Presented By: David Kidd, Director of Compliance, Peak 10 & Brian Herman, VP of Managed Security Sales, Still Secu

1. Presented By: David Kidd, Director of Compliance, Peak 10 & Brian Herman, VP of Managed Security Sales, Still Secure

2. Defining the Challenge

3. Cost of Breaches Continues to Rise • An increase in the total average cost of a data breach: • For each reporting company, the average cost for a data breach was more than $8.9 million per breach and ranged from $1.4 million to $46 million, a 6% increase from 2011. • An increase in lost business due to data breach: • Lost business from denial of service, malicious insider and web-based attacks account for 58% of data breach costs averaging $591,780 with a 24 day duration to resolve the attack, a 42% increase from 2011. • An increase in third-party data breaches: • Companies averaged 102 successful attacks per week, up from 72 last year • An increase in disruption to business in response to breach: • Information theft accounts for 44% of external costs up 4% from 2011 • Disruption to business and lost productivity accounts for 30% of external cost, up 1% from 2011. Recovery and detection accounted for 47% of internal activity cost.

4. Merchant Costs for a PCI Breach • Card replacement costs now averaging about $4 per item • Compliance fines now ranging from about $5,000 to $50,000 per event for a small merchant (III, IV) • Cost of forensic examination averaging between $25,000 and $35,000 per event for these same merchants • Additional fines for actual fraudulent utilization of stolen PAN varies

5. Breach Example TJX: The “Pearl Harbor” of Credit Card Breaches (01/2007) • Hackers spent 18 months exploiting weak wireless security outside thousands of TJX stores • 45.7 million credit and debit cards were stolen • TJX stated the breach cost > $256 million • Still incurring related expenses in years after the breach • The average cost per breached card will be between $90 and $305 • Business and reputation costs are even greater

6. Consequences: New Oversight Federal Trade Commission Response • As a consequence of the breach TJX Stores announced in 2007, the FTC took enforcement action by treating the breach as an “unfair trade practice” • State and local privacy laws are also increasingly applied to information security breaches • What had been an industry challenge is now a regulatory challenge

7. PCI DSS

8. PCI Security Standards Council Founders: Payment Brands Participating Organizations: Merchants, Banks, Processors, Developers, POS Vendors Trademarks and logos used on this page are the property of their respective owners.

9. Developing Standards Established in 2006, the Security Standards Council was formed to coordinate information security programs of the founding payment brands. The PCI Security Standards Council has established multiple standards for the industry including equipment manufacturers, payment software application developers, merchantsand merchant service providers. Merchants & Processors PCI DSS Software Developers PCI PA-DSS Manufactures PCI PTS

10. The PCI DSS The PCI Data Security Standard The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard for organizations that store, process, or transmit cardholder data. The PCI DSS applies to all entities that store, process, and/or transmit cardholder data. If you are a merchant who accepts or processes payment cards, you must comply with the PCI DSS regardless of transaction volume.

11. Elements of the PCI Data Security Standard

12. Moving to the Cloud

13. Understanding the Cloud Service Models • Public Cloud • The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services. • Hybrid • The cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load-balancing between clouds). • Community Cloud • The cloud infrastructure is shared by several organizations and supports a specific community that has shared concerns (e.g., mission, security requirements, policy, or compliance considerations). It may be managed by the organizations or a third party and may exist on-premises or off-premises. • Private Cloud • The cloud infrastructure is operated solely for a single organization. It may be managed by the organization or a third party, and may exist on-premises or off premises.

14. Software as a Service (SaaS) – Capability for clients to use the provider’s applications running on a cloud infrastructure. The applications are accessible from various client devices through either a thin client interface, such as a web browser, or a program interface. Platform as a Service (PaaS) – Capability for clients to deploy their applications (created or acquired) onto the cloud infrastructure, using programming languages, libraries, services, and tools supported by the provider. Infrastructure as a Service (IaaS) – Capability for clients to utilize the provider’s processing, storage, networks, and other fundamental computing resources to deploy and run operating systems, applications and other software on a cloud infrastructure. Understanding the Cloud Service Models

15. The Cloud Compliance Challenge: PCI DSS What makes the cloud different? The cloud is relatively new technology and may be misunderstood. Clients may have limited visibility into the service providers underlying infrastructure and the related security controls. Some virtual components do not have the same level of access control, logging, and monitoring as their physical counterparts. It can be challenging to verify who has access to cardholder data process, transmitted, or stored in the cloud environment. Public cloud environments are usually designed to allow access from anywhere on the Internet.

16. Meeting the Challenge

17. Assessing PCI DSS Compliance • Study PCI DSS Standard • Learn what the standard requires of your business. • Inventory IT Assets and Processes • Identify all systems, personnel and processes involved in the transmission, processing or storing of cardholder data. • Find Vulnerabilities • Use the appropriate SAQ to guide the assessment, and appropriate technologies to locate insecure systems. • Validate with Third-Party Experts • Your environment’s complexity may require a Qualified Security Assessor and/or Approved Scanning Vendor to execute proper assessment.

18. Tips for Successful PCI DSS Compliance • Tip #1 – Start Early • Begin in the early stages of deciding to accept payment cards • Perform an initial gap analysis • Follow the PCI Prioritized Approach to avoid hitting big issues late in the project • Select a QSA early in the project • Tip #2 – Manage as a Project • Follow project management tenets: get a project sponsor, create a core team, and make a project charter • Tip #3 – Limit scope as much as possible • Segregate the cardholder data environment to the maximum extent possible. As data expands across the network the compliance scope increases multi-fold. • Tip #4 – Look beyond checklists and tools: follow the intent behind controls • Leverage the opinion of you QSA and the guidance documents from the Council on the intent of each requirement to avoid getting lost in technicalities • Tip #5 – Compliance with another standard is not enough • PCI DSS serves a specific purpose: protection of payment card data; being compliant with another information security standard may not be sufficient • Tip # 6 – Validate your Vendors’ Compliance • Compliance of service providers is as important as that of the merchant • Even when you outsource an activity, you are still responsible for compliance

19. Control in the Cloud Cloud Service Stack (typical)

20. Responsibility in the Cloud Client Service Provider The client may have limited control of user-specific appliacation configuration settings SaaS The client has control over the deployed applications and possibly configuration settings for the application-hosting environment. PaaS The client has control over operating systems, storage, deployed applications and possible limited control of select networking components (e.g. host firewalls) IaaS

21. Cloud Considerations Sample of PCI Responsibilities in the Cloud

22. 22 Questions for Service Providers • How long has the service provider been PCI DSS compliant? • When was its last validation? • What specific services and PCI DSS requirement were included in the validation? • What specific facilities and system components were included in the validation? • Ask for proof: • Copy of the AOC • Applicable sections of the ROC

23. Other Considerations • Governance, Risk and Compliance • Risk Management • Due Diligence • Service Level Agreements (SLAs) • Business Continuity and Disaster Recovery • Human Resources • Physical Security • Technical Security • Identity and Access Management • Logging and Audit Trails

24. The 3 elements of comprehensive compliance

25. Cloud Considerations Sample of PCI Responsibilities in the Cloud

26. Ongoing Process PCI Compliance is an Ongoing Process of Continuous Monitoring and Improvement. The assessment stage is key.

27. THANK YOU!