Reducing cardholder data footprint with tokenization and other techniques
1 like52 views
This webinar discusses techniques for reducing an organization's cardholder data footprint to simplify PCI DSS compliance. It covers tokenization, which replaces sensitive card data with random tokens that have no value. Tokenization stores the original data in a secure vault and allows transactions to use tokens instead of real card numbers, reducing the scope of systems and data in scope for PCI compliance. Other techniques discussed include network segmentation, point-to-point encryption, and outsourcing services to PCI-compliant vendors. Reducing an organization's cardholder data footprint lowers the cost and effort of compliance while also preventing data breaches and theft.
Reducing cardholder data footprint with tokenization and other techniques
- 1. Reducing Cardholder Data Footprint with Tokenization and other Techniques
- 2. Webinar Objective • Understanding the PCI DSS Compliance and its Requirements. • How Businesses can Reduce their Compliance Scope with Reduced Cardholder Data Footprint? • Learn About the various Techniques of Reducing the Cardholder Data Footprint
- 3. Topics Covered • A Quick Introduction to PCI DSS Compliance • PCI DSS Scoping Requirements • Top 4 Techniques for reducing Cardholder Data footprint in your enterprise • What is Tokenization? • Process of Tokenization • How Does Tokenization Reduce Card Data Footprint?
- 4. Gain CPE Points Attending the Webinar! • Attend the entire session of the Webinar and gain Continued Professional Education points. • It can be used for various certification such as CISA, CISSP, CRISC, CISM, PCI QSA, etc.
- 5. Free Informative Resources • Subscribe to our YouTube channel: https://www.youtube.com/c/vistainfosecofficial • Get access to free informative videos on • PCI DSS • HIPAA • GDPR • SOC1 & SOC2 • Ethical Hacking
- 6. PAST WEBINARS • PCI DSS - Managing your outsourced vendor. • Log Management and reporting for the PCI environment. • Best practices in Ecommerce security. • PCI DSS and the Cloud – Top risks and Mitigations • Wireless in the PCI environment – Top risks and Mitigations • PCI DSS in the virtualized environment – Top risks and Mitigations • Targeted attacks: Spear Phishing and Social Engineering. • PCI DSS Scoping and Segmentation. • Managing Data Leakage in your PCI environment. • Strategies for migration from early TLS and SSL. • Using PCI DSS for GDPR Compliance
- 7. PAST WEBINARS • Using ISO27001 for PCI DSS • SOC2 and YOU • GDPR – Are you ready • SOC2 – Beyond the myth • GDPR – Steps to a successful DPIA • Block chain – A crash course – What is it, potential uses and pitfalls • Tackling Security in the Cloud: CASB to the rescue • HIPAA – Basics and Beyond… • Using SOC2 for HIPAA Compliance • Developing a Cyber Security framework using NIST
- 8. PAST WEBINAR • SOC for Cyber Security • Rights of Data Subjects – GDPR and PDPA • SOC2 Compliance and the Cloud • Debunking Top 10 myths of PCI DSS • Achieving PCI DSS in 90 days • FDA CFR Part 11 – What’s the hype all about • Achieving SOC2 Compliance in 90 days – Is it possible? • Step by step approach to PDPA compliance • 7 steps for Compliance with NIST 800-171 compliance • PCI DSS - 5 Simple Techniques to reduce scope
- 9. PAST WEBINAR • SOC2 and CCM • In talks with Nitin Bhatnagar (PCI Council) - Meeting Payment Security Needs Now and for the Future • Covid-19 and Business Continuity • PA DSS and PCI SSF – How they match up and how they map • PCI PIN, PCI Cryptography & Key Management • NESA – How it matters to you
- 10. As We Go Along • Do type in your queries in the query box and I will answer as much as possible during the webinar. If due to time constraints, I will surely write directly to you. • Feel free to share a topic of your interest that you would like to learn more about from our team ( Information Security- Compliance, Regulatory Standards, Risk Assessment Services related topic).
- 11. DE Couvertes It is not the answer that enlightens, but the question.
- 12. About Me NARENDRA SAHOO Mr. Sahoo carries over 25 years of experience in the IT industry, out of which the last 16 years has been dedicated to VISTA InfoSec. His professional qualifications includes PCI QSA, CISA, CISSP, CRISC, ISO 27001 Lead Assessor. Starting off as an assembly language programmer, with the advent of networking and the Internet in India, he moved on into networking and IT management of which InfoSec was a natural progression. A very well versed professional with proficiency in globally recognized standards such as ISO27001, PCI DSS, ITIL/ISO 20000, COBIT and many international regulations such as HIPAA, CSV, SOX, SSAE16, SOC, etc., Mr. Sahoo has conducted IT consulting and assessments for large Banks, Software development organizations, Banks, Research & Development companies and BPOs in India and overseas. Well versed with strategy development and an astute Technical background, he has audited, designed and strategized for a wide variety of Information security and networking technologies. He has provided consulting services for premier organizations such as Tata Group, Shell Oil, Cipla, numerous payment processing organizations and a host of banks including the Reserve Bank of India and the Indian armed forces. He has recently been awarded the “Crest of Honor” by the Indian Navy for his contributions. He was inducted into the CSI – Hall of Fame for his significant contributions to the fraternity. Sectors: Worked in all vertical ranging from Government/PSU, BFSI, Pharma, Manufacturing, ITES etc. Designation - Founder & Director of VISTA InfoSec Certifications- PCI QPA, PCI QSA, CISSP, CISA, CRISC, ISO27001 LA Industry Experience-25 Years
- 17. Survey Participation Request We Value Your Feedback • Request you to complete our brief survey at the end of the webinar and leave your valuable comments. • Your Answer will allow us to meet your expectations better
- 18. PCI HISTORY • Late 90’s - Visa recognized a need to protect Card Data to prevent theft. • June, 2001 – Visa mandated rules to protect Card Data. • Later the other card associations followed Visa’s lead with their own programs.
- 19. PCI HISTORY The Four Programs Were Called: • Visa: CISP – Cardholder Information Security Program • MasterCard: SDP – Site Data Protection • American Express: DSOP - Data Security Operating Policy • Discover: DISC - Discover Information Security & Compliance
- 20. PCI History Once there were four programs • Confusion ensued • There were now four set of rules, guidelines, penalties and fines.
- 21. Solution
- 22. PCI History • Establishment of a Standard organization named Payment Card Industry Security Standards Council • Also Known As: PCI • The founding members were the five major card brands: • American Express • MasterCard • Discover • Visa • JCB (Japan Credit Bureau) • Primarily seen in Hawaii, California and other major T & E Markets in the USA
- 23. History in Brief • Visa, MasterCard, American Express, Discover and JCB decided to standardize on a common set of data security requirements for Merchants and Data Processors – the PCI Data Security Standard (PCI DSS). • PCI Security Standards Council was formed in 2004 as an independent organization in order to maintain and promote the PCI DSS. • Version 1.0 of the PCI DSS was published in January 2005. • Version 1.1 published in September 2006. • Version 1.2 released October 2008. • Latest version 4.0 expected to be released in mid 2021 this year.
- 24. PCI History • Not The Perfect Solution • The Good News • The security guidelines have been consolidated under a single entity – PCI DSS: Data Security Standard. • Your Compliance and IT staff will appreciate this. • The Bad News • Due to federal restraint of trade laws, the card brands can not collude on the rules, penalties and fines • So we must still please multiple masters. • For the most part, Visa’s rules are the most restrictive and therefore are used as the bellweather guideline.
- 25. The PCI Security Standards Council Members
- 26. PCI DSS Compliance Requirements
- 27. How can Cardholder Data & Environment be Secured? • Businesses falling in the scope of PCI DSS Compliance will have a significant impact on their resources (cost and manpower). • Any systems or applications that have access to sensitive card information whether encrypted or not shall fall in scope. • Enterprises looking for ways to simplify and reduce the scope of PCI DSS Compliance can possibly do so by reducing the Card Data footprints in their systems and applications. • Merchants and Service Providers are required to size and scope their Cardholder Data Environment to gauge the current risk exposure. • Scoping and analyzing the Cardholder Data Environment will indicate the likelihood of their business facing incidents of data breaches. • Depending on whether the Cardholder Data Environment (CDE) is minimal and adequately isolated or extensive, the systems, applications, and network accordingly fall in the scope of PCI DSS that needs to be secured.
- 28. What is Scoping and Segmentation S
- 29. Importance of Understanding Scoping & Segmentation • There are many interpretations of “adequate network segmentation” • Not all are accurate • There are many motivations for wanting to reduce scope • Not all motivations are in the best interests of security • Improper scoping choices are contributing to compromises • Cardholder data is still a very desirable target for hackers
- 30. Importance of Understanding Scoping & Segmentation • Bad interpretations and/or motivations can lead to- • Aggressive or accidental under-scoping. • Ineffective segmentation controls. • Which can have disastrous consequences such as- • Bad interpretations can also lead to unnecessary over-scoping. • Can result in ineffective allocation of security resources.
- 31. Scoping Confusion • What does “in scope” mean? • Every PCI DSS requirement may not apply to an in-scope system. Consider: • Requirements applicable for system function/use. • Requirements applied at network level rather than on every system. • Controls to reduce applicability of certain PCI DSS requirements (must be verified!). • What does “out of scope” mean? • Consider as ‘untrusted’. • No security evaluation or validation of the system/network. • If an “out-of-scope” system could lead a CDE compromise, it should not have been considered out of scope.
- 32. What is Scoping? Scoping involves the identification of people, processes, and technologies that interact with OR could otherwise impact the security of CHD.
- 33. Scoping Concepts • Systems located within the CDE are in scope, irrespective of their functionality or the reason why they are in the CDE. • Similarly, systems that connect to a system in the CDE are in scope, irrespective of their functionality or the reason they have connectivity to the CDE. • In a flat network, all systems are in scope if any single system stores, processes, or transmits account data.
- 34. Scope of PCI DSS
- 35. How To Scope?
- 36. PCI DSS Scoping • PCI DSS applies to all systems and networks that store, process, and/or transmit cardholder data, and all connected systems including- • Networking equipment that transmits cardholder data (i.e. routers, switches, firewalls, wireless access points). • Encrypted Cardholder Data which still falls in scope.
- 38. Compliance Scope
- 39. Scope of PCI DSS • If your shop handles financial card data: • PCI DSS requirements are applicable if a Primary Account Number (PAN) is stored, processed or transmitted. • PCI DSS security requirements apply to all “system components” – defined as “any network component, server or application that is included in or connected to the cardholder data environment”. • Failure to comply will eventually result in surcharges, fines and substantially increased liability in the event of a data breach. • If a PAN is not stored, processed or transmitted then PCI DSS requirements do not apply.
- 40. Reducing Card Footprint What is it all about??
- 41. How to Reduce the Scope or Cardholder Data Footprint in the Environment? • Complex IT-environment can make it more costly and difficult for Merchants & Service Providers to achieve and maintain PCI Compliance. • For these reason, once they have identified what systems are in scope, they should try to reduce their scope by limiting the Cardholder Data Footprint in the Environment. • While it is impossible to completely eliminate or reduce the Cardholder Data footprint, but there are methods that considerably reduce and simplify PCI scope.
- 42. Techniques of Reducing Cardholder Data Footprint Reducing Cardholder Data Footprint Network Segmentation Point-to-Point- Encryption Tokenization Outsourcing
- 43. Techniques of Reducing Cardholder Data Footprint • Network Segmentation- Network segmentation involves isolating the Cardholder Data Environment from the rest of the company’s network. This prevent systems that are out- of-scope from communicating with, or impact the security of systems in the Cardholder Data Environment. (Refer to our earlier webinar on PCI DSS Scoping & Network to learn more about it) • Tokenization- Tokenization is the process of converting sensitive data or replacing cardholder data with a random-generated value called a token. Implementing this process helps secure sensitive data and reduce the scope of Compliance as no card will reside in the Cardholder Data Environment with the tokenized data flowing through your systems.
- 44. Techniques of Reducing Cardholder Data Footprint • Point-to-Point Encryption- P2PE involves encrypting the Payment Card Data at point of interaction when swiping Payment Card, until the point that it reaches the decryption environment. The data is indecipherable during the transaction process and protects the data against hacking, theft and fraud. Merchants who implement P2PE solutions are subject to fewer PCI requirements. • Outsourcing- Outsourcing is always a good option provided you outsource it to the right vendors. By right vendors we mean, PCI compliant vendors. This will definitely help reduce your PCI scope and Card Data footprint. By opting a PCI Compliant solution or simply moving to a PCI DSS compliant cloud-hosting platform, you will automatically reduce the scope of compliance. Outsourcing in general can reduce costs related to compliance, and also minimize efforts required to meet the requirements in PCI DSS. However, it important that we evaluate the security levels and compliance status of the third-party vendors before considering as an outsourcing option.
- 45. What is Tokenization? • Tokenization can be referred to as the process of replacing a credit card number with an alternate set of characters, or elements that have no significant value. • It is a technique that involves replacing sensitive data with non-sensitive elements or numbers that are randomly generated and known as a token. • It is a unique process of protecting sensitive data while retaining all the relevant information without compromising its security. • Tokenization works on the principles of devaluing the sensitive data such as to make it unviable for the hackers to breach the data defenses. • The entire Tokenization process is very different from encryption, wherein it does not allow the token to be deciphered and reveal the sensitive data that is processed.
- 46. Process of Payment Card Tokenization
- 47. How Does Tokenization Card Data Footprint? • Secure Data Vault- The technique of Tokenization involves replacing of sensitive payment card data with a token and storing the original data in a highly secure centralized data vault. With this, the sensitive data is not accessible outside of the data vault, except when originally captured at the beginning of a transaction or, later, accessed from the data vault by an authorized user or an authenticated application. This completely draws out the risk of sensitive data exposure in the payment card environment. So, organizations can reduce the number of systems, applications and processes that are directly exposed to the sensitive data and in turn reduce the overall scope for compliance with PCI DSS. • Data Surrogates- In the process of tokenization, a token is used as a replacement or as a surrogate value to the original sensitive data. The token represents the original data, which is encrypted and stored in a central data vault. So, in the process, the application does not contain any credit card information including the data in an encrypted format. This in turn reduces the Cardholder Data footprint and enables the entire application in this scenario falls out of the PCI DSS scope.
- 48. How Does Tokenization Reduce Card Data Footprint? • Data Relation Token- Tokenization facilitates a one-to-one data relation token between the credit card number and the token to maintain referential integrity across systems. The referential integrity allows for a transaction analysis with tokens, thus eliminating the need of accessing the sensitive credit card number directly. This helps remove the sensitive card data out of the environment, thus reducing the card data footprint and the PCI scope. • Tokens Have No Value- Tokens are replaced alternate set of characters, or elements that have no significant value. So, they can be easily transmitted across the networks and applications without having the original sensitive data in the environment. The original data on the other hand is securely stored in a central data vault, outside the Cardholder Data environment with access only limited to the authorized applications for retrieving it. This way the footprint of sensitive data is reduced in the environment while also the need to secure and monitor it frequently is reduced.
- 49. Key Takeaway • Reducing the Cardholder Data footprint in the environment is crucial for it helps reduce the scope of Compliance. • With less sensitive data, it translates into fewer compliance requirements which may in turn enable quicker audits. • Not just that, reducing Cardholder Data Footprint in the environment will in a way also prevent incidents of data breach or theft. • Apart from the above mentioned significant reasons, reducing the Cardholder Data footprint in the environment also lowers the cost of compliance and the required resources for achieving compliance.
- 50. THANK YOU FOR SHARING YOUR VALUABLE TIME
- 51. GENTLE REMINDER ABOUT THE SURVEY PLEASE SHARE YOUR VALUABLE FEEDBACK YOUR OPINION IS IMPORTANT FOR US