1 Presented By: David Kidd, Director of Compliance, Peak 10 & Brian Herman, VP of Managed Security Sales, Still Secure 2 Defining the Challenge 3 Cost of Breaches Continues to Rise • An increase in the total average cost of a data breach: • For each reporting company, the average cost for a data breach was more than $8.9 million per breach and ranged from $1.4 million to $46 million, a 6% increase from 2011. • An increase in lost business due to data breach: • Lost business from denial of service, malicious insider and web-based attacks account for 58% of data breach costs averaging $591,780 with a 24 day duration to resolve the attack, a 42% increase from 2011. • An increase in third-party data breaches: • Companies averaged 102 successful attacks per week, up from 72 last year • An increase in disruption to business in response to breach: • Information theft accounts for 44% of external costs up 4% from 2011 • Disruption to business and lost productivity accounts for 30% of external cost, up 1% from 2011. Recovery and detection accounted for 47% of internal activity cost. 4 Merchant Costs for a PCI Breach • Card replacement costs now averaging about $4 per item • Compliance fines now ranging from about $5,000 to $50,000 per event for a small merchant (III, IV) • Cost of forensic examination averaging between $25,000 and $35,000 per event for these same merchants • Additional fines for actual fraudulent utilization of stolen PAN varies 5 Breach Example TJX: The “Pearl Harbor” of Credit Card Breaches (01/2007) • Hackers spent 18 months exploiting weak wireless security outside thousands of TJX stores • 45.7 million credit and debit cards were stolen • TJX stated the breach cost > $256 million • Still incurring related expenses in years after the breach • The average cost per breached card will be between $90 and $305 • Business and reputation costs are even greater 6 Consequences: New Oversight Federal Trade Commission Response • As a consequence of the breach TJX Stores announced in 2007, the FTC took enforcement action by treating the breach as an “unfair trade practice” • State and local privacy laws are also increasingly applied to information security breaches • What had been an industry challenge is now a regulatory challenge 7 PCI DSS 8 PCI Security Standards Council Founders: Payment Brands Participating Organizations: Merchants, Banks, Processors, Developers, POS Vendors Trademarks and logos used on this page are the property of their respective owners. 9 Developing Standards • Established in 2006, the Security Standards Council was formed to coordinate information security programs of the founding payment brands. • The PCI Security Standards Council has established multiple standards for the industry including equipment manufacturers, payment software application developers, merchants and merchant service providers. Manufactures PCI PTS Software Developers Merchants & Processors PCI PA-DSS PCI DSS WWW.PEAK10.COM 9 10 The PCI DSS The PCI Data Security Standard • The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard for organizations that store, process, or transmit cardholder data. • The PCI DSS applies to all entities that store, process, and/or transmit cardholder data. If you are a merchant who accepts or processes payment cards, you must comply with the PCI DSS regardless of transaction volume. WWW.PEAK10.COM 10 11 Elements of the PCI Data Security Standard 12 Moving to the Cloud 13 Understanding the Cloud Service Models Public Cloud The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services. Private Cloud Community Cloud Hybrid The cloud infrastructure is operated solely for a single organization. It may be managed by the organization or a third party, and may exist onpremises or off premises. The cloud infrastructure is shared by several organizations and supports a specific community that has shared concerns (e.g., mission, security requirements, policy, or compliance considerations). It may be managed by the organizations or a third party and may exist onpremises or off-premises. The cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load-balancing between clouds). 14 Understanding the Cloud Service Models • Software as a Service (SaaS) – Capability for clients to use the provider’s applications running on a cloud infrastructure. The applications are accessible from various client devices through either a thin client interface, such as a web browser, or a program interface. • Platform as a Service (PaaS) – Capability for clients to deploy their applications (created or acquired) onto the cloud infrastructure, using programming languages, libraries, services, and tools supported by the provider. • Infrastructure as a Service (IaaS) – Capability for clients to utilize the provider’s processing, storage, networks, and other fundamental computing resources to deploy and run operating systems, applications and other software on a cloud infrastructure. WWW.PEAK10.COM 14 15 The Cloud Compliance Challenge: PCI DSS What makes the cloud different? • The cloud is relatively new technology and may be misunderstood. • Clients may have limited visibility into the service providers underlying infrastructure and the related security controls. • Some virtual components do not have the same level of access control, logging, and monitoring as their physical counterparts. • It can be challenging to verify who has access to cardholder data process, transmitted, or stored in the cloud environment. • Public cloud environments are usually designed to allow access from anywhere on the Internet. 16 Meeting the Challenge 17 Assessing PCI DSS Compliance • Study PCI DSS Standard • Learn what the standard requires of your business. • Inventory IT Assets and Processes • Identify all systems, personnel and processes involved in the transmission, processing or storing of cardholder data. • Find Vulnerabilities • Use the appropriate SAQ to guide the assessment, and appropriate technologies to locate insecure systems. • Validate with Third-Party Experts • Your environment’s complexity may require a Qualified Security Assessor and/or Approved Scanning Vendor to execute proper assessment. 18 Tips for Successful PCI DSS Compliance Tip #1 – Start Early •Begin in the early stages of deciding to accept payment cards •Perform an initial gap analysis •Follow the PCI Prioritized Approach to avoid hitting big issues late in the project •Select a QSA early in the project Tip #2 – Manage as a Project • Follow project management tenets: get a project sponsor, create a core team, and make a project charter Tip #3 – Limit scope as much as possible • Segregate the cardholder data environment to the maximum extent possible. As data expands across the network the compliance scope increases multifold. Tip #4 – Look beyond checklists and tools: follow the intent behind controls • Leverage the opinion of you QSA and the guidance documents from the Council on the intent of each requirement to avoid getting lost in technicalities Tip #5 – Compliance with another standard is not enough • PCI DSS serves a specific purpose: protection of payment card data; being compliant with another information security standard may not be sufficient Tip # 6 – Validate your Vendors’ Compliance • Compliance of service providers is as important as that of the merchant • Even when you outsource an activity, you are still responsible for compliance 19 Control in the Cloud Cloud Service Stack (typical) Cloud Layer IasS PaaS SaaS Data Interfaces (APIs, GUIs) Applications x Solution Stack (programming languages) x Operating System (OS) x x Virtual Machines x x Virtual Network Infrastructure x x Hypervisors x x x Processing and Memory x x x Data Storage (hard drives, removable disks, backups, ect.) x x x Network (interfaces and devices, communications infrastructure) x x x Physical Facilities / Data Centers x x x 20 Responsibility in the Cloud Client Service Provider The client may have limited control of userspecific appliacation configuration settings SaaS PaaS IaaS The client has control over the deployed applications and possibly configuration settings for the application-hosting environment. The client has control over operating systems, storage, deployed applications and possible limited control of select networking components (e.g. host firewalls) 21 Cloud Considerations Sample of PCI Responsibilities in the Cloud Requirement IasS PaaS SaaS 1: Install and maintain a firewall configuration to protect cardholder data. Both Both CSP 2: Do not use vendor-supplied defaults for system passwords and other security parameters. Both Both CSP 3: Protect stored cardholder data. Both Both CSP 4: Encrypt transmission of cardholder data across open, public networks. Client Both CSP 5: Use and regularly update anti-virus software or programs. Client Both CSP 6: Develop and maintain secure systems and applications. Both Both Both 7: Restrict access to cardholder data by business need to know. Both Both Both 8: Assign a unique ID to each person with computer access . Both Both Both 9: Restrict physical access to cardholder data. CSP CSP CSP 10: Track and monitor all access to network resources and cardholder data. Both Both CSP 11: Regularly test security systems and processes. Both Both CSP 12: Maintain a policy that addresses information security for all personnel. Both Both Both PCI DSS Appendix A: Additional PCI DSS Requirements for Shared Hosting Providers. CSP CSP CSP 22 Questions for Service Providers • How long has the service provider been PCI DSS compliant? • When was its last validation? • What specific services and PCI DSS requirement were included in the validation? • What specific facilities and system components were included in the validation? • Ask for proof: • Copy of the AOC • Applicable sections of the ROC WWW.PEAK10.COM 22 23 Other Considerations • Governance, Risk and Compliance • Risk Management • Due Diligence • Service Level Agreements (SLAs) • Business Continuity and Disaster Recovery • Human Resources • Physical Security • Technical Security • Identity and Access Management • Logging and Audit Trails WWW.PEAK10.COM 23 24 The 3 elements of comprehensive compliance 25 Cloud Considerations Sample of PCI Responsibilities in the Cloud Requirement IasS MSSP 1: Install and maintain a firewall configuration to protect cardholder data. Both Both 2: Do not use vendor-supplied defaults for system passwords and other security parameters. Both Both 3: Protect stored cardholder data. Both Client 4: Encrypt transmission of cardholder data across open, public networks. Client Both 5: Use and regularly update anti-virus software or programs. Client Both 6: Develop and maintain secure systems and applications. Both Both 7: Restrict access to cardholder data by business need to know. Both Both 8: Assign a unique ID to each person with computer access . Both Both 9: Restrict physical access to cardholder data. CSP CSP 10: Track and monitor all access to network resources and cardholder data. Both Both 11: Regularly test security systems and processes. Both Both 12: Maintain a policy that addresses information security for all personnel. Both Both PCI DSS Appendix A: Additional PCI DSS Requirements for Shared Hosting Providers. CSP CSP 26 Ongoing Process PCI Compliance is an Ongoing Process of Continuous Monitoring and Improvement. Report Assess Remediate The assessment stage is key. 27 THANK YOU!