Pci-Dss V 3.2.1 Qsa Revision

Front 1

MNEMONIC FOR all requirements

Back 1

IDPEPDRIRTRM -install, do not, protect, encrypt, protect from malware, secure systems, restrict, track, regularly test and maintain infosec policy.

Front 2

What is requirement 3

Back 2

Protect stored cardholder data i.e. if must store it then protect it!

Front 3

requirement 3.1 is about retention periods and deleting exceeded retention periods by doing what?

Back 3

Limit cardholder data to a minimum by utilising a retention and disposal policy, adopt a quarterly process for identifying and deleting exceeded retention period.

Front 4

requirement 3.2 is about not storing what?

Back 4

Do not store SAD after authentication, or CVV, track, PIN

Front 5

requirement 3.3 masking pan when displayed. How many numbers are allowed

Back 5

Mask Pan when displayed, first six last 4 max allowed visible

Front 6

requirement 3.4 is about rendering PAN unreadable when stored - how can this be achieved?

Back 6

Render PAN unreadable - one way hash, truncation or tokens pad, use strong crypto. Disk encryption - access control via seperate authentication mechanism

Front 7

requirement 3.5 is about documenting and implementing procedures to protect keys for stored data including key encrypting keys. What strength mus they be?

Back 7

Protect against disclosure and misuse. Includes algorithms, protocols, custodians, secret and private key storage, HSM, PTS POI, store in fewest locations. Key encrypting keys must be as strong as the data encrypting key they are protecting.

Front 8

requirement 3.6 is about key management - what specifically?

Back 8

Fully document all key mgmt processes, strong keys, secure distribution, storage, end of life, retirement, split knowledge, dual control, prevent substitution, custodian acknowledge of responsibilities.

Front 9

What is requirement 4?

Back 9

if you must send chd then encrypt it!

Strong crypto, never unprotected pans

Front 10

requirement 4.1 is about transmission encryption - what should you use?

Back 10

Use strong crypto and security protocols to safeguard SAD during transmission over wireless, GSM, GPRS and extra requirements Appendix A2 for SSL/TLS

No SSL3 and No WEP

Front 11

Require 4.2 is about sending PANs over messaging technologies. What must we do?

Back 11

Never send unprotected PANS by end user messaging technologies- its so easy to intercept them!

Front 12

what is Requirement 5

Back 12

Protect all systems against malware and regularly update AV or programs i.e. protect yourself against malware and other attacks

Front 13

requirement 5.1 is about ensuring what kind of systems have anti virus?

Back 13

Deploy AV on all systems commonly affected, make sure its capable, systems not commonly affected must be periodically evaluated,

Front 14

requirement 5.2 - what must the AV be and do?

Back 14

AV must be current, periodically scan and generate audit logs per 10.7

Front 15

requirement 5.3 - how should AV be configured

Back 15

AV must be current, actively running and generating audit logs. Ensure logging cant be disabled by users

Front 16

what is Requirement 6

Back 16

Develop and maintain secure systems and applications i.e build software properly and securely

Front 17

requirement 6.1 is about rating what?

Back 17

Establish a process to identify vulns using rankings like CVSS

Front 18

requirement 6.2 is about patch management - how often

Back 18

Ensure components are software is protected by installing patches according to ranking (6.1) and with 30 days

Front 19

requirement 6.3 is about custom code - how should it be developed?

Back 19

Develop apps according to industry best practice, remove dev & test accounts, review custom code to identify coding vulns

Front 20

requirement 6.4 is about the change management process - what should it be like?

Back 20

Follow change control processes, seperate dev & test environments, seperation of duties, no live PANs, remove test data before go live. Change control procedures must - document impact, document authorisation, details of functionality testing and the back out procedure. Finally validate change - does it meet all 12 requirements?

Front 21

requirement 6.5 is about ensuring developers are trained in secure coding techniques - such as?

Back 21

Address common coding vulns, give developers annual training, develop best practice OWASP. Address injection flaws, buffer overflow, crypto storage, comms, error handling, ranking of high risk vulns (6.1) XSS, access control, CSRF and session management.

Front 22

requirement 6.6 What about public facing web apps?

Back 22

For public facing web apps use WAF in front

Front 23

Mnemonic for Requirement 7

Back 23

Keep access to a minimum

Restrict/Limit NTK, Deny all, SecPol

Front 24

Requirement 7 is about what?

Back 24

Restrict Access to card holder data by busines need-to-know

Front 25

requirement 7.1 access control policies

Back 25

Limit access to RBAC, principle of least privilege, job function and documented authorisation

confirm access rights and controls for privileged users

Front 26

What is requirement 7.2 access control

Back 26

Establish access control restricted to those who ntk with permissions set to deny all. Included system components, rbac and deny all default setting.

Confirm access controls default with 'deny-all'.

Front 27

What is requirement 8

Back 27

Make sure people are who they say they are!

Identify and authenticate access to system components

Front 28

Mnemonic for Requirement 8

Back 28

IAM Process , UID & Authentication, Comms & Guidance, Tokens, DB's, SecPol

Front 29

requirement 8.1 - verify all users have a unique id - how?

Back 29

Define process for proper user and admin identification management. Ensure unique id, cover adds, mods, deletions, revocation, disable inactives (90 days) lockout 6 times duration 30 mins, idle 15.

Front 30

requirement 8.2 what else is needed in addtion to a unique uid?

Back 30

In addition to unique UID must use at least one - something you know, have or are (pwd, token, biometric)

Front 31

requirement 8.2.1-6 verify authentication how and when should it change?

Back 31

Ensure access control process ensures - Encrypt auth data, verify id, min length pwd 7 alphanumeric, change every 90 days, remembers last four pwds/phrases and that pwds are reset at first time use

Front 32

requirement 8.3 - MFA what?

Back 32

Secure all non-console admin access and remote access to CDE using MFA (bp til 31/01/18)

Front 33

requirement 8.4 - guidance on what? hint pwds

Back 33

Document and communicate guidance on strong authentication credentials, how to protect them, instructions not to reuse, instructions to change if any suspicion of discovery

Front 34

requirement 8.5 - what about shared accounts?

Back 34

Do not use generic or shared passwords or authentication methods, remove generic/shared, no generic sys admin - accountability

Service Providers - must use unique authentication per customer of shared hosting

Front 35

requirement 8.6 - Tokens - what about them?

Back 35

Tokens - Authentication methods were used must be assigned to individual not shared and physical/logical controls must be in place to ensure that only intended account can use.

Front 36

requirement 8.7 - DB's what about them?

Back 36

DB's - all access to db's must be through programmatic methods, on dba's have ability to have direct access or query db, ap id's can only be used by app

Front 37

What is requirement 9

Back 37

Physical security is just as important!

Restrict physical access to cardholder data

Front 38

Mnemonic for requirement 9

Back 38

Entry controls, Visitor procedures, sensitive areas, visitor authorisation,

Media - Secure, Control, Storage, Destroy.

Devices that Capture CD tampering awareness

Front 39

requirement 9.1- what should we use to limit and monitor access

Back 39

Use entry controls to limit and monitor access, CCTV, ph or log controls to network jacks, AP's, gateways, handhelds, hw and telcoms lines

No network jacks in public areas

Front 40

requirement 9.2 - how do we tell who is a visitor?

Back 40

Distinguish between staff and visitors, use badges, assign access requirements and revoke on expiry

Front 41

requirement 9.3 - who is allowed in to sensitive areas?

Back 41

Control access to sensitive areas - authorised, based on job function and revoked upon termination

Front 42

requirement 9.4 - is there a process for assigning badges?

Back 42

Procedures to authorise visitors - before entering, escorted within CDE, given a badge to distinguish as visitors, which expires, asked to surrender when leaving and maintain a log/audit trail for 3 months

Front 43

requirement 9.5 a - securing media where?

Back 43

Securing media - backups at secure location, off site and review security annually

Front 44

requirement 9.6 a- securing media, if you send it, how should it be sent?

Back 44

strict control over media - classify sensitivity, send by secure courier, and ensure it has management approval for move

Front 45

requirement 9.7 - secure media, how should we check it?

Back 45

strict storage control - inventory, review annually

Front 46

requirement 9.8 - media no longer needed, what should we do with it?

Back 46

Destroy media - incinerate, shred, pulp, render cd unrecoverable so that cd cannot be reconstructed

Front 47

requirement 9.9 - staff awareness wrt peds

Back 47

Protect devices that capture chd from tampering not keyboards or pin pads. Inventory - make model, location, serial no. periodically inspect.

Train staff re attempted tampering, verify identity of maintenance persons, verify installation, be aware of suspicious behaviour, report such behaviour or signs of tampering

Front 48

What is requirement 10

Back 48

Track who's going where and what they do!

Track and monitor all access to network resources and cardholder data

Front 49

requirement 10.1 - what do we use to track and monitor activity?

Back 49

implement audit trails to link activity to users and admins

Front 50

requirement 10.2 - what should the audit trail record?

Back 50

Automated audit trails - records indiviudal user access to cd, root/admin actions, access to audit logs, invalid login attempts, changes to accounts i.e. elevation of privs, adds, deletions, stopping or pausing of audit logging, creation/deletion of system level objects.

Front 51

requirement 10.3 - what user activity should audit trail contain?

Back 51

Audit trail should record the following - uid, type of event, date and time, success or failure, orginiation and identity of affected data, system component or source

Front 52

requirement 10.4 what about the time?

Back 52

Time sync all critical components - correct and consistent time, protected, from industry accepted sources

Front 53

requirement 10.5 -where should we hold audit logs?

Back 53

secure audit trails, limit viewing, protect from unauthorised modification, backup to a centralised log server, external facing devices should log to centralised log, use FIM or change detection software (alerting)

Front 54

requirement 10.6 when should we review audit logs and why?

Back 54

Review logs for anomalies, can use tools, review daily all security events from all sources that store, process or transmit, review logs of other components according to policy/risk assessment, follow up anomalies,

Front 55

requirement 10.7 - how long should we keep logs?

Back 55

retain audit trail for 1 year with 3 months immediately available (can be from backup)

Front 56

requirement 10.8 SP's only - network monitoring - what should be included?

Back 56

SP's only - process for timely detection of failures of critical security controls i.e from firewalls, IDS/IPS, FIM, AV, physical and logical access controls. Note: best practice til 31/01/18.

Respond to any such failures timely, restore, identify root cause, address any issues, risk assess, implement additional controls, fully document.

Front 57

Requirement 11

Back 57

Test to make sure it's all working properly!

Regularly test security systems and processes - test and check everything is working correctly!

Front 58

Requirement 11.1 - wireless? what of it?

Back 58

Test for the presence of auth and un-auth wireless AP's quarterly.

Inventory of authorised AP's including business justification ,

incident response procedure (IRP) if un-auth detected.

Front 59

Requirement 11.2 - internal and external scans, when, how, why, who?

Back 59

Vuln scans - internal and external (ASV) quarterly and after changes, scans must be done by authorised personnel, address all high risk. Rescan until passing scan achieved, scan after any changes.

Front 60

Requirement 11.3 - pen test when and why?

Back 60

Pen test methodology - based on industry standards (NIST SP800-115), covers entire cde, internal/external, network layer pen test, review of threats and vulns of last 12 months, suggested remedial activities.

All tests annual, or after significant changes, correct exploitable vulns found, test segmentation every 6 months if SP. best practice til 31/01/18

Front 61

Requirement 11.4 - should we monitor the perimeter?

Back 61

IDS/IPS, monitor all traffic as well as critical points of the cde, keep all signatures and engines up to date.

Front 62

Requirement 11.5 - should we monitor files?

Back 62

Change detection mechanism, FIM, alert to un-auth modification of critical files. implement process to respond to alerts. File comparisons at least weekly.

Why- unath changes could render other security controls ineffective or mean a breach.

Front 63

Requirement 12

Back 63

Make sure everyone knows what's required.

maintain a policy that addresses infosec for all personnel

Front 64

Requirement 12.1 - Security Policies - what about them?

Back 64

Establish, publish, dissmeninate, review annually

Front 65

Requirement 12.2 - risks?

Back 65

Risk assessment process, annually and on significant changes

Front 66

Requirement 12.3 - acceptable use of what?

Back 66

usage policies for critical technologies to define their proper use - wireless, remote access, laptops, removable media, email and internet. Includes authorised approval, authentication for the use of technology, list of personnel and devices, inventory of ownership - contact,label, purpose, acceptable use, acceptable locations, remote access for vendors and 3rd parties including deactivation, where cd is access by remote access there must be no copying, moving or storage of cd unless auth business need

Front 67

requirement 12.4 - infosec responsibilities for all personnel - what about them?

Back 67

Ensure that security policies clearly define infosec responsibilities for all personnel.

Service providers only - executive management shall establish responsbility for the protection of chd including accountability, defining a chartger for the program and communication to all exec management - bp til 31/01/18

Front 68

Requirement 12.5 - Responsibilities - what for?

Back 68

Assign responsibilities - establish, doc and distribute infosec pols, monitor and analyse security alerts, incident response and escalation procedures, admin user accounts - add, deletes changes, monitor and control all access to cardholder data

Front 69

Requirement 12.6 - awareness why? when?

Back 69

implement security awareness program make all personnel aware of the need to protect CD. Educate annually and require all staff to acknowledge at least annually that they have read and understood security policies and procedures.

Front 70

Requirement 12.7 - check your staff out!

Back 70

Employee background checks - criminal record, credit history, references

Front 71

requirement 12.8 - what about service providers?

Back 71

policies and procedures to manage service providerss whre cd is shared or could affect the security of cd. maintain a list including description of service provided. Written agreement including acknowledgement that sp are responsible for the security of chd where they store, transmit or process or could affect the security of the cde. Due diligence prior to engagement, monitor SPs annually, maintain info about what is managed by sp and what is managed by entity.

Front 72

requirement 12.9 - SP's only - what are their responsibilities?

Back 72

Service Providers only: acknowledge in writing that they are responsible for security of cde where they store, transmit or process cd or where they could affect the security of the cde.

Front 73

Requirment 12.10 - What should the IRP cover?

Back 73

Implement an Incident Response Plan (IRP): must address roles and responsibilities, communications strategy including to payment brands, IR procedures, business resilience, data backup, legal requirements for reporting compromises, coverage of all critical systems. Review and test plan at least annually, Designate personnel to be available 24/7/365 to respond to alerts, provide training to staff with breach responsiblities, include alerts from all systems not just IDS/IPS, firewalls FIM. Process to evolve lessons learned.

Front 74

Requirement 12.11 - Review your personnel and what they are doing?

Back 74

SP's only : Review quarterly to confirm personnel are following procedures - daily log reviews, firewall sets, config standards to new systems, change management, response to security alerts. bp til 31/01/18. Maintain documentation of quarterly review, review and sign off by personnel assigned responsibility for pci dss compliance program.

Front 75

What is appendix A about?

Back 75

Additional pci dss requirements for shared hosting providers re protecting each entity, making sure that each only have access to their own cde, restricting privs to cde only, ensuring logging and audit trails and processes for timely forensics investigations.

Front 76

What is Appendix 2 about

Back 76

Entities still using SSL or early TLS. Stop using by 30/06/18, ensure terminals are not susceptible to known attacks, risk mitigation plan,

Front 77

what are the main sections of the Compensating Controls Worksheet

Back 77

Constraints, Objectives, Identified Risk, Definition of Compensating Controls, Validation of Compensating Controls and Maintenance. COIDVM

Front 78

What are the main components of the RoC

Back 78

contact info and report date

Executive Summary

Description of Scope of work and approach taken

Details about the reviewed environment

Quarterly scan results

Findings and objectives

Compensating Controls Worksheet

CExDDQFCcw

Front 79

What is the process flow of card transactions

Back 79

CMAPBI

Cardholder - Merchant - Acquirer - Payment Brand Network - Issuer

Front 80

Requirement 1 - keep the bad guys out!

requirement 1.1 is about firewall and router configs - what else?

Back 80

Install and maintain a firewall configuration to protect cardholder data. Config stds must include: change control, network diagram, data flow diagram, fw @ internet and between dmz and internal zone, roles and responsibilities, documented business justification for rules, review of fw rules every 6 months.

Front 81

requirement 1.2 is about what the config should do and what else

Back 81

Build FW/router configs to restrict access between untrusted networks and the cde. Restrict inbound/outbound to only necessary traffic, deny all , secure and sync router files, put perimeter fw between wireless and cde, permit only authorised traffic

Front 82

requirement 1.3 is about prohibiting what traffic

Back 82

Prohibit direct public access between INT and CDE. Prevent access to CD must go through DMZ.

Front 83

Requirement 2 - Set systems up properly!

is about vendor defaults and what else

Back 83

Do not use vendor-supplied defaults for system passwords and other security parameters i.e

Attempt to sign on with defaults

Hardening standards and system configurations

Ensure that non-console access is encrypted

Front 84

What is DESV and what is it about?

Back 84

an entity determined by an acquirer or payment brand as requiring additional validation to existing PCI requirements. could be due to breaches, need greater assurance, S-RoC, S-AoC

Front 85

Track 1 vs Track 2 - whats the difference?

Back 85

Track 1 contains all fields of both tracks upto 79 characters

Track 2 provides shorter processing time for older dial up systems up to 40 characters

Front 86

What part of track 1 are a violation to store/

Back 86

44-56 = CVV/CVC

Front 87

What parts of track 2 are a violation to store

Back 87

28-40 = CVV/CVC, PIN, Service Code

Front 88

What should an inventory contain for systems that store transmit or process CD

Back 88

System name, account data stored, reason, retention period, and protection mechanism

Front 89

Storing track data is not permitted except for who?

Back 89

Issuers and issuing processors may be permitted to retain SAD if needed for business purposes (troubleshooting) but payment brands may have addtional requirements for issuers.

Front 90

Where can track data be found hidden?

Back 90

Databases, flat files, log files and debug files

Front 91

What type of system commonly store track data?

Back 91

POS systems and servers, authorisation servers

Front 92

What is the mod 10 check and how does it work?

Back 92

1) start from 2nd digit right, double alternative digits and subtract 9 for those over 10

2) add calculated values including skipped, together

3) The total obtained in step 2 must be divisible by 10

or use cardholder data discovery tool

Front 93

What are the principles of sampling?

Back 93

1)consider business facilities and components

2)samples must be representative of all types and locations of the aforementioned

3)samples must be sufficiently large enough

Sampling is not a PCI-DSS requirement. Facilities = offices, DCs, retail stores

4)document the rationale for sampling and methodology used.

Front 94

requirement 3.2 prohibits the storage of SAD after authorisation - what should happen to it if received?

Back 94

It must be rendered unrecoverable - securely deleted

Front 95

How should Cryptographic keys be kept?

Back 95

one or more of the following:-

encrypted with a key-encrypting key that is at least as strong as the data-encrypting key and stored seperately, within a secure crypto device (HSM, PTS approved), as a key components or key shares (industry standard method)

Front 96

What is split knowledge and how is it managed, why should it be used?

Back 96

Where clear text key management processes are used the split knowledge should be used. At least 2 people have knowledge of a part of a key and never the resultant key once two or more parts come together. Dual control should be used to perform a function but again neither should have access to the resultant key.

Front 97

What is important to remember about key custodians?

Back 97

Requirement 3.5.1 - access to keys must be limited to the fewest number of custodians possible

Requirement 3.6 custodians should acknowledge and accept their responsibilities as key custodians.

Front 98

What are the requiements for video cameras and their retention period.

Back 98

To monitor access control to entrances/exits to sensitive areas such as the CDE, they must be protected from tampering, actively monitored and data retained for 90 days.

Front 99

What happens in the clearing process?

Back 99

The acquirer and issuer exchange purchase information to complete the transaction via the payment brand network. The acquirer sends payment info to the payment brand network.

Front 100

What happens in the reconciliation process?

Back 100

The payment brand sends purchase info to the issuer and then provides reconciliation to the acquirer as part of the clearing process

Front 101

What happens during the settlement process?

Back 101

the issuer determines acquirer and sends payment to the merchant and bills the cardholder.

Front 102

name some common coding standards

Back 102

OWASP, SANS CWE Top 25, CERT Secure Coding

Front 103

What is SAQ A used for?

Back 103

card not present, MO/TO merchants - all cd functions outsourced to pci-dss compliant SP no stored cd

Front 104

SAQ-A EP is for whom?

Back 104

eCommerce only merchants who outsource cd functions and who have website that doesnt received cd but hands off to SP or 3rd party compliant org

Front 105

SAQ - C is for who?

Back 105

merchants with segmented payment apps connect to internet, no stored cd.

Front 106

SAQ-C VT is for whom?

Back 106

Merchants using only web based virtual terminal with no cd stored. - not eccomerce

Front 107

SAQ-D

Back 107

Merchants not included in any other SAQ or all Service Providers

Front 108

SAQ- P2PE is for who

Back 108

merchants with validated P2PE solution listed on Standards council website with no stored cd. No ecommerce.

Front 109

What are payment brands compliance programs responsible for?

Back 109

TEPVADF

Tracking, Enforcement, Penalties, Deadlines, Validation process, Approval and posting of compliant entities, Definition of merchant and SP levels. Also forensic investigations and responding to account data compromises

Front 110

Who should one go to in the event of a data breach?

Back 110

The payment brands - a list can be found of contact details for the payment brands on the SCC website

Front 111

What type of assessment is needed by a Level 1 merchant or Service Provider

Back 111

Onsite, RoC and ASV scan report

Front 112

What type of assessment is needed by a Level 2 merchant or Service Provider

Back 112

Self Assessment, SAQ and ASV Scan

Front 113

What type of assessment is needed for L2 and L4 merchants

Back 113

Determined by brand or acquirer

Front 114

who determines merchant levels and how

Back 114

Payment brands based on transaction volume, which is determined by the acquirer

Front 115

who determines a service providers level?

Back 115

Brands based on transax volume or type of service provider. can also be determined by acquirer or service provider themselves

Front 116

how is a scope of the environment determined?

Back 116

identify all locations and flows of chd

verify that they are all included in the cde

ensure correctly documented - verify