PCI DSS – Implementer

PCI DSS Implementer Course Outline

The PCI DSS Implementer course is split into 9 in-depth modules, which are covered over two days. The module outline is as follows: 

Modu​le 1:

• Security Breaches Overview & Vulnerability Experiences
• Structure & Relationships
• Impact of Data Compromises and Increasing Risk to Cardholder Data
• Compromise Case Study Examples

Module 2:

• Overview of the PCI DSS and AIS
• PCI DSS Objectives
• Relationship to Industry Standards
• Compliance & Validation – key differences

Module 3:

• Compliance Validation Process
• What is AIS Compliance and Validation Levels
• New Self-Assessment Questionnaires
• Overview of Scoping, Sampling and Compensating Controls

Module 4:

• Requirements for Payment Applications
• Payment Application Scope
• Guidelines for Payment Application Security Strategy
• Payment Application Mandates

Module 5:

• Cardholder Data, Finding and Eliminating Sensitive Authentication Data
• CVV vs CVV2, Track 1 vs Track 2 Data, Full Track or Magnetic Stripe
• Track Data Characteristics and Guidelines for Searching, MOD-10
• The PCI PIN Transaction Security Program

Module 6:

• PCI DSS Applicability and Scoping
• Important Cardholder Data concepts
• PCI DSS Scoping Statement
• Network Segmentation, Scoping examples

Module 7:

• Compensating Controls
• Definition, Myths, Facts
• Successfully Applying Compensating Controls, Analysing Risk
• Case Study Scenario and Discussion

Module 8:

• New Standards and Emerging Technologies
• PIN Transaction Security
• Data Field / End to End Encryption
• New Wireless Guidelines
• Virtualization & Cloud Computing
• Tokenization

Module 9:

• A detailed explanation of PCI DSS Requirements (above) and Audit Guidelines including the 12 Sections and related sub requirements including:
• Firewall configuration Standards Settings
• Network Segmentation and Firewall Rules
• Vendors Defaults and Admin Access
• System Configuration Standards
• Cardholder Data Retention
• Protecting Stored Data
• Encrypting Cardholder Data
• Encryption Key Management
• Encrypting Sensitive Data over Public Networks
• Using and updating anti-virus software principles
• Updated Wireless Guidelines, End to End
• Encryption Patch management and change control
• Software Development Controls
• Secure Software Development
• Web-facing Applications
• End to End (E2E) encryption Restricting access to cardholder data
• Unique User Ids
• Two-Factor Authentication
• User Authentication
• Restricting physical access to cardholder data
• Maintaining Information Security policies
• Employee Acceptable Use Policy
• Information Security Management Responsibilities
• Employee Education and Screening
• Service Provider Requirements
• Incident Response Planning
• Virtualization, tokenization, Cloud computing
• Logging Access to Cardholder Data
• Monitoring Access to Cardholder Data
• Vulnerability Scans and Penetration Testing
• IDS and FIM