS Security Policy

Activities NOT allowed while accessing and/or


connected to the cardholder environment

Checking email

Visiting any website not directly associated and


pertinent to the actions being performed

Make internet or intranet connections that


are not explicitly necessary
Agenda

• PCI DSS overview


• The Basics
• Your responsibilities
• University Policies
• Best Practices
Best Practices

Maintain strong passwords and update regularly

• Password Dos and Don’ts

Be on the lookout for skimming devices

• Familiarize yourself with the point-of-sale equipment and


check regularly for modifications

Be sure your station is physically secured at all


times
Best Practices Continued

Destroy CHD immediately* (cross-cut shredder)

Notify the Compliance Officer or Financial Services immediately if


there is a change in personnel

Never send CHD via electronic messages/email

Never share your login credentials

Be on the lookout for phishing/social engineering attempts to steal


your credentials
• Avoiding phishing and social engineering attacks

*Only write down CHD when absolutely necessary… it usually is not.


Questions?

[email protected] | 850.857.6070

You might also like