[Music]
to improve is to change and to be
perfect is to change often to me this
really describes the ongoing struggle of
security you know we all want to be
perfectly secure but to some degree
Perfection and security are both
unachievable goals and so the best we
can do is to continue continue to change
and adapt and maybe in a way that is you
know
Perfection and so today we're going to
be talking about a big change at least
for anyone who works in payments or you
know payment acceptance and that's pcss
4.0 it's here now
what so before we dig in who knows what
PCI
is who who doesn't know what PCI is
is who pretends not to know what PCI is
so that they don't have to work on PCI
assessments well I'm Kyle hinterberg and
11 or 12 years ago I had no idea what
PCI was I was a CIS admin at an
e-commerce company and one year a bank
came to us and said hey you have to do
PCI right or you're going to face the
consequences and so they said part of
this is someone has to go become a PCI
Isa or an internal security assessor and
so that was me I volunteered you know I
was new to security thought I'll do that
and I volunteered and now here I am and
so let that be a lesson to anyone
volunteering for
anything I was an Isa for a while I
eventually changed over to the other
side of the table became a consultant
and a qsa or qualified security assessor
which just basically means I can do PCI
assessments for other people but all
that's kind of boring so if you want to
remember two things about me I got
awesome dogs that's Ace Oakley and
Apollo this is the newest member of of
the pack
Artemis and I'm a qsa but I'm not your
qsa so if you have any questions I'd
love to talk through them but ultimately
your compliance is really going to be
determined by you your qsa and your
bank so for what PCI is you know it's
it's the payment card industry a number
of years ago the the major credit card
Brands they got together Visa Mastercard
Discover American Express and JCB they
decided they wanted rules for how to
govern credit card and credit card
information and so they created the
PCI security standards Council or PCI
ssse that security standards Council has
made a number of Standards over the
years but the main one is the DSs or the
data security standard and basically
it's the rule book for how you have to
handle credit card information
specifically if you're a merchant or
service
provider and the the DSs it's went
through a number of revisions over the
years it came out back in 2004 um since
then it moved up in 2018 when the most
current version that most people are
following 321 came out but last year was
the big shakeup 4.0 was released but
whenever a new standard comes out you're
not forced to jump right over to it so
you do have some transition time which
is where most people are still in that
version 321 because with version 4 all
the requirements were renumbered
reorganized and updated and you know it
was a a big number
change and so as you can see here this
is kind of the transition period people
have until April 1st 2024 that's the the
deadline by April 1st 2024 that's when
everyone's going to have to start
assessing against version 4 but even at
that point you still have a bit of a
transition period because there's a
number of new requirements 64 new
requirements that get got introduced in
this standard and so those new
requirements the vast majority aren't
going to be required until April 1st
2025 until then they're just best
practices so whenever you're thinking
about PCI DSS version 4 those are the
two big dates to keep in mind April 1st
2024 that's when you need to assess
against it April 1st 2025 that's when
all the requirements are going to be in
effect so what exactly is new in 4.0 you
know and the the honest truth is a whole
lot there's more than we can talk about
in the time we have today so we're just
going to hit some of the highlights and
then talk about some of those big ticket
items the things that you should be
working on well ahead of 2025 if you
want to have a hope of you know being
compliant when you need to
be so to talk through some of the the
highlights you know some of my favorite
points one of them is you know if you
look at the current version and past
versions of the DSs it talked about
firewall rule sets router rule sets but
a lot of people got confused on these
because nowadays in Cloud environments
and other you know software network
controls it made firewalls a little bit
outdated so that term's been ditched now
it's the network security controls that
the requirements themselves elves are
basically the same as they have been
it's just network security controls
instead of firewalls or
routers um the next one here requirement
5.3.2 now allows you to use anti-
malware to perform um continuous
behavioral checks instead of doing scans
you know in the past you had to do
regular scans now you can do you know
more modern EDR without having to have a
compensating control to allow you to get
by with
that requirement
8.2.2 this one
um allows you to be compliant even when
you're using a shared account and so
really what this one does for you is
everyone here has break glass accounts
on network environment you always are
going to have your Brak glass admin
account for your firewall those are
non-compliant there's no real way around
it those are are technically
non-compliant even though everyone does
it this allows an option to finally make
that compliant because they realize
everyone does it regardless of what they
want you to do
83.9 is probably going to be most
people's favorite it allows you to get
rid of password rotation historically
you know PCI always wants you to do that
90-day password rotation now if you're
using a password as part of an MFA
solution or if you're doing you know
posture analysis of your accounts try to
figure out if there's something you know
all of a sudden Bob is logging in from
Russia those types of things if you
employ those types of Security Solutions
you can ditch password
rotation 1144 is probably my favorite it
allows you to determine what pen
penetration test vulnerabilities you
need to remediate if you look at the
current version 321 it just says
anything exploitable needs to be
remediated which is kind of vague but
now in 1144 the new requirement in 4.0
it says that you know companies just
need to follow their own risk
remediation standards so they determine
you know hey this is a high we need to
fix it in 90 days Etc as long as they're
doing that they're compliant
and last but not least Enterprise risk
assessments are gone this has always
been one that's been a little bit tricky
because the scope of what you actually
had to cover in these risk assessments
was never quite clear and so now there
is no longer an Enterprise risk
assessment requirement there's just
certain requirements have smaller
specific targeted risk analyses that
need to be
performed so anyone who's familiar with
Ford ATO might say hey why didn't you
have the customized approach in that
list and it's because in my opinion the
customized approach is getting overhyped
it's you know cool it's nice but at the
end of the day I don't really see a lot
of people are going to use it and I
don't really think a lot of people
should use it and so if you're not
familiar in PCI 4.0 you're going to have
two options whenever you're assessing
most requirements either you can take
the defined approach which is just
following the rule as it's written doing
what the data security standard says and
that's how you're implementing that
control or you can make your own control
completely custom you can write it up
yourself say hey we're going to do X Y
and Z and that's how we're going to to
meet this objective and so each
requirement that allows us will have an
objective and you can choose to meet
that however you like and as long as
it's valid and your assessor allows you
to do it that's fine but again this
isn't going to be like a a quick win or
a way to cheat the system it's going to
require more work and generally speaking
it's not really something people should
worry about to kind of explain it you
know if you have the objective that you
need to get to work most people are
going to follow the defined you know way
to do that and they're going to drive to
work but some people might own a jetpack
and so they're going to fly to work and
that covers them and they're still
meeting that objective but again if
you're an organization you're looking
through these controls you should just
follow the defined approach unless
you're reading through one and you
realize you have that metaphorical
jetpack and one other thing to to keep
in mind with these is that um the
compensating control or the idea of a
compensating control hasn't went away
that still exists and for anyone who
isn't familiar a compensating control is
what you can do if you get to a
requirement that you need to follow and
you have a legitimate business or
technical constraint that prevents you
from meeting that control you can
Implement a compensating control
basically document menting some
mitigating factors you can still do that
and it's different from a custom control
compensating control should only be used
when you have a legitimate business or
technical constraint um customized
approaches custom controls should be
used when you have a new or better way
to do things and as a last note on them
if you do take that custom approach you
can't use a compensating control on your
custom approach if you went through the
pro trouble of making your own
requirement you should be able to follow
it without any
help so to shift gears now we'll talk
through some of those items that are
more or less Big Ticket ones the ones
that I'd recommend organizations to
start working on right away so that way
they're in place in time and the first
one is you know scope reviews
historically organizations have not had
a hard and fast requirement to do a PCI
I scope review it's always been assumed
there are requirements for things like
diagrams and inventories but there
wasn't a specific requirement for
scoping but that's no longer the case
now you are going to have to perform
your own scope review document your
scope and that'll be evidence that
you'll need to provide to your qsa when
you do your your first Ford AO
assessment this is one of those new
requirements that comes into play
immediately so when you do your first
ford. assessment your qsa will expect to
be reviewing your scope validation
documentation and if you don't have it
or it's insufficient you know that
potentially opens you up to
non-compliance and you know this is
something you need to do at least
annually unless you're a service
provider in that case you have to do it
twice a year and there's even additional
requirements that are having you know
really taking a harder look at some of
the documentation and really making sure
you're understanding your own
environment doing things like forcing
you to look at your keys and
certificates hardware and software user
and systems accounts you know Cipher
Suites really documenting a lot of the
different controls in your environment
so that way again you actually know
what's there not just relying on your
qsa to tell you what's in
scope as a note on timing this is going
to be the only one we're talking about
that comes into effect immediately the
other new requirements that come into
effect immediately are really um
primarily policy and procedure updates
so the rest of the ones we're going to
jump into here are all ones that will be
best practices until April 1
2025 anyone who's familiar with PCI will
see that they you know consistently have
been pushing more MFA trying to get MFA
all over the place and so this is just
continuing that now you are going to
have to use MFA whenever you're signing
into a CDE system and the CDE that's the
card holder data environment really a
CDE system is anything that stores
processes or transmits credit card
information or any system that isn't
segmented from A system that stores
processes or transmits so this means
even if you're sitting in your corporate
office on your corporate workstation if
you go to sign sign into a CDE system
you'll have to use MFA for that
authentication and there still is the
requirement that you need to use MFA for
remote access so if you are sitting at
home and you VPN in and then sign into a
CDE system when you do the VPN you'll
have to authenticate with MFA then when
you do the access into that CTE system
you'll have to use MFA again they can
use the same MFA solution you know both
could be OCTA or dual or whatever but
you need separate hits for both steps
back in 2015 we had the first EMV
liability shift and what that meant is
it really was pushing organizations to
start accepting chipped credit cards you
know and nowadays basically all of us
all the cards that you use have chips in
them and what that is done has made it a
lot harder for people to steal credit
card information during face-to-face
transactions but the the downside to
that is that it's pushed a lot of those
you know malicious people online and if
you've been paying attention to the the
the news you know in the last several
years there's been a lot of breaches due
to you know Mage cart style attacks
people siphoning data off of payment
pages and that was one of the major
pushes in Ford Ido is to start locking
down payment pages so there's some
specific requirements around that you
know as you can see here the one looking
at payment page scripts making sure that
you know all the scripts that are
running on your payment Pages you can
justify why they're there you can
validate their integrity and make sure
they're not changing when you don't
expect them to change this is one where
my recommendation to everyone is just to
look at all the scripts and if you don't
need a script running on your payment
page get rid of it you might have to
fight with your marketing department but
odds are it's not that big of a deal to
pull a script off of your payment page
you can keep them everywhere else just
don't have more credit card
information's coming in you know you're
also going to have to put in change and
tamper detection mechanisms again this
is looking at the um the headers and the
htpt content you know kind of making
sure that what is getting presented to
someone entering credit card information
is is exactly what you expect it to be
and that it's not being modified unless
you want it to be
modified requirement 541 in my opinion
is kind of a radical shift for the DSs
because it's requiring you to put in
anti- fishing protections on your email
solution or you know however you're
receiving emails and the reason this is
a little bit different for PCI is that
that email solution isn't generally
going to be in scope odds are your
emails aren't in scope for PCI or you're
probably doing something wrong and so
the requirement even stipulates that
just because they're making you do this
does not bring your email solution into
scope but you are going to have to have
something you know a lot of people might
have like a mcast or a proof point or
something protecting your users already
and that's what they're looking for
because similar to the the issue with
those Mage card attacks they realize one
of the biggest ways that people get into
an organization is through fishing and
even if you have segmentation in place
odds are if someone breaks into your
network it's just a matter of time until
they find you know your CDE get access
to your sensitive
information in the you know the the
current version kind of or the the last
version of 321 requirement 6.6 was one
of the few that gave you kind of an
either or you could either do web
application vulnerability assessments or
you could Implement a web application
firewall you know a wff or something
similar to that going forward with 4.0
this option is being removed and you're
going to have to implement a w that's
the only option you'll have web
application security assessments are
still a great thing still something you
should consider to keep in your you know
your development and your vulnerability
Management Programs but you are going to
have to have a w this is where the secs
has just determined that you need that
247
protection and in a somewhat similar
situation you know organizations have
always had to perform daily log reviews
but the the issue was it was never
really called out how they had to do
those reviews and so it's always been
been technically um compliant to perform
manual log reviews but anyone who's ever
played with logs knows that if you have
like more than two systems you can't
actually do manual log reviews it just
becomes completely unfeasible and so now
in 4.0 you are going to have to have
some type of an automated solution
something like a Sim that is re you know
looking at all those logs and generating
actionable alerts so that way people can
actually do this and let the you know
those tools do what they're meant to
do service providers you know in the PCI
world you know organizations that are
helping Merchants those service
providers have had to look at
critical um critical security system
control failures for a while had to
detect them and alert on them but now
Merchants are going to have to do this
too so basically any organization that
has to you know be be compliant has to
look at these critical security controls
and then determine if they failed and
this is one that if you think about it
it can be a little bit weird you know
what does it really mean so the easy
easiest way to think about is just
determine what your critical security
control systems are things like
firewalls physical access control your
anti- malware solution and then if they
failed how would they fail and would you
have any clue that it happened if this
is something you don't really have in
place from a security perspective odds
are your best bet is to talk to some of
your you know infrastructure Engineers
your system admins they likely already
have things that are you know monitoring
for uptime monitoring for system usage
those are the exactly the types of tools
that you're going to want to use and
should get you most if not all the way
there for this
one quarterly internal scans have been
something that have had to happen for a
long time but now with PCI 4.0 you are
going to have to do authenticated
vulnerability scans you know and the
honest truth is most organizations avoid
these even though authenticated scans
can provide better information they also
tend to provide a lot more findings and
so they get to be a lot more unruly to
handle so with that in mind my
recommendation is to start doing you
know keep doing those unauthenticated if
you are but start doing authenticated
scans as well use those unauthenticated
scans to support your compliance for the
time being and then when we get to you
know April 1st 2025 and you need to
start doing those authenticated ones
hopefully you've already whittel down
those findings and you're good to go and
can continue with doing those
scans um a couple notes first of all
this is only on the internal side
external vulnerability scans you know
those quarterly ones they're still
required but they have to come through
an ASV and approved scanning vendor just
the same as before no no big changes
there but the S has laid out strict
requirements over timing this is
something where you know people forever
have tried to fight with words like
quarterly and say hey I ran a scan in
December and another scan in January so
that covers me for you know two quarters
and that's not the way it works so now
you know quarterly being solidly defined
it means every 90 to 92 days or on the
nth day of every third month and they
have similar definitions for what daily
means what annual means all of those
have very hard definitions so if you you
know looking at those requirements that
have to happen on a schedule you need to
make sure you're hitting that schedule
or again potentially face
non-compliance and so kind of to Circle
back to where we started you know what
should we do now that Ford ad is out
start working on our scope review and
validation processes
put MFA on all the things start
reviewing and securing our payment
Pages protect our users from fishing
emails wh it
up Implement a Sim or a similar
solution detect and address critical
security control system
failures and start performing
authenticated internal vulnerability
scans some of these items may require
some big changes but you know I hope you
all feel at least a little motivated to
trying to achieve protection through
continued
change and with that I thank you all for
your time I think I have time for a few
questions if anyone has
any
cbody
yes do you your card
anywhere I make sure to change it
regularly
any other
questions to a degree you know some of
them are one to one and like for most of
the requirements that stayed the same
they're they're renumbered but it's
still there you know like right now if
you're compliant to the current version
you're going to be compliant for the
most part when 4.0 comes out other than
some of these new ones like doing the
authenticated scans and then you know
like the the current requirement is
still in the DSs and that one will just
be phased out so I would expect you know
come you know 2025 there'll be version
4.1 that I'll just get rid of those and
streamline it a little bit
more any other
questions
to a good degree it's still does exist
and that's where now there's you know
like there used to be skimmers now it's
more so shimmers and so they that still
exists and it's it's much more difficult
but it's not impossible and I know that
you know like now there's EMV 2.0 and
you know moving that up that is making
it harder to do that and so it's removed
it a lot but that's where even today you
know half the gas stations you go to
they're still not EMV compliant the
majority of gas pumps out there still
have to use Swipe cards because it's
just too expensive for them to bother
making everything um IP you know that's
what they have to right now if you don't
know most gas pumps still use serial
connections and that's where they just
use the old swipes and to be able to get
EMV compliant they have to run you know
IP connections out to them and
completely redo their networking which
is where most gas pumps still run on non
EMV technology and that's the biggest
area right now for at least in the
United States for you know theft and
that's where you find tons of
skimmers any other
questions if not I think you all for
your
[Applause]
time