PCI 3.0 Revealed - What You Need to Know Today
2 likes•1,191 views
The document outlines the key aspects of PCI-DSS version 3.0, including its evolution, new requirements, and deadlines for compliance. It emphasizes themes such as the importance of securing point-of-sale devices, the role of service provider accountability, and the need for explicit penetration testing guidelines. Key new requirements include secure handling of credit card data, unique authentication for service providers, and updated methodologies for penetration testing.
![[6.5.11] Broken Auth. & Session Mgmt.
Authentication/Session attacks
•
•
•
•
•
•
•
21
© 2013 Imperva, Inc. All rights reserved.
Cookie Tampering
Cookie Poisoning
Session Hijacking
Session Reuse
Parameter Tampering
SSL Reuse
Brute Force
Confidential](https://image.slidesharecdn.com/impervapresentationpci3-131107184325-phpapp01/85/PCI-3-0-Revealed-What-You-Need-to-Know-Today-21-320.jpg)
![[11.3] Pen Testing and Remediation
Source: http://www.imperva.com/docs/SB_Imperva_WhiteHat.pdf
22
© 2013 Imperva, Inc. All rights reserved.
Confidential](https://image.slidesharecdn.com/impervapresentationpci3-131107184325-phpapp01/85/PCI-3-0-Revealed-What-You-Need-to-Know-Today-22-320.jpg)
PCI 3.0 Revealed - What You Need to Know Today
- 1. PCI-DSS v3.0: What You Need to Know Today Barry Shteiman – Director of Security Strategy 1 © 2013 Imperva, Inc. All rights reserved. Confidential
- 2. Agenda § PCI-DSS Themes and Drivers § Dates and Deadlines § New Requirements § Web App Compliance 2 © 2013 Imperva, Inc. All rights reserved. Confidential
- 3. Today’s Speaker - Barry Shteiman § Director of Security Strategy § Security Researcher working with the CTO office § Author of several application security tools, including HULK § Open source security projects code contributor § CISSP § Twitter @bshteiman 3 © 2013 Imperva, Inc. All rights reserved. Confidential
- 4. Introducing PCI-DSS 3.0 4 © 2013 Imperva, Inc. All rights reserved. Confidential
- 5. PCI-DSS Payment Card Industry (PCI) Data Security Standard (DSS) § Industry driven • From conception to enforcement § Evolving • 4th version over 7 years • Rate of releases has slowed – 3 years since v2.0 release § Concise and Pragmatic • Does not avoid naming technologies • Calls out threats by name • Very specific about data scope 5 © 2013 Imperva, Inc. All rights reserved. Confidential
- 6. PCI-DSS Evolution § PCI 1.2 § PCI 1.0 • December 2004 12 major sections • October 2010 • Definition of scope, clarifications • September 2006 • App security, compensating controls 6 2006 • November 2013 • Consistency for assessors, risk based approach, flexibility § PCI 2.0 § PCI 1.1 2005 § PCI 3.0 • October 2008 • Risk based approach, emphasis on wireless 2007 © 2013 Imperva, Inc. All rights reserved. 2008 2009 Confidential 2010 2011 2012 2013
- 7. PCI-DSS 3.0 Key Drivers § Lack of education and awareness § Weak passwords, authentication § Third-party security challenges § Slow self-detection, malware § Inconsistency in assessments 7 © 2013 Imperva, Inc. All rights reserved. Confidential
- 8. General Themes § Penetration testing gets real • More explicitly-defined penetration test guidelines § Skimmers, skimmers and more skimmers • New requirement to maintain list of POS devices, periodically inspect devices and train personnel • Inclusion of POS devices in other sections § Service provider accountability § PCI requirement clarifications and details 8 © 2013 Imperva, Inc. All rights reserved. Confidential
- 9. Why Protect Point-of-Sale Devices? Physical data theft incidents from 2013 Verizon Data Breach Incident Report Source: http://www.verizonenterprise.com/DBIR/ 9 © 2013 Imperva, Inc. All rights reserved. Confidential
- 10. Service Providers Accountability Third-party awareness at the compliance level Source: http://www.bankinfosecurity.com/bofa-confirms-third-party-breach-a-5582 10 © 2013 Imperva, Inc. All rights reserved. Confidential
- 11. PCI DSS 3.0 Dates and Deadlines § Publication Date: November 7, 2013 § Effective Date: January 1, 2014 • Version 2.0 will remain active until December 31, 2014 § Deadline for New Requirements: June 30, 2015 11 © 2013 Imperva, Inc. All rights reserved. Confidential
- 12. What’s New? New Requirements Added in PCI-DSS 3.0 12 © 2013 Imperva, Inc. All rights reserved. Confidential
- 13. New Req. 6.5.6 Insecure handling of credit card and authentication data in memory. Compliance: • document how PAN/SAD is handled in memory to minimize exposure 13 © 2013 Imperva, Inc. All rights reserved. Confidential
- 14. New Req. 6.5.11 Broken authentication & session management. Compliance: • • • • 14 Flag session tokens Don’t expose session ID in URL Implement time-outs Prevent User ID manipulation © 2013 Imperva, Inc. All rights reserved. Confidential
- 15. New Req. 8.5.1 Service providers with access to customer environments must use a unique authentication credential for each customer Compliance: • Authentication policies and procedures to mandate different authentication is used to access each customer environment ** Only mandated for service providers 15 © 2013 Imperva, Inc. All rights reserved. Confidential
- 16. New Req. 9.9 Protect POS devices that capture payment card data from tampering Compliance: • Maintain a list of POS devices • Periodical inspection for tampering/substitution • Training for awareness Note: PCI-DSS now addresses skimmers. 16 © 2013 Imperva, Inc. All rights reserved. Confidential
- 17. New Req. 11.3 Develop penetration testing methodology based on industry guidelines like NIST Compliance: • Implement a penetration testing approach based on an industry standard (like NIST SP800-115) • Define pen-test for all layers • Specify retention and remediation activity 17 © 2013 Imperva, Inc. All rights reserved. Confidential
- 18. New Req. 12.9 Service providers must document in writing they will adhere to PCI DSS standards Compliance: • Acknowledge in writing to customers that service provider will maintain PCI DSS in full on behalf of the customer ** Only mandated for service providers 18 © 2013 Imperva, Inc. All rights reserved. Confidential
- 19. Web Application Compliance Using a WAF to Close the Compliance Gap 19 © 2013 Imperva, Inc. All rights reserved. Confidential
- 20. Web Application Relevant Requirements 20 © 2013 Imperva, Inc. All rights reserved. Confidential
- 21. [6.5.11] Broken Auth. & Session Mgmt. Authentication/Session attacks • • • • • • • 21 © 2013 Imperva, Inc. All rights reserved. Cookie Tampering Cookie Poisoning Session Hijacking Session Reuse Parameter Tampering SSL Reuse Brute Force Confidential
- 22. [11.3] Pen Testing and Remediation Source: http://www.imperva.com/docs/SB_Imperva_WhiteHat.pdf 22 © 2013 Imperva, Inc. All rights reserved. Confidential
- 23. PCI-DSS Carry-ons Req 6.6: Protect public-facing Web applications Req 10: Audit all access to cardholder data Req 7: Limit access to systems and data on a business need to know Req 8.5: Identify and disable dormant user accounts and access rights Req 11.5: Alert personnel to unauthorized modification of files Source: http://www.imperva.com/PCI/ 23 © 2013 Imperva, Inc. All rights reserved. Confidential
- 24. Learn More 24 © 2013 Imperva, Inc. All rights reserved. Confidential
- 25. PCI PCI-DSS Council http://www.pcisecuritystandards.org Imperva’s PCI Resource Center http://www.imperva.com/PCI/ 25 © 2013 Imperva, Inc. All rights reserved. Confidential
- 26. Skimmers KrebsOnSecurity http://krebsonsecurity.com/category/all-about-skimmers/ 26 © 2013 Imperva, Inc. All rights reserved. Confidential
- 27. Third-Party Breaches Imperva’s January 2013 HII and Imperva’s CMS Hacking Webinar http://www.imperva.com/resources/overview.html 27 © 2013 Imperva, Inc. All rights reserved. Confidential
- 28. www.imperva.com 28 © 2013 Imperva, Inc. All rights reserved. Confidential