Payment card industry data security standard
- 1. Payment Card Industry Data Security StandardBy: Sally ChiuACC 626 Section 002
- 2. What is PCI DSS?Is it effective?Impact on the auditing professionOverview
- 3. “Payment Card Industry Data Security Standard”industry-wide framework for developing a robust payment card data security processaims to protect cardholder data What is PCI DSS?
- 4. response to the growing misuse of payment card informationPayment Card Industry (PCI) Security Standards Council - 5 global payment card companies: American Express, Discover, JCB International, MasterCard, and Visaapplies to entities that store, process or transmit cardholder information Retailers, on-line merchants, payment processing companiesHistory and Origins
- 5. 6 principles, 12 major requirements, many sub-requirements and detailed requirements, and testing procedures 6 objectives:Build and Maintain a Secure NetworkProtect Cardholder DataMaintain a Vulnerability Management ProgramImplement Strong Access Control MeasuresRegularly Monitor and Test NetworksMaintain an Information Security PolicyComponents of PCI DSS:
- 6. PCI Security Standards Council sets the overall high level requirementseach card issuer enforces the standard, sets validation requirements and penaltiesdifferent merchant / service provider levels, and requirements for each levelEg: Level 1 – merchants with 6M+ transactions annually most stringent requirements ASV scans, QSA auditsmost recent version - PCI DSS v.2.0continuously updated to as new threats emergePCI DSS Logistics
- 7. Is PCI DSS Effective?Effectiveness of PCI DSS2011Ponemon Institute & Imperva study:64% of compliant firms had no breaches over the past two years, vs only 38% of non-compliant firms 2011 Cisco study:70% feel that their organizations are more secure 87% feel that PCI compliance is necessary60% are using PCI compliance to drive other security network projectsappears that most organizations regard PCI DSS as an effective tool in improving cardholder security
- 8. Ineffectiveness of PCI DSSPCI DSS compliant firms still experience security breachesEg: Hannaford Bros, breach in 2008: theft of 4.2 million customer card numbers Eg: Heartland Payment Systems, breach in 2008: 130 million credit card numbers exposedCritics: PCI DSS ineffective as it has failed to prevent data breach incidents Is PCI DSS Effective?
- 9. Is PCI DSS Effective?Ineffectiveness of PCI DSSdeveloped by card companies to shift blame to retailers rather than actually preventing cybercrimelack of standardizationhigh cost of compliance - $3.8M implementation cost for Level 1 merchantsExecutives see PCI DSS as a burden, not an investment ROI unknown
- 10. PCI DSS: Effective guideline, but does not guarantee security Breaches of PCI DSS compliant firms show that even compliance does not guarantee protection against security breachesPCI DSS - only a framework for protecting cardholder data – will not 100% guarantee securityEffective from aspect of laying the groundwork for a secure systemForces entities to be continuously compliant
- 11. Canadians are among the most frequent users of debit and credit cards Canada seen as vulnerable to hackers and data thieves due to:lack of strong Canadian privacy legislation inadequate IS security at Canadian SMEslag in adopting Chip & PIN technology on credit cards Canada has relied upon PCI DSS to improve cardholder data securityPCI DSS and Canada
- 12. Impact of PCI DSS on the Accounting Professionopens numerous opportunities for the accounting profession CAs can act as consultants to businesses CAs can act as QSAs to assess PCI DSS complianceCAs can work together with the PCI to achieve greater protection of cardholder data
- 13. Impact of PCI DSS on the Accounting ProfessionCAs acting as QSAs can offer integrated services to clients PCI compliance & S. 5970 audit efficiencies can be gainedHowever, should be aware of differences:FrameworkTesting periodScope
- 14. PCI DSS is a critical step towards improving the security of cardholder data in Canada and worldwidepresents new opportunities for the accounting professionConclusion