Thursday, July 15, 2010
dean.jpgUsed to be a QSA (Qualified Security Assessor). There are now 8 in NZ.

The QSA wears the risk and signs you off for PCI compliance.

There are no silver bullets for PCI stuff.

"It's a hell of a roller-coaster ride"

He has seen 2.5 million credit card numbers in NZ, in the clear, in many website databases.

One guy Albert Gonzalez compromised 170 million credit cards across many large corporations.

PCI requirements:

"Protect stored data": 79% of orgs fail on this.

PAN (account data) must be unreadable when stored.

You can never store mag stripe data.

"Track and monitor all access to network resources and cardholder data"

"Develop and maintain secure systems and applications" - 56% of organisations fail on this


1. Card holder data gets everywhere

2. Keep test and development environments out of scope. Don't use real live data in them.

3. The good: payment gateways and companies that handle cards - they do a good job. They outsource to experts.

The bad: small merchants with a few transactions. Cheap website with cheap hosting. Easily compromised.

The ugly: corporates. Great staff but don't make any progress.

If you're a merchant: find a compliant service provider.

4. If your a service provider: code well, make a noise about it. Make your solutions easy to assess for compliance. Keep in touch with your acquiring bank.

5. You need to evolve your security to address risks. You are allowed to exceed PCI standards.

6. New VISA best practices: you don't need to store the PAN any more, rely on your service provider to do it.

7. Do it properly, or don't use credit cards. Support your developers and give them training.

8. Storage of card data: Challenge it - why does the business need it? Get rid of old cards if you don't need them.

9. Checkbox security - don't just check the boxes. Exceed them.

10. OWASP top 10 - adopted by PCI DSS.

Two most useful links:

Parting thoughts:

- Use OWASP as a tool

- Don't confuse compliance and standards with security

- Chop up your credit cards!


Why did you give up being a QSA?

It was really stressful

When collecting info and passing it on to a payment gateway, do you require an audit?

Different QSAs treat it differently. He believes the webserver is in scope if it's taking the card data. New version of standard coming out in October that may address in-memory stuff.

Why stop using credit cards? At least you get protection, unlike if you use debit cards?

Dean uses a low-value debit card.

How does PCI deal with it if you're using third-party libraries?

Payment application DSS will kick in if you're using it to resell.

Comments are closed.