WEBVTT 00:00:01.040 --> 00:00:05.170 Let's look at some of the key PCI SSC qualifications and what they 00:00:05.170 --> 00:00:09.400 allow people to do, starting with a Qualified Security Assessor, or 00:00:09.400 --> 00:00:13.150 QSA, which is the most common PCI qualification. 00:00:14.040 --> 00:00:17.560 A QSA will have been trained in PCI DSS and also in 00:00:17.560 --> 00:00:19.110 what we're learning in this course, 00:00:19.290 --> 00:00:22.350 how payments work and the different roles of acquirers, 00:00:22.440 --> 00:00:24.150 brands, and issuers. 00:00:24.740 --> 00:00:26.700 At the end of their mandatory training, 00:00:26.740 --> 00:00:29.980 they have to sit an exam, and if they pass the exam, they are 00:00:29.990 --> 00:00:33.760 authorized to conduct PCI DSS assessments of organizations. 00:00:34.140 --> 00:00:37.320 Remember, QSAs work for companies that have been approved by 00:00:37.320 --> 00:00:41.660 the PCI SSC to carry out PCI DSS assessments. 00:00:42.840 --> 00:00:48.220 The Internal Security Assessor, or ISA, works for an organization 00:00:48.220 --> 00:00:51.710 that handles cardholder data, so that's typically a merchant, or a 00:00:51.710 --> 00:00:54.850 service provider to a merchant, or a financial institution like an 00:00:54.850 --> 00:00:56.160 issuer or an acquirer. 00:00:56.840 --> 00:01:02.150 The organization must be a PCI participating organization, so that means it has 00:01:02.150 --> 00:01:07.050 a relationship with the PCI SSC that allows them to have ISAs, and it also 00:01:07.050 --> 00:01:10.060 allows them to attend the annual PCI Community Meeting. 00:01:10.840 --> 00:01:15.670 The ISA is trained to exactly the same standards as a QSA. So they've 00:01:15.670 --> 00:01:19.730 been trained in PCI DSS, and therefore, they are authorized to 00:01:19.730 --> 00:01:25.370 conduct PCI DSS assessments if the card scheme or card brand allows 00:01:25.370 --> 00:01:27.360 an ISA to conduct an assessment. 00:01:28.040 --> 00:01:32.700 Some card schemes do allow ISAs to conduct PCI DSS assessments for 00:01:32.700 --> 00:01:38.310 some types of merchants and other card schemes don't. Typically, an 00:01:38.320 --> 00:01:42.480 ISA is going to be working for the internal audit department. To do 00:01:42.480 --> 00:01:46.100 an internal assessment, the assessor has to be independent from the 00:01:46.100 --> 00:01:49.130 people that are making the controls and the requirements and the 00:01:49.130 --> 00:01:50.150 security happen. 00:01:51.540 --> 00:01:55.400 All of the other types of assessors for the other PCI standards, 00:01:55.560 --> 00:02:01.860 such as Secure Software, P2PE, 3DS, PIN, and Card Production all 00:02:01.860 --> 00:02:04.860 have to be PCI DSS QSAs first. 00:02:05.240 --> 00:02:09.060 Then they take the mandatory training and another exam in the other 00:02:09.060 --> 00:02:11.450 standard they want to be able to assess against. 00:02:12.340 --> 00:02:16.450 Typically, they will need to demonstrate some specialist technical knowledge 00:02:16.470 --> 00:02:20.560 alongside knowledge of the particular standard, and that's largely going to be 00:02:20.560 --> 00:02:22.960 in relation to cryptography and key management, 00:02:23.440 --> 00:02:27.000 enhanced levels of physical security that apply to secure 00:02:27.000 --> 00:02:30.130 zones, and then for the software standard, 00:02:30.200 --> 00:02:35.070 secure software development and programming knowledge. A Qualified 00:02:35.070 --> 00:02:38.830 Integrator and Reseller, or QIR, works for a company that installs 00:02:38.830 --> 00:02:42.360 point‑of‑sale software in retail merchants. That's the software that 00:02:42.360 --> 00:02:44.360 sits on the electronic cash registers. 00:02:45.040 --> 00:02:47.580 Often this software is going to be compliant with the 00:02:47.580 --> 00:02:50.620 Secure Software Standard or previously would have been 00:02:50.620 --> 00:02:54.060 validated to the PCI PA‑DSS standard. 00:02:54.640 --> 00:02:55.030 Now, 00:02:55.040 --> 00:02:58.550 many breaches in retail environment have been caused by payment 00:02:58.550 --> 00:03:01.590 software being installed and configured badly, 00:03:01.590 --> 00:03:02.730 for example, 00:03:02.730 --> 00:03:06.140 by leaving all the system passwords for the whole company as the 00:03:06.140 --> 00:03:08.510 default password as it came from the manufacturer. 00:03:08.590 --> 00:03:11.950 So that makes it very easy for the criminals to steal cardholder data. 00:03:12.640 --> 00:03:16.530 So the QIR program was developed to train people that install those 00:03:16.530 --> 00:03:19.360 types of systems on how to configure them securely. 00:03:19.840 --> 00:03:23.820 And some card schemes have made the use of a QIR mandatory now for 00:03:23.820 --> 00:03:28.790 face‑to‑face retailers. An approved scanning vendor provides 00:03:28.800 --> 00:03:31.750 external vulnerability scans to organizations. 00:03:32.240 --> 00:03:36.450 An external vulnerability scan is software that probes an organization's 00:03:36.460 --> 00:03:39.890 internet‑facing systems to look for known vulnerabilities or 00:03:39.890 --> 00:03:43.060 misconfigurations that could be exploited by an attacker. 00:03:43.840 --> 00:03:46.960 These types of scans are very important in keeping data 00:03:46.960 --> 00:03:50.660 secure because in the early days of the internet when people 00:03:50.660 --> 00:03:52.540 really didn't understand security, 00:03:52.630 --> 00:03:55.250 they just connected stores and web servers to the internet 00:03:55.250 --> 00:03:58.650 without a firewall. Forcing organizations to have scans and 00:03:58.650 --> 00:04:01.570 remediate vulnerabilities was an initiative from one of the 00:04:01.570 --> 00:04:03.850 card brands to improve security. 00:04:04.340 --> 00:04:07.720 So their program for accrediting scanning vendors and 00:04:07.720 --> 00:04:11.560 requiring scans became part of the PCI program. 00:04:12.140 --> 00:04:16.779 Some card brands still require companies to have external scans and 00:04:16.779 --> 00:04:20.779 report the findings to their acquirer, but it is now also a requirement 00:04:20.779 --> 00:04:27.990 in PCI DSS. The PCI program for ASVs has requirements for the operation 00:04:27.990 --> 00:04:32.080 of the scanning tool, and then also, the personnel in the ASV company 00:04:32.080 --> 00:04:33.160 have to be trained. 00:04:34.640 --> 00:04:40.920 The PCI Forensics Investigator, or PFI, is a QSA who's had extensive 00:04:40.920 --> 00:04:43.760 training and experience in computer forensics. 00:04:44.340 --> 00:04:50.400 Their role is to determine what happens after a breach of cardholder data. So 00:04:50.400 --> 00:04:54.860 they will come in, they will try and determine the cause of the breach, and 00:04:54.860 --> 00:04:59.040 they will make sure that the breach has been sealed and that the criminal is no 00:04:59.040 --> 00:05:01.840 longer active in the company's network. 00:05:02.040 --> 00:05:05.860 Now, I've met some of these people, and they're generally very nice people, 00:05:06.240 --> 00:05:08.660 but I do hope you never have the opportunity to work with 00:05:08.660 --> 00:05:11.590 them on a professional basis because that would imply you've 00:05:11.590 --> 00:05:13.350 had a breach of cardholder data.