CPSC 466 Reading Assignment 15 by Marc Velasco https://padlet.com/themarcvelasco/od041cv7kkcakt8h Thoughts and summary of main points from Reading Assignment 15 - PCI DSS Standard v 4.0 en-us 2022-05-04 01:19:01 UTC 2022-05-04 02:11:59 UTC hello@padlet.com Risk Management https://padlet.com/themarcvelasco/od041cv7kkcakt8h/wish/2169230893 Reminded me of the SQA reading on risk management. RM listed three steps: Identify, Analyze, assign priority to risks. 

Current reading listed 🤬, Repair, and Report. ]]> 2022-05-04 01:47:30 UTC https://padlet.com/themarcvelasco/od041cv7kkcakt8h/wish/2169230893 Topics of PCI DSS https://padlet.com/themarcvelasco/od041cv7kkcakt8h/wish/2169235303 1. Build and Maintain a Secure Network and System

2. Protect Cardholder Data

3. Maintain a Vulnerability Management Program

4. Implement Strong Access Control Measures

5. Regularly Monitor and Test Networks. 

6. Maintain an Information Security Policy]]> 2022-05-04 01:51:23 UTC https://padlet.com/themarcvelasco/od041cv7kkcakt8h/wish/2169235303 How to Properly Report https://padlet.com/themarcvelasco/od041cv7kkcakt8h/wish/2169243888
  • Contact Information and Report Date
  • Executive Summary
  • Description of Scope of Work and Approach Taken
  • Details about Reviewed Environment
  • Quarterly Scan Results
  • Findings and Observations

    • ]]>     2022-05-04 01:58:35 UTC https://padlet.com/themarcvelasco/od041cv7kkcakt8h/wish/2169243888     Not using vendor supplied passkeys https://padlet.com/themarcvelasco/od041cv7kkcakt8h/wish/2169246542 Something that seems quite common sense, but perhaps is a bigger issue that threatens OpSec in the paycard industry.]]> 2022-05-04 02:00:56 UTC https://padlet.com/themarcvelasco/od041cv7kkcakt8h/wish/2169246542 PCI DSS https://padlet.com/themarcvelasco/od041cv7kkcakt8h/wish/2169251880 Specific goals and requirements must be met as part of the PCI DSS, which include maintaining secure networks, protecting cardholder data, managing vulnerabilities, implementing access controls, testing networks and maintaining a security policy.]]> 2022-05-04 02:05:56 UTC https://padlet.com/themarcvelasco/od041cv7kkcakt8h/wish/2169251880 Three Ongoing Steps to adhering to PCI DSS standards https://padlet.com/themarcvelasco/od041cv7kkcakt8h/wish/2169254908 Assess - Identify all locations of cardholder data, taking an inventory of your IT assets and business processes for payment card processing and analyzing them for vulnerabilities that could expose cardholder data.
    Repair - Fixing any identified vulnerabilities and removing unnecessary cardholder data storage and implementing secure business practices
    Report - documenting assessment and remediation details and submitting compliance reports to the acquiring bank and card brands that you do business with.]]>     2022-05-04 02:09:00 UTC https://padlet.com/themarcvelasco/od041cv7kkcakt8h/wish/2169254908     PCI DSS Requirements https://padlet.com/themarcvelasco/od041cv7kkcakt8h/wish/2169256651 1. Install and maintain a firewall configuration to protect cardholder data.
    2. Do not use vendor-supplied defaults for system passwords and other security parameters. 
    3. Protect stored cardholder data.
    4. Encrypt transmission of cardholder data across open, public networks.
    5. Protect all systems against malware and regularly update anti-virus software or programs.
    6. Develop and maintain secure systems and applications.
    7. Restrict access to cardholder data by business need to know.
    8. Identify and authenticate access to system components.
    9. Restrict physical access to cardholder data.
    10. Track and monitor all access to network resources and cardholder data.
    11. Regularly test security systems and processes.
    12. Maintain a policy that addresses information security for all personnel.]]>     2022-05-04 02:10:45 UTC https://padlet.com/themarcvelasco/od041cv7kkcakt8h/wish/2169256651     Overview of PCI Requirements https://padlet.com/themarcvelasco/od041cv7kkcakt8h/wish/2169257883  Requirements set by the PCI security standards council (PCI SSC) to protect cardholder data. The standards apply to all transactions (process or transmit data) with requirements for software developers and manufacturers of applications and devices used in those transactions. The council is responsible for managing the security standards. ]]> 2022-05-04 02:11:59 UTC https://padlet.com/themarcvelasco/od041cv7kkcakt8h/wish/2169257883