<Insert Picture Here>

Security Payment Card Industry (PCI) Compliance

Carl Terrantroy
Directory Technology GTMi’s ANZ
Oracle PCI Review

1
3 Guiding Principles

2
12 PCI Requirements

3
Action plan
Access Control
Provides merchants with a single source
for valid user identification.
External

Internal
SOA Apps Customers Partners IT Staff Employees SOA Apps

Access Identity
Auditing Management Administration Monitoring
and and
Reporting Directory Identity Management
Services Provisioning

Applications Systems & Repositories

SCM ERP CRM OS (Unix) HR Mainframe NOS/Directories

 Data Privacy Control

Protect data
at all levels:
Network,
Decryption Encryption
application
database and
storage.
Encrypted
Data on
Backup Media
Compliance Control
Automation and enforcement of access
policies, software maintenance and
business process’s

Gather Model Reconcile Enforce Audit

Recipient Policy

Recipient Policy

Recipient Policy
12 PCI Requirements

Discuss
Oracle Solution
Requirements
Footprint
Detail

Why its important to

= address these
requirements
Requirement 1

Install and maintain aEnterprise

firewall Manager
Audit Vault
configuration to protect cardholder data

Monitor software version

= Centralise log files
Requirement 2

Do not use vendor

Enterprise Manager
supplied defaults
Data Vault
for passwords

Provides checks
= Password management
Requirement 3

Protect stored TDE

cardholder ASO
data Secure Backup

In session

= At rest on disk
On tape backups
Requirement 4

Application
Encrypt transmission of cardholderServer
data
TDE
across open public networks

Wireless security
= Data in motion protection
Requirement 5

Maintain a GRC Manager

vulnerability Partner
program

ITIL / Cobit alignment

= Services
Requirement 6

Develop and maint. Enterprise Manager

secure systems Change Management
and applications Application Manager

Automate patching

= Evaluate DB changes
Monitor applications
Requirement 7

Restrict access to Label Security

Cardholder data by Access Manager
need to know eSSO

Protect Data Source

= Automate manual process

Desktop Single Sign On
Requirement 8

Assign a unique id Access Manager

to each person Identity Manager
with access EUS

Consistent access

= Automate on / off boarding

Cetralised access
Requirement 9

Restrict physical Identity Manager

access to card Data Vault
holder data Adaptive Access

Logical = physical access

= Harden credentials
Continuous monitoring
Requirement 10

Track and monitor Access Manager

all access to Identity Manager
resources and data Audit Vault

Application access

= Verify and test access policy

Secure audit data
Requirement 11

Regularly test Control Manager

security systems Identity Manager
and processes Enterprise Manager

Test Internal Controls

= Attestation
Secure audit data
Requirement 12

Maintain a policy that addresses

information security

= Partner services
 PCI Suite
1 2 3 4 5 6 7 8 9 10 11
Identity Manager
   
IDM
Access Manager   
eSSO 
Suite
Virtual Directory 
Adaptive Access 
Data Vault
DB
Audit Vault 




Security
ASO   
Secure Backup 
Options
Enterprise Manager   
Summary

#1 Encryption

#2 User access

Foundation for GRC V2.0

Next Steps
1
Schedule Security PCI Review
2
Prioritize and define the remediation
plan for solution
– What’s the greatest risk
– Gains vs. effort
– Re use for other projects

3
Feedback Forms
Q&
A