Time
51 minutes
Difficulty
Intermediate
CEU/CPE
1

Video Transcription

00:01
Hello and welcome to CyberRays. Intermediate Days Security Course PC. I, continued Albie instructor Dustin Perry
00:08
in today's video. We're going to pick up where we left off, then move going over P. C. I.
00:14
First, we're going to discuss the PC I three step process.
00:18
After that, we're going to go over the variance compliance levels for PC I. And lastly, we'll discuss the costly penalties that could apply if you fail to secure PC I data. So let's get started.
00:31
We're going to start this lesson with just a quick quote on P C. I from QSR Quick Service Restaurant magazine.
00:38
The security benefits associated with maintaining PC I compliance are vital to the long term success of all merchants who process card payments.
00:48
This includes continual identification of threats and vulnerabilities that could potentially impact the organization.
00:55
Most organizations never fully recover from data breaches because the loss is greater than the data itself,
01:02
and that is definitely true.
01:04
A lot of businesses have had to close their doors because of a PC I data breach.
01:11
So it's definitely important that we take this stuff seriously and always try and and meet or exceed these compliance. Um
01:21
requirements
01:23
as we get go through it
01:26
so the PC I three step process has noticed on the screen. It is a cycle. So once you finish, you kind of keep going around and never ends. The first step in the PC I three set process is assessed.
01:40
This is where you will identify a cardholder data
01:42
taken inventory of any I T assets that includes registers, pos systems and even the networks that they're on.
01:53
You also want to go over business processes for card payment card processing and analyze them for vulnerabilities. Make sure that everything makes sense.
02:01
Once you're done assessing, you'll move on to the remediation stage. And this is where you actually fix these vulnerabilities and eliminate the storage of cardholder data. Unless again, it's absolutely necessary. If you can. You never want a story any of that data that just adds unnecessary risk.
02:19
Once you're finished, remediating the vulnerabilities, you'll move on to the reporting stage,
02:23
and this is where you'll compile and summit any required reports to the appropriate acquiring bank and card brands.
02:30
Then you start all over assess, look for more vulnerability, see where you can improve
02:35
remediate report
02:37
and again start all over.
02:40
Ah, qualified security Ancestor is a data security firm that is qualified by the PC I counsel to perform on site PC I. Data Security Standard Assessments.
02:53
The assessor will verify all technological information given by the merchant or service provider,
03:00
use their own independent judgment to confirm the standard has been met or has failed to meet,
03:07
provide support and guidance during the compliance process So they're they're toe to help you get compliant.
03:14
They are hard to be on site for the duration of the assessment,
03:19
as is necessary.
03:21
They need to adhere to the PC I data security standard assessment procedures. They've got their own procedures that they have to follow.
03:29
Validate the scope of the assessment. So that's basically making sure that they are including everything that touches that PC I Data sets the networks that these devices air on the physical devices themselves. In the business practices
03:42
evaluate any compensating controls. Sometimes it's impossible to meet a certain requirement, but there may be something you can do to kind of help make that requirement.
03:54
Um, count basically,
03:58
and then the assessor will also produce the final report on compliance so they'll give you the stamp of approval and approved scanning. Bender is a data security firm that uses a scanning solution to determine whether or not the customer meets the external vulnerability scanning requirement.
04:16
Approved scanning vendors are qualified by the PC I SSC or Security Standards Council, to perform extra network and system scans as required by the PC I data security standard.
04:30
And these are typically your, um,
04:32
Elektronik vulnerability assessments.
04:35
You can find a list of qualified security sensors and skinning vendors online.
04:46
Is that a quick quiz question?
04:47
How does the PC I three step process work?
04:53
This is more of a cycle than a process, but it's definitely important to understand all three steps.
04:59
Yeah, the first up is assessed. You want to identify any cardholder data or UM,
05:04
A I T assets and business processes for payment card processing and analyze them for vulnerabilities,
05:12
for the next step is remediate.
05:14
You want to fix these vulnerabilities and limiting the storage of cardholder data.
05:18
Lastly, you will report compiling and submitting any required reports to the appropriate acquiring bank and card brands.
05:28
Once you finish that, you'll start all over and get back into that assess phase then remediated,
05:33
then before
05:36
reports are the official method by which merchants on other entities report their compliance satis with the PC I data security standard to their respective acquiring financial institutions or payment card brands.
05:53
Quarterly submission of a report for network scanning may also be required, so this depends on which level you fall into which will get into the compliance levels. Next
06:02
individual payment Guard brand. Some may require submission of other documentation. This is where you really need to see their websites for informations. You need to check on who your payment brands are
06:15
and make sure meeting their standards as well.
06:17
Depending on the payment card brand requirements, merchants and service providers may need to submit A s a que or a self assessment questionnaire for self assessments or a report on compliance for any on site assessments.
06:33
There are two components to the South Assessment questionnaire.
06:38
The 1st 1 is a set of questions that correspond to PC I. D. S s requirements designed for service providers and merchants,
06:46
and the second part is an access station of compliance or basically a certification that you are eligible to perform and have performed the appropriate self assessment,
06:56
typically inappropriate at a station will be packaged with the questionnaire that you select.
07:03
There are four main levels of PC I compliance, and all of these levels are based on the amount of transactions your organization processes each year.
07:14
So merchant level one is any merchant, regardless of acceptance. Channel processing over six million visa transactions per year.
07:23
Any merchant that visa at its sole discretion determine should meet level one merchant requirements to minimize the risk to the visa system.
07:31
Level two.
07:32
Any merchant, regardless of acceptance. Channel processing one million to six million visa transactions per year
07:41
Level. Three. Any merchant processing 20,000 to 1 million V c e commerce transactions per year
07:47
and level forest. Any merchant processing fewer than 20,000 v c e commerce transactions per year in all other merchants, regardless of acceptance channel processing up to one million transactions per year.
08:03
So if you are a level four merchant
08:07
and
08:09
you suffer a PC, I data breach
08:11
any merchant that has suffered a breach
08:16
can be escalated to a higher validation level, so if this year 2020 your level four later in the year get a data breach
08:24
visa could move you up to Level three requirements for next year.
08:31
The payment brands may at their discretion fine acquiring banks 5000 to $100,000 per month for PC I compliance violations.
08:41
The banks typically will pass these finds along until eventually it hits you the merchant.
08:48
Furthermore, the bank will also most likely terminate your relationship or increase any fees like transaction fees.
08:56
Normally, penalties are not openly discussed or widely publicized, but they can definitely be catastrophic. Toe a small business.
09:05
It's important to be familiar with your merchant account agreement, which should kind of outline your exposure.
09:11
There's a lot of potential liabilities. In addition to the monetary fines.
09:18
Lost confidence. Many customers will go to other merchants after a certain one beats a or
09:28
has a data breach
09:30
diminished sales. Because you're losing customers, you're obviously gonna lose sales.
09:35
There's typically an additional cost of reissue restoring new payment cards. This is more for like a bank or anybody that offers that are on payment cards,
09:43
fraud losses, typically the responsible to pay for any losses due to fraud as well.
09:50
Then again, I mentioned you can move to higher costs. You can change levels about compliance levels, which could
09:58
include MAWR costs. You may need to get new equipment toe help secure your data.
10:05
Of course, you've got your legal costs, settlements and judgements so someone could sue you for losing their data,
10:13
the fines and penalties and we kind of went over these a little bit. They can range from 5000 to $100,000 per month, and it really just depends on what happened.
10:24
Termination of ability to Accept Payment Cards If this has happened multiple times, they may just say you're not allowed to accept payment cards anymore. But it means you're an only cash business in a digital world.
10:35
Lost jobs This is typical. If a company suffers a PC, I data breach thesis. So CEO, CEO or any
10:43
dependant positions on those may be fired and lose their job and doesn't look good on your resume.
10:50
And lastly, your company could go out of business. All this can just be too much for a lot of companies, and it happens all the time.
11:00
So in today's video, we finish our discussion on PC I. We went over the PC I three step process assessed for Mediate and Report. We went over the basic compliance levels required and some of the penalties that could occur if you fail to meet the compliance levels
11:18
up next, we've got Ph I.

Up Next

Intermediate Data Security

This intermediate level course will cover data security in detail.

Instructed By

Instructor Profile Image
Dustin Parry
Network Security Engineer
Instructor