Information Security Policy and PCI DSS Requirements

Information Security Policy Document Control

• The document is a draft version of an Information Security Policy for an unspecified company.

• The policy sets out high-level objectives for information security, but does not provide specific guidance on how to achieve them.

• The policy covers personnel responsibilities, network security, system builds, data security, anti-virus, patching and vulnerability management, software development, change management, access control, physical security, system logging, network testing, and monitoring tools.

• Personnel are responsible for understanding their information security responsibilities, protecting credentials, attending training, and reporting security incidents.

• Line managers are responsible for ensuring personnel receive training, have access to policies and procedures, and have their access revoked upon leaving employment.

• Senior management roles include the Information Security Manager, Policy Manager, SOC Manager, Incident Response Manager, and those responsible for user account management and access monitoring.

• Network security requirements include firewall management, documentation, architecture, and configuration, as well as secure management of wireless networks.

• System builds must adhere to configuration standards, remove default settings, and use secure management services.

• Data storage and transmission must comply with specific requirements for protecting cardholder data and using encryption.

• Anti-virus must be deployed on all affected systems and centrally managed.

• Patching and vulnerability management require the application of vendor updates and the management of vulnerabilities using the Common Vulnerability Scoring System (CVSS).

• The policy covers secure software development practices, change management procedures, access control policies, physical site access and security, system logging configurations, network testing methodologies, and the use of monitoring tools such as intrusion detection and prevention systems (IDS/IPS) and file integrity monitoring (FIM).Requirements and Terminology of Payment Card Industry Data Security Standard (PCI DSS)

• Requirement 9 of PCI DSS mandates assigning a unique ID to each person with computer access.

• Requirement 10 of PCI DSS requires restricting physical access to cardholder data.

• Requirement 11 of PCI DSS states that all access to network resources and cardholder data must be tracked and monitored.

• Requirement 12 of PCI DSS emphasizes the need to regularly test security systems and processes.

• Annex A of PCI DSS provides a glossary of terms for better understanding.

• PCI DSS is a standard developed by the PCI Security Standards Council for entities handling cardholder data.

• Insecure services, such as unencrypted data transmission or vulnerable platforms like torrents, Skype, SMTP, and DNS, are not compliant with PCI DSS.

• A public network is any network not managed by the organization and can be monitored or intercepted by other entities.

• A DMZ, or Demilitarized Zone, is a subnet that exposes an organization's external-facing services to the Internet.

• Inbound traffic refers to data flowing into the organization from outside, while outbound traffic refers to data flowing out of the organization.

• Sensitive Authentication Data (SAD) includes full magnetic stripe data, PINs, and other information used in relation to payment cards.

• Cardholder data (CHD) includes the primary account number (PAN), cardholder name, and expiration date.