Payment Card Industry Data Security Standard Handbook

Praise for Payment Card Industry Data Security Standard Handbook
"While providing insightful guidance on a holistic approach to tackling the Dirty Dozen of PCI, this book also teaches the fundamental principles of information security management. The PCI DSS Handbook is a must–read for all levels of security managers."
—John Reeder, CISSP, CISM, CISA, CIPP, Vice President, Information Security & Compliance
"There′s a lot of noise surrounding PCI compliance. This book is the perfect resource to help clear the air so people can focus on what′s important."
—Kevin Beaver, security consultant and creator of the Security On Wheels audio programs
Your single source for understanding the Payment Card Industry data Security Standard
The significant benefits of extensive payment card use and rapid advances in technology are immense, but also require your organization to address the specific challenges associated with protecting its cardholder data and cardholder data environments.
Clearly written and easy to use, Payment Card Industry Data Security Standard Handbook is your single source along the journey to compliance with the Payment Card Industry Data Security Standard (PCI DSS), addressing the payment card industry standard that includes requirements for security management, policies, procedures, network architecture, software design, and other critical protective measures.
This all–inclusive resource for payment card industry compliance shows you how your organization can:
Protect cardholder data, with discussion of the requirements necessary to ensure cardholders are properly protected
Maintain a vulnerability management program in order to minimize the overall vulnerability of the cardholder data environment
Implement strong access control measures in order to achieve PCI DSS compliance
Regularly monitor and test networks to find out how netw orks must be monitored and tested
Enforce an information security policy and what it must contain in order to be PCI DSS–compliant
Payment Card Industry Data Security Standard Handbook presents an overall view of the essential components and best practices for successful implementation of an information security program, as well as a deeper understanding of how to put compliance into action while maintaining your business objectives.

Spis treści:
Introduction.
Part 1: The Fundamentals.
Chapter 1: PCI Fundamentals.
History of PCI.
Why PCI DSS?
Chapter 2: Security 101.
Strategy and Planning.
Information Risk Management.
Information Classifi cation.
Risk Assessment.
Risk Analysis.
Dealing With Risk.
Defense in Depth.
Policy, Standards, and Procedures.
Adoption of a Security Framework.
Security and the System Development Life Cycle (SDLC).
Security Training and Awareness.
Metrics.
Physical Security.
Data Communications and Networking.
Perimeter Security.
Information Security Monitoring and Log Management.
Intrusion Detection and Intrusion Prevention Technology.
Logical Access Control.
Electronic Authentication.
Encryption.
Remote Access Control.
Secure Communications.
HTTPS.
Secure Shell.
Virtual Private Networks.
Wireless.
Incident Response.
Forensics.
Part 2: PCI Breakdown (Control Objectives and Associated Standards).
Chapter 3: Build and Maintain a Secure Network.
Requirement 1: Install and Maintain a Firewall Confi guration to Protect Cardholder Data.
Requirement 2: Do Not Use Vendor–Supplied Defaults for System Passwords and Other Security Parameters.
Requirement A.1: Hosting Providers Protect Cardholder Data Environment.
Chapter 4: Protect Cardholder Data.
Requirement 3: Protect Stored Cardholder Data.
PCI DSS Appendix B: Compensating Controls f or Requirement 3.4.
Requirement 4: Encrypt Transmission of Cardholder Data Across Open Public Networks.
Chapter 5: Maintain a Vulnerability Management Program.
Requirement 5: Use and Regularly Update Antivirus Software.
Requirement 6: Develop and Maintain Secure Systems and Applications.
Chapter 6: Implement Strong Access Control Measures.
Requirement 7: Restrict Access to Cardholder Data by Business Need to Know.
Requirement 8: Assign a Unique ID to Each Person with Computer Access.
Requirement 9: Restrict Physical Access to Cardholder Data.
Chapter 7: Regularly Monitor and Test Networks.
Requirement 10: Track and Monitor All Access to Network Resources and Cardholder Data.
Requirement 11: Regularly Test Security Systems and Processes.
Chapter 8: Maintain an Information Security Policy.
Requirement 12: Maintain a Policy that Addresses Information Security.
Part 3: Strategy and Operations.
Chapter 9: Assessment and Remediation.
PCI DSS Payment Card Industry Self–Assessment Questionnaire.
PCI DSS Security Audit Procedures.
PCI DSS Security Scanning Procedures.
Leveraging Self–Assessment.
Strategy and Program Development.
Chapter 10: PCI Program Management.
Case for Strategic Compliance.
Who Should Be Involved Achieving PCI DSS Compliance for Our Organization?
PCI DSS Glossary, Abbreviations, and Acronyms.
References.
Resources.
Index.

Nota biograficzna:
Timothy M. Virtue, CISSP, CISA, CCE, CFE, CIPP/G, is an accomplished information security and risk management professional who specializes in the strategic application of information risk management methodologies to operational business goals and objectives.

Okładka tylna:
Praise for Payment Card Industry Data Security Standard Handbook
"While providing insightful guidance on a holistic approach to tackling the Dirt y Dozen of PCI, this book also teaches the fundamental principles of information security management. The PCI DSS Handbook is a must–read for all levels of security managers."
—John Reeder, CISSP, CISM, CISA, CIPP, Vice President, Information Security & Compliance
"There′s a lot of noise surrounding PCI compliance. This book is the perfect resource to help clear the air so people can focus on what′s important."
—Kevin Beaver, security consultant and creator of the Security On Wheels audio programs
Your single source for understanding the Payment Card Industry data Security Standard
The significant benefits of extensive payment card use and rapid advances in technology are immense, but also require your organization to address the specific challenges associated with protecting its cardholder data and cardholder data environments.
Clearly written and easy to use, Payment Card Industry Data Security Standard Handbook is your single source along the journey to compliance with the Payment Card Industry Data Security Standard (PCI DSS), addressing the payment card industry standard that includes requirements for security management, policies, procedures, network architecture, software design, and other critical protective measures.
This all–inclusive resource for payment card industry compliance shows you how your organization can:
Protect cardholder data, with discussion of the requirements necessary to ensure cardholders are properly protected
Maintain a vulnerability management program in order to minimize the overall vulnerability of the cardholder data environment
Implement strong access control measures in order to achieve PCI DSS compliance
Regularly monitor and test networks to find out how networks must be monitored and tested
Enforce an information security policy and what it must contain in order to be PCI DSS–compliant
Payment