Search

The Importance Of PCI ; Data Security Standard (DSS)

As the world moves towards digital means of payments and transactions, there has also been concerns over the security and protection of cardholder information. According to the PCI Security Standards Council, more than 500 million card holder records with confidential information have been breached since 2005. Merchants, who accept digital forms of payments, are at the centre of digital payments, and can become a victim of financial fraud at multiple points, including: • The point-of-sale device or machine • Wireless hotspots • Connected computer or any other device • Transmission of the cardholder data to the service provider. Risk factors According to a business survey conducted by Forrester Consulting, a majority of businesses conduct activities increase the risk of card fraud, including storage of card number, expiration date, any verification code, and customer date. Introduction to Data Security Standard (DSS) The Payment Card Industry’s Data Security Standard (PCI-DSS) is a security standard mandatory for organizations that handle payments using cards, issued from major card types including MasterCard, Visa, and American Express. This PCI standard is mandatory for all card brands and is administered by the PCI Security Standards Council. The sole aim of the PCI standards is to protect cardholder data and to reduce card frauds. Objectives The objective of PCI-DSS course is the protection of cardholder data during storage, processing, and transmission. Cardholder account information includes the unique primary account number (PAN) printed in the front of every card. Merchants or any service provider, who process card payments, must never store sensitive information about the transaction after the authorization. This includes confidential data that is stored in the magnetic stripe of the card, along with any personal identification information entered by the cardholder. Requirements The PCI Data Security Standards specifies a list of 12 mandatory requirements, which are grouped under 6 control objectives, as listed below: 1) Build and maintenance of a high-security network, which includes: * Installation of a secure firewall to protect cardholder data. This restricts (or blocks) all traffic from untrusted networks, and prohibit direct public access between the Internet and the cardholder data environment. * Changing of the vendor-provided default password and other security measures. This is important as most card fraudsters are able to break into the cardholder’s internal network using the default passwords. 2) Protection of cardholder information, which includes: * Encryption of cardholder information that is transmitted over public networks. Encryption technology renders the transmitted data unreadable by any unauthorized person. Use of cryptography and security protocols such as SSL/TLS or IPSec can be used to safeguard customer data. * Protection of the stored cardholder data. Sensitive data on the magnetic chip of the card must not be stored. In case the PAN needs to be stored, it must be stored in an unreadable format. Limit the duration of storage of cardholder data. 3) Maintenance of a vulnerability management program, which includes: * Use and regular updates of anti-virus software programs on all systems. Harmful viruses can enter the user network through email and other online activities. Anti-virus software is an effective tool to protect computer systems from external attacks. * Development and maintenance of secure systems and applications. Security vulnerabilities in the system and applications can enable cyber criminals to access PAN and other secure data. Ensure that all the systems and application are updated with the latest security patch from the vendor. 4) Secure access control measures, which includes: * Restricting business access to cardholder information. Limit access to confidential cardholder data to only those users whose work requires this information. Additionally, restrict the access to the least amount of data required for business purpose. * Assigning of a unique ID to every person with computer access. This is important to be able to trace if the access to critical data has been executed by only authorized persons. 5). Restricting of the physical access to cardholder data. Physical access to cardholder data must be restricted to all onsite personnel, visitors, and all paper and electronic media. 6) Regular monitoring and testing of networks, which includes: * Tracking and monitoring of all access points to network resources and cardholder data. Use of logging mechanisms and tracking of user activities are included. * Regular testing of security procedures and processes. Periodic testing of security controls is important, along with internal and external network scans. 7) Maintaining of an information security policy, which includes: * Maintenance of a company policy that addresses information security. This includes establishing a security policy that addresses all the PCI-DSS requirements, along with an annual process to detect any vulnerability. These set of requirements is mandatory for companies that manufacture devices that accept and process PIN-based transactions or any other type of digital payments. Financial institutions, merchants, and service providers must ensure that they only use devices, approved for PTS (PIN transaction security).
Rated 4.5/5 based on 20 customer reviews

The Importance Of PCI ; Data Security Standard (DSS)

631
The Importance Of PCI ; Data Security Standard (DSS)

As the world moves towards digital means of payments and transactions, there has also been concerns over the security and protection of cardholder information. According to the PCI Security Standards Council, more than 500 million card holder records with confidential information have been breached since 2005.

Merchants, who accept digital forms of payments, are at the centre of digital payments, and can become a victim of financial fraud at multiple points, including:

• The point-of-sale device or machine

• Wireless hotspots

• Connected computer or any other device

• Transmission of the cardholder data to the service provider.

Risk factors

According to a business survey conducted by Forrester Consulting, a majority of businesses conduct activities increase the risk of card fraud, including storage of card number, expiration date, any verification code, and customer date.

Introduction to Data Security Standard (DSS)

The Payment Card Industry’s Data Security Standard (PCI-DSS) is a security standard mandatory for organizations that handle payments using cards, issued from major card types including MasterCard, Visa, and American Express.

This PCI standard is mandatory for all card brands and is administered by the PCI Security Standards Council. The sole aim of the PCI standards is to protect cardholder data and to reduce card frauds.

Objectives

The objective of PCI-DSS course is the protection of cardholder data during storage, processing, and transmission. Cardholder account information includes the unique primary account number (PAN) printed in the front of every card.

Merchants or any service provider, who process card payments, must never store sensitive information about the transaction after the authorization. This includes confidential data that is stored in the magnetic stripe of the card, along with any personal identification information entered by the cardholder.

Requirements

The PCI Data Security Standards specifies a list of 12 mandatory requirements, which are grouped under 6 control objectives, as listed below:

1) Build and maintenance of a high-security network, which includes:

* Installation of a secure firewall to protect cardholder data.

This restricts (or blocks) all traffic from untrusted networks, and prohibit direct public access between the Internet and the cardholder data environment.

* Changing of the vendor-provided default password and other security measures.

This is important as most card fraudsters are able to break into the cardholder’s internal network using the default passwords.

2) Protection of cardholder information, which includes:

* Encryption of cardholder information that is transmitted over public networks.

Encryption technology renders the transmitted data unreadable by any unauthorized person. Use of cryptography and security protocols such as SSL/TLS or IPSec can be used to safeguard customer data.

* Protection of the stored cardholder data.

Sensitive data on the magnetic chip of the card must not be stored. In case the PAN needs to be stored, it must be stored in an unreadable format. Limit the duration of storage of cardholder data.

3) Maintenance of a vulnerability management program, which includes:

* Use and regular updates of anti-virus software programs on all systems.

Harmful viruses can enter the user network through email and other online activities. Anti-virus software is an effective tool to protect computer systems from external attacks.

* Development and maintenance of secure systems and applications.

Security vulnerabilities in the system and applications can enable cyber criminals to access PAN and other secure data. Ensure that all the systems and application are updated with the latest security patch from the vendor.

4) Secure access control measures, which includes:

* Restricting business access to cardholder information.

Limit access to confidential cardholder data to only those users whose work requires this information. Additionally, restrict the access to the least amount of data required for business purpose.

* Assigning of a unique ID to every person with computer access.

This is important to be able to trace if the access to critical data has been executed by only authorized persons.

5). Restricting of the physical access to cardholder data.

Physical access to cardholder data must be restricted to all onsite personnel, visitors, and all paper and electronic media.

6) Regular monitoring and testing of networks, which includes:

* Tracking and monitoring of all access points to network resources and cardholder data.

Use of logging mechanisms and tracking of user activities are included.

* Regular testing of security procedures and processes.

Periodic testing of security controls is important, along with internal and external network scans.

7) Maintaining of an information security policy, which includes:

* Maintenance of a company policy that addresses information security.

This includes establishing a security policy that addresses all the PCI-DSS requirements, along with an annual process to detect any vulnerability.

These set of requirements is mandatory for companies that manufacture devices that accept and process PIN-based transactions or any other type of digital payments.

Financial institutions, merchants, and service providers must ensure that they only use devices, approved for PTS (PIN transaction security).

KnowledgeHut

KnowledgeHut

Author

KnowledgeHut is a fast growing Management Consulting and Training firm that is a source of Intelligent Information support for businesses and professionals across the globe.


Website : https://www.knowledgehut.com

Join the Discussion

Your email address will not be published. Required fields are marked *

5 comments

Jerry Bertelson 02 Feb 2017

It's the best time to make a few plans for the future and it is time to be happy. I've learn this submit and if I may I want to recommend you some fascinating issues or suggestions. Maybe you could write subsequent articles relating to this article. I want to read more issues about it!

Christina 27 Jun 2017

Thanks for the terrific guide

KnowledgeHut 28 Jun 2017

Thanks Christina

Naomi 28 Jun 2017

I enjoy the article

Antwan 05 Jul 2017

Thanks, it is very informative

Suggested Blogs

Top It-security Certification Courses in Demand As of 2019

The field of information technology seems a bit of isolated and saturated when it comes to any innovation in that regard. This is not the case at present, though it seems a bit monotonous there are several IT security certification courses that you can do to not only boost your income but also to make sure that you excel in your department. With a lot of security breaches happening in the past, IT security has become one of the most demanding fields as far as the security and its maintenance is concerned. Here is a detailed list of the Top IT-Security certification courses in Demand in 2017. We’ve covered almost all the aspects of the certificate course details. Let us proceed further and understand each one of these certification courses. Information Systems Security Engineering Professional (ISSEIP/CISSP) Certification Course This was developed in conjunction with the NSA (National Security Agency, USA) this CISSP certification course mainly focusses on the integration of security methodologies and best practices in the information systems. There are several added applications of it in the business practices, several other private and government based projects. EC- Council Licensed Penetration Tester Certification Course The License Penetration Tester certification demonstrates the ability of the professional to audit the security of the network, penetration testing performance and recommending a suitable correction for whatsoever weaknesses found. The two-part EC-Council certified security analyst (CSA) and Licensed Penetration Tester (LPT) is a comprehensive and standard based, intensive training program that teaches IT security professionals to conduct the tests and find the errors or weaknesses in the systems. Later on, they are asked to perform the required rectification protocols. GIAC certified penetration tester Certification Course The GPEN Certification is for the IT security personnel who can assess the target networks for all sorts of vulnerabilities including Virus, various Malwares & Ransomwares. These certified pros are capable of knowing the ins-and-outs of the penetration testing methodology. There are also aware of the legal issues that are related to the penetration testing also. Also, they are very much expert in knowing, how a successful penetration test can be conducted with the technical and non-technical techniques that are related to the penetration testing. GIAC Security Essentials Certification Course The GSEC certification allows the security professionals to demonstrate the hands-on application of security tasks related to the broad range of the IT systems. The candidates are required to demonstrate a proper understanding of IT security that is beyond simple terminologies and concepts, and they must prove the theory into practice. Cybersecurity Forensic Analyst Certification Course The CSFA or the Cybersecurity Forensic Analyst proves that certification holders can do a scheduled and comprehensive analysis of the systems. Then can properly interpret the evidence and deliver the so formed investigation results in an effective and efficient manner to the stakeholders of the company. This will be going to be a time bound job, so it is very much necessary that these professionals can perform the analysis as fast as they can. EC-Council Certified Secure Programmer Certification Course You might have known that most of the software-related vulnerabilities are caused because of some programming errors. The EC-council certified secure programmers (ECSP), they have proven that they can develop some top quality codes that can be later on used so that the system can be protected from such vulnerabilities. These certifications are available for .Net and Java programming languages. Check Point Certifies Security Expert Certification Course CCSE or the Check Point Certifies Security Expert program ensures that they professionals are being taught, how to build, modify, deploy and troubleshoot some of the many checkpoint security systems. There are several hands-on lab exercises developed for them to take part in and they are taught how they can debug firewall processes, optimise the VPN performance and upgrade management servers for getting the optimal security. Certified Security Software Lifecycle Professional Certification Course The CSSLP or the Certified Secure Software Lifecycle Professional certification course validates the ability of a professional so that he can develop application and software for security protocols. These can later on used as an add-on to reduce the security system vulnerabilities. And then can lock down all the potential breach points throughout the software development lifecycle (SDLC). Conclusion These are some of the most popular IT-security certification courses that can be done in the year 2017. The data we’ve got is valid since the year 2015, and there are only a minor ups and downs in the percentage of market change in individual sectors since then. These IT security certification courses enhance one’s capability to such an extent that they can easily foresee any security any inbound security breached, beforehand and will make them potent enough to strategize a plan to counteract the threat.
Rated 4.0/5 based on 20 customer reviews
Top It-security Certification Courses in Demand As...

The field of information technology seems a bit of... Read More

Cobit 5 Framework And Components- IT Security

As several enterprises perform day-to-day operations to fulfill assigned tasks, all they are concerned about the confidentiality as well as the integrity of the information. They have data warehousing technology to store the secure information in an encrypted form. But all these come under Information security management and are under the threat radar as the data thefts and hacking activities have increased to its extreme. It is quite essential to adopt the advanced technology to secure the information. COBIT 5 is a comprehensive course to provide important data or information, the much-needed security and it is quite vital for organizations; who have several reasons to implement it without any hesitation. COBIT 5 for IT security is actually a tutorial that has a very important role to play in this internet world where malicious activities are increasing at a brisk pace. The information is quite vital for any organization that uses this technology for the future reference and decision making. Going through COBIT 5 foundation course can help IT security professionals to understand, analyze and gain awareness of the emerging technologies and threats accompanying them. How Cobit 5 helps a Business Enterprise in Enhancing Information Security? Here is how a business enterprise can enhance the level of IT security with the help of Cobit 5: COBIT 5 has necessary attributes that reduce complexity and enhance cost effectiveness to a certain extent. User satisfaction is increased with the changes that are brought in IT security arrangements using COBIT 5. Help in improvising the integration of IT security with antivirus script encrypted for protection from online threats With the implementation of COBIT 5 to enhance IT security, a business entrepreneur can be benefitted with the awareness being provided to them regarding risk decisions being taken from their end for revoking the data security IT security breach incidents can be reduced to a huge extent with the implementation of techniques enumerated in the COBIT 5 course Essential Things to be Considered for Implementing COBIT 5 Here are the points that need to be considered while using COBIT 5 for enhancing IT security: Know the importance of IT security in context to enterprise data security: Know all the essential responsibilities of end-to-end business and management of IT security. Efficient governance and management of IT security due to organizational structures, policies and culture. Define the association of IT security with endpoint objectives of the enterprise. The last longing requirements from the entrepreneur’s end to: Prevent the vital information from getting unveiled to an unauthorized person and sustain the level of information risk to a certain level by implementing necessary instructions. Make sure that services are persistently rendered to stakeholders whenever needed in order to maintain the level of user satisfaction with IT security through COBIT 5. Obey the relevant laws and regulations as well as the internal policies on information and system security alongside offering transparency on the basis of acquiescence Acquire the cost of IT security services as well as technology protection.  Integration of COBIT 5 with Norton Antivirus  for IT Security As various techniques are unveiled by experts to deliver IT security, integration of COBIT 5 with Norton antivirus (developed by Symantec Corporation) has made the things easier. According to the Oxford dictionary,  IT security actually means to keep the system data secure or free from any kind of online threat. COBIT 5 integration with antivirus, prevents the IT infrastructure from any kind of malicious activity or help the unauthorized person to gain access to the system, where secure information is stored. The data stored in the machine are more worth than the latter. The COBIT 5 principles gives successful integration with antivirus has certain criteria and it has to follow the same. Listed below are the enumerated criteria that COBIT 5 has to sustain while offering IT security in terms of giving a security shield with the features of Norton security suite encrypted with the data security software. To prevent the intrusion of any online threat that may destroy the machine containing secure data. To offer comprehensive security in order to prevent the data getting stolen from the machine. To prevent the occurrence of such instances that disrupt computer services. Going through these criteria, one thing is that more emphasis is supposed to be given on internet security. In order to perform this, there are certain things that need to be considered at the earliest. More emphasis needs to be laid on the security of internet browser Security for the Operating system is also a top priority as its sudden crash can lead to data loss. Offering comprehensive security to the web browser is a crucial step to prevent the intrusion of online threats in the device that can adversely impact the network data and computer system. The browser security methodology to prevent web browser in the COBAT 5 tutorial is actually called the ‘perimeter defense. The Norton internet security offers firewall protection to the device as the web browser is used to access so many websites. The intrusion of online threats in the form of malware, adware, spyware and Trojan horse; can damage the important data files stored on the secondary hard disk of the device or steal the file from its exact location. The filtering proxy server and firewall inhibit in COBIT 5 with Norton, can prevent the access of malicious network websites before it gets displayed on the screen. Other than this, Norton antivirus scans the email access as well as an attachment before it gets successfully downloaded in the device. COBIT 5 with the integration of Norton security suite; secures the vital data from getting hacked that is stored in the desktop or Laptop. It encrypts the data so that malicious spyware cannot read or copy a bit of crucial data and chances of data theft or hacking is minimized to a huge extent. On some occasions, the COBIT 5 for IT Security stops responding or does not perform tasks up to the mark. There is sometimes due to the slow performance of Norton security integrated with it. No need to panic, just contact Norton customer support and avail instant assistance from experts.
Rated 4.5/5 based on 20 customer reviews
3426
Cobit 5 Framework And Components- IT Security

As several enterprises perform day-to-day operatio... Read More

Top Principles of COBIT 5 Foundation – IT Security

COBIT is created by international professional association (ISACA), which is a non-profit independent association. The COBIT (Control Objectives for Information and Related Technologies) provide a business framework for the governance and management of IT. COBIT supplies globally accepted principles, practices, and analytical tools, and a growth road map that influences proven practices. All of these are encompassed within a logical framework of IT-related processes. COBIT 5 consolidates COBIT 4.1, and following are the reasons for the transition from COBIT 4.1 to COBIT 5: • There was a need to have an all-through scope of business/organisation that covers all the IT and business functions. • There was a need to have a rational understanding of analysing the existing standards, methods, tools, and practices that relate and supplement each other. • There was a need for COBIT to be rigidly assimilated with other ISACA frameworks. • There was a need to have an improvised guidance on emerging technologies and enterprise architecture. • There was a need for COBIT to be closely bound by the external standards and frameworks. COBIT 5 is generic and proves to be useful for all the enterprises, whether small-scale or large-scale and whether commercial or non-profit. Wherever there is a dependency on technology for reliable information or a need to provide quality and control of information, COBIT 5 is used exclusively for all the business processes. COBIT 5 benefits organization and is majorly used by top-level executives and consultants in an enterprise covering the following areas of business: • IT Operations • Security and Risk Management • Audit • Governance • Compliance Following are the principles of COBIT 5: COBIT 5 Principle 1: Meeting the Needs of the Stakeholder COBIT 5 enables the transformation of the needs of the stakeholders into a more practical and achievable strategy. COBIT 5 strives to maintain a balance between the use of available resources and the realisation of the benefits of keeping in consideration the associated risks. This principle focuses on the governance, negotiation, and decision making about the various conflicting needs of the stakeholders. This assures that whenever the benefit, resources, and risk-assessment decisions are made for delivering the value, the needs of the stakeholders is taken into consideration. It uses a mechanism called the COBIT 5 Goals Cascade, which translates the needs of the stakeholder into more specific and manageable approach which are then mapped to specific processes and practices. COBIT 5 Principle 2: Covering the entirety of the Project In this approach, COBIT performs the integration of IT governance and enterprise governance and includes all the processes used to manage information and technology. Considering the latest views and developments in the governance and with the integration of IT governance into the enterprise governance, COBIT can combine both the form of governance at the same time. The overall business processes and IT services are included in the COBIT 5. The four main elements of this end-to-end approach are as follows: • The objective of governance for creating value • The enablers, which can individually or collectively decide what will work • Deciding the scope • Assigning roles, responsibilities, and activities COBIT 5 Principle 3: Applying a Single Integrated Framework The continuous changes in the technology and added pressure from customers and suppliers have led to a challenging task for the organisations to manage and govern its information and related technology. The COBIT 5 enables the organisations to have a single Integrated Framework, providing an enterprise coverage and consistency, and it also can be customised as per the needs of the organisation. COBIT 5 can retain the position of a single Integrated Framework due to the following reasons: • COBIT 5 acts as a single integrated source of direction, even for the non-technical terms of language. • COBIT 5 aligns itself with relevant standards and frameworks such as ITIL and ISO standards. • Taking into account the latest standards and frameworks, COBIT 5 composes itself as a ‘Superstructure’ by aligning all the management and governance activities. COBIT 5 Principle 4: Enabling Holistic Approach We need to have a complete view of the organisation, including the management and governance structures and processes, while making important decisions concerning the organisation. COBIT 5 facilitates effective management and governance of IT across the organisation by the means of ‘enablers.’ Enablers are the factors driving the outcome of activities that are governance and management related. Enablers can be applied across the entire organisation, including all the internal and external resources relevant to the governance and management of IT. There are five categories of Enablers defined in COBIT 5, and they’re as follows: • Principles and Policies: Performs day-to-day activities of translating the required behaviour into a logical guidance. • Processes: It consists of applications required to achieve objectives which, in turn, produce outputs required to achieve IT-related goals. • Structures in an Organisation: Are responsible for making informed decisions in an organisation. • Information: It is the key product of an enterprise itself and keeps an organisation the organisation operating successfully and well governed. • People’s skills and competencies: Links people with the right skills for successful completion of work, along with taking corrective steps and making corrective decisions. COBIT 5 Principle 5: Separating Governance from Management COBIT 5 clarifies that the governance and management each serve different purpose, have different responsibilities, require different types of activities, and need different supportive organisation structures. COBIT 5 uses EDM (evaluate, direct, and monitor) for governance, while PBRM (plan, build, run, and monitor) for management as follows: • Governance or EDM ensures that the needs of the stakeholders are evaluated by identifying and agreeing on objectives to be achieved, which is directed by prioritisation and are also monitored for performance against objectives. • Management or PBRM ensures to monitor the activities and confirm that they are in alignment with those described in the governance set.
Rated 4.0/5 based on 20 customer reviews
Top Principles of COBIT 5 Foundation – I...

COBIT is created by international professional ass... Read More

Useful links

5% Discount