Description

This training will allow you to understand the new version of the PCI-DSS standard relating to the protection of bank account data, including card payment and the key security elements necessary to bring your business into compliance, while taking into account specificities of its context.

Who is this training for ?

For whom ?

CISO or security correspondents, security architects, security engineers, project managers (MOE, MOA) who must integrate regulatory security requirements.

Prerequisites

Good knowledge in IT security management.

Training objectives

Understand the protection of banking data

Understand the current PCI-DSS 3.x standard and prepare for version 4.0

Implement PCI compliant security solutions

Define your company's compliance project

Training program

• Introduction
  • - The participation of the brands VISA, MASTERCARD, AMEX, etc.
  • - The relationship between PADSS and PCI DSS.
  • - Understand the ecosystem of players (QSA, ASV , certified publishers).
  • - The DSS standard and other PCI standards (PA DSS, PTS, CP, etc.).
• Preparing your project
  • - To be or not to be PCI DSS? merchant, PSP, issuing bank and/or acquirer, third-party supplier.
  • - The different contexts of applicability of the regulations, the role of brands .
  • - The “right” choice of scope: from “flat network” to “controlled network”.
  • - The impact of PCI DSS on virtualization choices.
  • - Sharing PCI security in the cloud: which cloud service to choose?
  • - The available documentary base.
  • - Know how to use the FAQ and official guidance.
  • - At what point in the project should I seek the informed advice of QSA auditors.
• The twelve “historical” requirements of the PCI DSS standard
  • - Condition 1: Install and manage a firewall configuration to protect CB data.
  • - Condition 2: Do not use default system passwords and other security settings.
  • - Condition 3: Protect stored cardholder data.
  • - Condition 4, 5, 6, 7, 8, 9, 10, 11 and 12.
• Compliance objectives and certification
  • - The scope of the evaluation of conformity with the conditions of the PCI DSS standard.
  • - The unquestionable choice of devices in contaminating and contaminated areas.
  • - Preparing for SAQs: carry out a self-assessment and a mock audit.
  • - Carry out official pentests and vulnerability scans.
  • - Prepare for compliance audits and anticipate deviations.
  • - The obligatory presentation of its AOC to the stakeholders.
• Managing your PCI-DSS project
  • - Adopt the priority approach proposed by PCI.
  • - Avoid a tunnel effect to your project: the steps towards the AOC.
  • - Define a road map towards PCI DSS certification.
  • - The PCI-DSS standard in relation to global SSI compliance.
  • - QSA auditors and preparation of the testing methodology.
  • - The maintaining compliance over time: assess recurring costs.
  • - Anticipate the new features of version 4.0 in order to maintain compliance in 202x.
  • - The necessary links between projects under PCI compliance .