PCI Resources

2022 PCICM Calendar Files

Mon, 05 Sep 2022 00:00:00 +0000

I’ll be attending both the 2022 PCI Community Meetings (often abbreviated PCICM) in Toronto and Milan.

While the schedule is provided on each individual site and within the useful companion app, I wanted something to put in my calendar.

So I wrote a script (adapted actually, I had created it for last year’s online meeting) and created 2 separate iCalendar (.ics) files which can be imported into regular calendar programs such as Outlook and Google Calendar.

GoSec 2019 Presentation

Thu, 05 Sep 2019 00:00:00 +0000

On Thursday August 29th, 2019, I gave a presentation at the GoSec 2019 conference in Montreal, Canada.

As promised to the attendees, here is a PDF of the slides of the presentation entitled “Future proofing your PCI DSS program”.

Updated Scoping Model (version 1.2.1) and French/Spanish Versions

Tue, 31 Jul 2018 00:00:00 +0000

I’m happy to announce the release of the update for the PCI Resources Scoping Model and Approach to version 1.2.1. The model is still available under a creative commons license (CC-BY-SA).

The changes are minor and mainly reflect reference changes for PCI DSS 3.2.1 which came out late May 2018 (and mainly reflected the fact that announced date related changes are now mandatory).

With this version, I’m adding the French and Spanish versions of the model from the upcoming translations of the book which should be available late summer or early fall 2018. Again, the model is available in PDF versions in both US letter and A4 (for my European friends).

Updated Scoping Model (version 1.2)

Tue, 10 Apr 2018 00:00:00 +0000

I’m happy to announce the release of the update for the PCI Resources Scoping Model and Approach to version 1.2. The model is still available under a creative commons license (CC-BY-SA).

The update is extracted from the most recent version of volume 2 of the book series (paperback called " PCI DSS made easy", or individual digital volumes) released in December 2017. The major changes were addressing the PCI SSC (PCI council) supplement called “Guidance for PCI DSS Scoping and Network Segmentation”.

Announcing the 2017 revision of the PCI Resources books on PCI DSS (including PCI DSS made easy)

Wed, 17 Jan 2018 00:00:00 +0000

Late December 2017, the updated versions of the of the PCI Resources book series on PCI DSS were released (links at the end of this post). I received the first paperback copies in early January 2018, and other than tweaks to the cover page for a design issue (weird things can happen when you go from 312 to 458 pages), the book is unchanged from its December 2017 release. The physical book has a new ISBN number, while digital editions kept the same one.

BSides Calgary 2017 Presentation

Sun, 22 Oct 2017 00:00:00 +0000

I just had the pleasure of presenting at BSides Calgary on the topic of " Using NetFlow & Open Source tools for Network Behavioral Analysis". Thanks to the event organizers and volunteers for a great event!

While I await a link to the recorded presentation on Youtube, I want to publish as promised the PDF of the slides, a ZIP of the source code, and a PDF of the demo installation instructions.

Announcing the release of Volume 4

Fri, 14 Jul 2017 00:00:00 +0000

I’m happy to announce the release of PCI Resources volume 4 in my series on PCI DSS, entitled “Hypothetical Case Studies”, available now in the Amazon kindle store (and hopefully in the next few hours in the iBooks store).

You may notice the design change… This will roll out slowly to all volumes and physical book (which will include volume 4 in its next release). So expect updates to the full series this fall (with major revisions to all volumes), and even including French and Spanish translations of all of the volumes in all formats (kindle, ibooks and paper).

December 2016 PCI council scoping guidance vs PCI Resources model

Mon, 16 Jan 2017 00:00:00 +0000

The PCI council (PCI SSC) finally released its promised guidance on scoping and network segmentation on December 9, 2016 (and I think they did a good job). As with all other information supplements they produce, this guidance is strong recommendation but leaves space for interpretation. Your assessor still (QSA, ISA, or other such as yours truly) has ultimate say in these matters; he or she is also receiving more guidance from the PCI council. The PCI Guru has covered this with initial opinions and through answers in a webinar from the council (both posts are recommended reading).

Changes between PCI DSS 3.1 and 3.2

Mon, 14 Nov 2016 00:00:00 +0000

This post was initially published on LinkedIn on October 13, 2016 at https://www.linkedin.com/pulse/changes-between-pci-dss-31-32-yves-desharnais-mba-cissp-pcip?trk=prof-post.

This text is adapted from section 1.8.5 of my book series on PCI DSS. ( http://www.pciresources.com/book/) and supplemented with information from the 2016 North American PCI Community meetings (PCICM) which I just attended a couple of weeks ago. As a reminder PCI DSS 3.2 will become the active standard as of November 1, 2016, although new requirements will only become mandatory on February 1, 2018. PCI DSS 3.1 can only be used for assessments ending by October 31, 2016.

A better PCI DSS scoping model? Or the problems with the OPST.

Mon, 07 Mar 2016 00:00:00 +0000

I have seen and heard about many ways of classifying systems for PCI DSS or expressing how to go about scoping. The most formal method I have found described out there is in the Open PCI Scoping Toolkit (OPST, http://itrevolution.com/pci-scoping-toolkit/) (which is not endorsed or approved by the PCI SSC). It was released in 2012, though I only learned of it in 2014. While I agree with the general approach to classifying systems, I have disagreements on the categories defined in the OPST. The lack of a model that I felt addressed PCI DSS appropriately is one of the reasons I dedicated a complete volume to scoping. I’ve decided to open the model under a Creative Commons licence ( CC BY-SA) for free to everyone in the hopes that we can all improve scoping and thus better manage our risks. The model is not endorsed or approved by the PCI SSC, though they are aware of it (and the PCI SSC, or PCI Council, has promised scoping guidance for 2016). The model can be found here: http://www.pciresources.com/pci-dss-scoping-model-and-approach/ (a PDF version is also available).

PCI Resources volumes are available on the Apple iBook store as well as the Amazon Kindle store

Mon, 07 Mar 2016 00:00:00 +0000

This post is just a summary of changes that have occured but that I’ve not yet blogged about.

Volumes 1 and 2 were released on the Amazon Kindle store in July 2015. The PCI Resources Scoping Model and Approach, derived from volume 2 and published under a Creative Common license at the same time. Volume 3 was released on the Amazon Kindle store in September 2015.

All 3 volumes were updated in January 2016 to reflect the SSL/TLS changes published by the PCI SSC in December 2015.

Welcome to PCI Resources

Tue, 28 Jul 2015 00:00:00 +0000

After many long hours over the last year, I am happy to announce the release of my first two volumes on PCI DSS compliance, the information security standard that covers credit card protection. Volumes 1 and 2 are available on the Kindle store now, and I hope to have volume 3 out in September 2015.

Volume 1, A business case for the PCI DSS, explains why the PCI DSS standard matters, how it works, how we got here, and where it may be heading. Volume 2, PCI DSS Scoping, explains what (and why) people, processes and technologies must be subjected to PCI DSS controls. Volume 3 will cover how to build an information security program that takes PCI DSS into consideration.

PCI DSS Overview

Mon, 01 Jan 0001 00:00:00 +0000

This section is adapted from the books*

The goal of information security should never be to block anything outright, but only to enable users to perform their legitimate business tasks in a secure fashion.

The goal of PCI DSS is to protect cardholder data from theft or unauthorized disclosure. This is our gold standard, the lens through which we will look at the PCI DSS requirements. And while the goal is to protect data, it is accomplished through measures on people, processes and technologies.

PCI DSS Scoping Model and Approach

Mon, 01 Jan 0001 00:00:00 +0000

The PCI Resources Scoping Model and Approach is available for free under a Creative Commons CC BY-SA license. This model is derived from Volume 2 of the book series and is at version 2.0 in English updated for PCI DSS 4.0.1. The guidance on PCI DSS scope documentation was added to this version and is also available below.

Other languages are still at the older version 1.2.1 (2018) and will be updated in fall 2026.

Summary of changes in the 4.0 edition of the book

Mon, 01 Jan 0001 00:00:00 +0000

Back to books home

Summary of changes in the 4.0 edition of the book

The original 3 volumes were written between fall 2014 and summer 2015 for PCI DSS 3.1; the fourth in 2017 for 3.2. They were only slightly modified based on changes from PCI DSS 3.1 to 3.2 and 3.2.1.

This version includes many more changes including:

Terminology (see 1.8.7.1)
Requirement changes both language and numbering
- All numbers are from 4.0, but the equivalent 3.2.1 number is present if available, e.g:
  - 12.5.1, v3#2.4
Images

Summary of changes in the 4.0.1 edition of the book

Mon, 01 Jan 0001 00:00:00 +0000

Back to books home

Summary of changes in the 4.0.1 edition of the book

The original 3 volumes were written between fall 2014 and summer 2015 for PCI DSS 3.1; the fourth in 2017 for 3.2. They were only slightly modified based on changes from PCI DSS 3.1 to 3.2 and 3.2.1. The fifth release for 4.0 in 2022 was as major a change as version 4.0 was to 3.2.1, the summary of changes in the 4.0 edition is still available.

Table of Content - Volume 1 (PCI DSS 4.0.1 edition)

Mon, 01 Jan 0001 00:00:00 +0000

Back to books home

Volume 1 - A Business Case for the PCI DSS (PCI DSS 4.0.1 edition)

1.1 Volume Introduction
1.2 Why PCI DSS?
- 1.2.1 The value of card information
- 1.2.2 The costs of PCI DSS
1.3 How We Got Here - An Oversimplified History of the Payment Card Industry (PCI)
- 1.3.1 From metals to paper
- 1.3.2 Development of the financial industry in the USA
- 1.3.3 The credit card era
- 1.3.4 Credit card and the internet - or the automated fraud era
- 1.3.5 Government Reaction to Accounting Scandals and Industry Reaction
1.4 Who should care about the PCI DSS?
- 1.4.1 The payment card model
- 1.4.2 Anatomy of payment card transactions
- 1.4.3 Clearing and Settlement
1.5 So what exactly is PCI DSS?
- 1.5.1 PCI DSS and the PCI SSC
- 1.5.2 Defining the PCI DSS?
- 1.5.3 PCI DSS at a high-level
- 1.5.4 High-level overview of other PCI standards
  - 1.5.4.1 Issuer Standards
  - 1.5.4.2 Software Security Standards
  - 1.5.4.3 Device Security Standards
  - 1.5.4.4 Payment Device and COTS (Commercial off the Shelf) Devices (aka mobile phones)
1.6 How should PCI DSS compliance be addressed?
- 1.6.1 From physical security to basic network security: Fort Knox or the ‘castle’ metaphor
- 1.6.2 Network complexity and virtualization lead to cloud computing
- 1.6.3 New approaches
1.7 Demonstrating PCI DSS compliance
- 1.7.1 RoC vs SAQ (and AoC)
- 1.7.2 Merchant Compliance
- 1.7.3 Service Provider Compliance
- 1.7.4 Other compliance - issuers, acquirers
1.8 Where do we go from here? The evolution of the PCI DSS standard
- 1.8.1 Early PCI DSS versions: versions 1.0, 1.1, 1.2 and 1.2.1
- 1.8.2 PCI DSS 2.0
- 1.8.3 PCI DSS 3.0 and 3.1
- 1.8.4 PCI DSS Designated Entities Supplemental Validation (DESV)
- 1.8.5 PCI DSS 3.2
- 1.8.6 PCI DSS 3.2.1
- 1.8.7 PCI DSS 4.0 and 4.0.1
  - 1.8.7.1 PCI DSS 4.0 - New terminology (Glossary)
  - 1.8.7.2 PCI DSS 4.0 Structural changes
  - 1.8.7.3 PCI DSS 4.0 Major Requirement Changes
  - 1.8.7.4 PCI DSS 4.0.1
1.9 The rise of genAI (summer 2026 status)
1.10 Parting thoughts for PCI DSS 4.0.1 version (Summer 2026)
End Notes - Volume 1

Table of Content - Volume 2 (PCI DSS 4.0.1 edition)

Mon, 01 Jan 0001 00:00:00 +0000

Back to books home

Volume 2 - PCI DSS Scoping (PCI DSS 4.0.1 edition)

2.1 Volume Terminology and Acronyms
2.2 PCI Resources basic diagrams
- 2.2.1 PCI Resources Base Network Diagram
2.3 Scoping
- 2.3.1 It all starts with data
2.4 PCI DSS Scoping explained
2.5 PCI Resources Simplified PCI DSS Scoping Model and Approach
- 2.5.1 Categories Summary
2.6 Simplified Approach and Scoping categories
- 2.6.1 Simplified Approach Part 1 - CDE (steps 1-3)
- 2.6.2 Simplified Approach Part 2 - Connected systems (steps 4-6)
- 2.6.3 Out-of-scope systems
- 2.6.4 Scope Documentation
- 2.6.5 Comparison to other models
2.7 Scope Reduction Methods
- 2.7.1 Outsourcing
- 2.7.2 Data Reduction (via PAN Transformations)
- 2.7.3 Segmentation / Isolation
2.8 Advanced Scoping
- 2.8.1 eCommerce
- 2.8.2 Card Present payments using Mobile payment devices as terminals
- 2.8.3 Virtualization and Cloud
- 2.8.4 Complex Virtualization Cases
- 2.8.5 Scope of Emails and Instant Messaging Solutions
- 2.8.6 Scope using genAI/LLM (summer 2026 status)
- 2.8.7 Non-covered technologies
2.9 Sources and References
End Notes - Volume 2
Appendix 2A - PCI DSS Scope Documentation Guidance for PCI DSS 4.0 .1

Table of Content - Volume 3 (PCI DSS 4.0.1 edition)

Mon, 01 Jan 0001 00:00:00 +0000

Back to books home

Volume 3 - Building a PCI DSS Information Security Program (PCI DSS 4.0.1 edition)

Volume 3 - Building a PCI DSS Information Security Program

3.1 Volume Introduction
3.2 The High-Level PCI DSS requirements
3.3 Building a PCI DSS Information Security Program
- 3.3.1 Where you come from matters
- 3.3.2 Information Security Programs are meant to address Risks
- 3.3.3 Information Security Frameworks
3.4 Considerations for an Information Security Program
- 3.4.1 Recapping the PCI DSS data elements
- 3.4.2 Data Classification
- 3.4.3 Examples of data classification
- 3.4.4 Governance
3.5 The PCI DSS Information Security Program Structure (the head of the program)
- 3.5.1 (Information Security) Policies (Sections 12.1, 12.2, X.1)
- 3.5.2 Responsibilities for the program (Section 12.1)
- 3.5.3 Targeted Risk Assessments (TRA, Section 12.3)
- 3.5.4 PCI DSS Program and Monitoring (Service Provider, Section 12.4)
- 3.5.5 Scope : Documenting usage of card information (Section 12.5)
- 3.5.6 Security awareness (Section 12.6)
- 3.5.7 Human Resource Security (Section 12.7)
- 3.5.8 Managing Third-party service providers (TPSP) (Section 12.8)
- 3.5.10 Incident Response Management (Section 12.10)
3.6 The body of the program
- 3.6.1 Objective 1: Build and Maintain a Secure Network and Systems
- 3.6.2 Objective 2: Protect Account Data
- 3.6.3 Objective 3: Maintain a Vulnerability Management Program
- 3.6.4 Objective 4: Implement Strong Access Control Measures
- 3.6.5 Objective 5: Regularly Monitor and Test Networks
3.7 Additional Requirements
- 3.7.1 Requirement Appendix A1:Multi-tenant service provider (previously called shared service provider) requirements
- 3.7.2 Requirement Appendix A2: Secure transmission of CHD from payment devices (cryptography for data in motion)
- 3.7.3 Requirement Appendix A3: Designated Entities Supplemental Validation (DESV)
3.8 Controls to consider when using, and to protect from, genAI/LLM
- 3.8.1 Controls when using genAI
- 3.8.2 Use of genAI to supplement controls
- 3.8.3 Impact of genAI and similar tools on the threat landscape
3.9 Addressing compliance gaps - prioritization
3.10 When you cannot meet the “defined approach” as is
- 3.10.1 Compensating Controls - the old way
- 3.10.2 Customized Approach - the new way
3.11 Total Cost of Ownership (TCO) and Return-on-Investment (ROI)
End Notes - Volume 3
Appendix 3A - Network Primer
Appendix 3B - A primer on encryption

Table of Content - Volume 4 (PCI DSS 4.0.1 edition)

Mon, 01 Jan 0001 00:00:00 +0000

Back to books home

Volume 4 - Hypothetical Case Studies - From Jane’s Flower Attic to Jane’s Flower Emporium (PCI DSS 4.0.1 edition)

Volume 4 - Hypothetical Case Studies
4.1 Volume Introduction
- 4.1.1 Assumptions
4.2 Jane’s journey - Step 1 - A small side business
- 4.2.1 Jane’s Flower Attic (JFA) business
- 4.2.2 Applying SAQ-B-IP using a cellular network connection to the payment device
4.3 - Step 2 - Jane’s Flower Boutique (JFB)
- 4.3.1 JFB Network Security Control (NSC, e.g. firewall) standard
4.4 Step 3 - Jane’s Flower Chain (JFC)
- 4.4.1 Network level controls
- 4.4.2 Identification and Authentication controls
- 4.4.3 Physical security controls
- 4.4.4 System level controls
- 4.4.5 Application level controls
- 4.4.6 Logging and Monitoring
- 4.4.7 Testing
- 4.4.8 Governance, Policies, Procedures
- 4.4.9 Incident Response
4.5 - Step 4 - Jane’s Flower Depot (JFD)
4.6 - Step 4 - Jane’s Flower Emporium (JFE)
- 4.6.1 JFE Organizational Structure
- 4.6.2 Best-practice in information security governance - Information security separate from IT
- 4.6.3 Payment transactions
- 4.6.4 Card present payments in stores and at delivery
- 4.6.5 Customer Service and MOTO transactions
- 4.6.6 eCommerce
- 4.6.7 The Information Security Program (based on ISO 27002)
End Notes - Volume 4
Appendix 4A - JFA Information Security Policy (simplified example)
Appendix 4B - JFB NSC (firewall) standard
Appendix 4C - JFC Incident Response Plan
Appendix 4D - JFD Payment Device Tampering Review Process
Appendix 4E - JFE Information Security Policy
Appendix 4F - JFE Risk Assessment