Upload
dinhtuong
View
220
Download
0
Embed Size (px)
Citation preview
MAC is an organization comprised of members from Banks, Acquirers,
ISOs, Card Associations, Law Enforcement and others involved in risk
management and compliance of the electronic payment processing
industry. The purpose of MAC is to educate members in the electronic
payment industries regarding the compliance with electronic
payments regulations along with the detection, prevention and
prosecution of those involved in electronic payment fraud. In the
context of fulfilling MAC’s ongoing educational obligations to its
members, this webinar is being presented by the MAC Education
Committee in support of the MAC mission regarding the exchange of
information and continuous education of its’ members.
AGENDA • Panel Introduction
• Why PCI DSS 3.0
• Summary of Changes in PCI 3.0
• Things that will cause merchants problems?
• How Will Changes Impact Merchant Compliance
• Portfolio Risk Mitigation Strategies
Meet the Panel
Deana Rich (Moderator) - Rich Consulting
Gary Glover – Security Metrics
Greg Rosenberg – Trustwave
Jim Bibles – Aperia Solutions
Why PCI DSS 3.0?
• Allows for smooth transition from
one version to the next
• Provides feedback process for
existing standard
• Ensures the new threats and
technologies are addressed
• No mix and Match
PCI DSS and PA DSS Lifecycle
Summary of Changes in PCI DSS 3.0
Summary of changes to The PCI DSS
5 Areas of Additional Guidance Explanation, definition and/or instruction to increase understanding or provide further information or guidance on a particular topic.
74 Clarifications Clarifies intent of requirement. Ensures that concise wording in the standard portrays the desired intent of requirements.
14 Evolving Requirements – Immediate Impact
Changes to ensure that the standards are up to date with emerging threats and changes in the market.
5 Evolving Requirements – Phased in
These requirements are considered “best practices only” until June 30, 2015 at which time they become mandatory for all 3.0 assessments
Things That Will Cause Merchants Problems
Requirement 11.3.4
• Requires penetration tests to verify that the
segmentation methods are operational and
effective.
• Shows up now in SAQ C
Things That Will Cause Merchants Problems
Requirement 12.8.5 and 12.9
• 12.8.5 – Requires merchants to document PCI
DSS requirements that are managed by their
service providers
• 12.9 – Requires merchants to get written
agreement/acknowledgment from their
service providers (as specified in requirement
12.8.5) **Effective July 1, 2015**
Things That Will Cause Merchants Problems
Changes to SAQs
• Qualification for New SAQ A-EP is not clearly
defined
• eCommerce merchants may no longer use
SAQ C
• No clear direction for merchants that use
mobile solutions
How Will Changes Impact Merchant Compliance?
Will I see a decrease portfolio compliance rate?
• Enhanced validation requirements for merchants using same SAQs
• Increase in merchants changing SAQ’s
• New “vendor management” requirements
• Better understanding of testing requirements
Increase in Portfolio Risk?
• Merchant security practices did not change
• The threat environment has evolved
• New technologies will impact risk
Portfolio Risk Mitigation Strategies
How do I manage my risk?
• Educate all merchants
• Provide secure processing solutions
• Concentrate on “high risk” merchants
Risk Drivers
• Transaction type (CP vs. CNP)
• POS type
• MCC
• Volume
Know your Card Brands qualification thresholds!
About Merchant Acquirers' Committee
MAC is an organization of Bankcard professionals involved in the risk management side of Card Processing. We have members from Banks, ISOs, Card Associations and others related to the risk management side of the industry. MAC is
dedicated to providing universal risk management solutions through ongoing communication and cooperation among acquirers and card associations.
Who we serve: Acquiring Bank
Acquiring Savings & Loan
Acquiring Credit Union
Gateway Provider
Internet Service Provider
ISO/MSP
Merchant Acquirer
Processor
Risk Management Professional
Your membership in MAC is an investment that should not be overlooked.
If you are not a member of MAC… JOIN TODAY!
https://www.macmember.org/