... aka “Teachings of Don PCI” Presentation title: What PCI DSS Taught Us About Security Brief abstract: This presentation will derive some useful lessons from our industry experience with PCI DSS. Organization can use these lessons to improve their security programs and reduce risk as well.

1. What PCI DSS Taught Us About Security Dr. Anton Chuvakin Security Warrior Consulting www.securitywarriorconsulting.com September 2010

2. Why Are We Here? Risk of DEATH vsRisk of $40 fine?

3. Outline PCI DSS Refresher PCI Helps! PCI Hurts? Lessons from PCI DSS Will compliance break security? Conclusions and Action Items

4. Inspiration…. “Too many have lost sight of goal which is to reduce the risk of security breaches and card fraud. Assessors often just focus on the words in the standard. They do not understand WHY the standard was written, or the risk built into it. “ PCI Knowledge Base by late David Taylor

5. What is PCI DSS or PCI? Payment Card Industry Data Security Standard Payment Card = Payment Card Industry = Data Security = Data Security Standard =

6. PCI Regime vs DSS Guidance Since 2004, PCI Council publishes PCI DSS Outlined the minimumdata security protections measures for payment card data. Defined Merchant & Service Provider Levels, and compliance validation requirements. Left the enforcement to card brands (Council doesn’t fine anybody!) Key point: PCI DSS (document) vs PCI (validation regime)

11. Assign a unique ID to each person with computer access

14. So, PCI Helps! MUCH more organizations KNOW about security now – due to PCI DSS DSS gave many a starting point PCI DSS has motivating “teeth” Blatant card data abuses SEEM to have decreased More people vulnerability scan due to PCI

15. But Also: PCI Hurts! Anti-auditor measures “suck” resources from anti-hacker measures Now we have “checkbox compliance” Security vendors fund compliance-feature development

16. Checklist Mentality IS Evil!

17. PCI Teachings REVEALED…

18. PCI Teachings: Leaders vs Losers

19. PCI Teachings: Awareness =/= Action PCI DSS raised awareness of web security "82% of websites have had at least one security issue, with 63% still having issues of HIGH severity.” (WhiteHat) Now…everybody knows that >80% of sites have XSS. So what?

20. PCI Teachings: The Floor CAN Be The Ceiling Compliance is the “floor” of security And a motivator to DO IT! However, many prefer to treat it as a “ceiling” Result: breaches, 0wnage, mayhem!

21. PCI Teachings: We Cannot Mandate “Caring” Q: Can we mandate caring about security? A: No We can mandate controls, approaches, tools, but we cannot mandate “doing a good job” Thus: mandatory = minimum only!

22. PCI Teachings: It Can be “Too Easy” and “Too Hard”

23. PCI Teachings: Many Would Rather Whine Than Do W1: Why don’t the brands “fix the system?” A1: They will. W2: Can we have “a risk based” standard? A2: No. 91% of people can’t spell “risk” W3: Can we do something simpler? A3: Yes! Cash.

24. PCI Teachings: Mandatory Beats Sensible

25. Observations…

26. PCI Teaching: $40> Your Life Risk of DEATH vs Risk of $40 fine? DOT study on seatbelts: Compliance = (Awareness + Enforcement) / Security Benefit

27. PCI Teachings: Compliance and Risk … have nothing to do with each other. But you KNOW compliance and you DO NOT KNOW risk! Which one will you act on?

28. PCI Teachings: People Will Fear THE KNOWN <- This is the enemy! This is NOT the enemy! -> Sadly, many organization will fear QSA more than an attacker!

29. PCI Teachings: Dead Data = Secure Data Many organization cannot be taught to secure the data … but they can be taught to delete it!

30. ?

31. How To “Profit” From Compliance? Everything you do for compliance, MUST have security benefit for your organization! Examples: log management, IDS/IPS, IdM, application security , etc

32. In Other Words… Every time you think “PCI DSS OR security,” god kills a kitten!

33. What Does Future Hold? More regulation to compel the laggards More threats to challenge the leaders New approaches to compliance -mandating care? More organization understanding and measuring security Longer term: slow trend toward more secure world

34. Conclusions and Action Items Kill the data– whenever you can PCI is basic security; stop whining about it - start doing it! Develop “security and risk” mindset, not “compliance and audit” mindset. Use compliance to drive security If you are doing PCI DSS and not getting a security benefit, please STOP!

35. Action Item! NOW LET’S ALL GO PRACTICE INCIDENT RESPONSE!!!

36. Questions? Dr. Anton Chuvakin Security Warrior Consulting Email:anton@chuvakin.org Site:http://www.chuvakin.org Blog:http://www.securitywarrior.org Twitter:@anton_chuvakin Consulting:http://www.securitywarriorconsulting.com

37. Want a PCI DSS Book? “PCI Compliance” by Anton Chuvakin and Branden Williams Useful reference for merchants, vendors – and everybody else Released December 2009!

38. More on Anton Now: independent consultant Book author: “Security Warrior”, “PCI Compliance”, “Information Security Management Handbook”, “Know Your Enemy II”, “Hacker’s Challenge 3”, etc Conference speaker: SANS, FIRST, GFIRST, ISSA, CSI, Interop, many, many others worldwide Standard developer: CEE, CVSS, OVAL, etc Community role: SANS, Honeynet Project, WASC, CSI, ISSA, OSSTMM, InfraGard, ISSA, others Past roles: Researcher, Security Analyst, Strategist, Evangelist, Product Manager