Both sets of business projects for your Course Project require adherence to PCI-DSS standards. You have been requested to create a power point in which you will present t
Both sets of business projects for your Course Project require adherence to PCI-DSS standards. You have been requested to create a power point in which you will present the:
- Need for training.
- The basic outline/idea of the training.
- The learning objectives you intend on meeting with the training.
- The differentiation of the groups. (For this part, identify what you will communicate to the different groups targeted by your program.)
- The methods of determination for success.
Review the following document, and use it as a basis for you your presentation:
PCI-DSS Best Practices for Implementing a Security Awareness Program.pdf
Create a minimum ten (10) slide PowerPoint presentation in which you:
- Illustrate your recommendations and justifications.
- Create bulleted speaking notes for your presentation to the executive board in the notes section of the PowerPoint.
- Note: You may create or assume any fictitious names, data, or scenarios that have not been established in this assignment for a realistic flow of communication.
- Use a professional and technical style to convey the information.
- Use at least three (3) quality resources as references in this assignment. Wikipedia and similar Websites do not qualify as quality resources.
Submit your completed assignment by following the directions linked below. Please check the Course Calendar for specific due dates.
Standard: PCI Data Security Standard (PCI DSS)
Version: 1.0
Date: October 2014
Author: Security Awareness Program Special Interest Group
PCI Security Standards Council
Information Supplement:
Best Practices for Implementing a Security Awareness Program
The intent of this document is to provide supplemental information. Information provided here does not replace or supersede requirements in any PCI SSC Standard.
ii
Information Supplement • Best Practices for Implementing a Security Awareness Program • October 2014
Table of Contents
1 Introduction………………………………………………………………………………………………………………………………….. 1
1.1 Importance of Security Awareness ………………………………………………………………………………………………… 1
1.2 Intended Audience ………………………………………………………………………………………………………………………. 2
1.3 Terminology ……………………………………………………………………………………………………………………………….. 2
2 Best Practices in Organizational Security Awareness ……………………………………………………………………. 3
2.1 Assemble the Security Awareness Team ……………………………………………………………………………………….. 3
2.2 Determine Roles for Security Awareness ……………………………………………………………………………………….. 3
2.2.1 Identify levels of responsibility …………………………………………………………………………………………………. 3
2.2.2 Establish Minimum Security Awareness …………………………………………………………………………………… 4
2.2.3 Determine the content of training and applicability based on PCI DSS …………………………………………. 5
2.3 Security Awareness throughout the Organization ……………………………………………………………………………. 5
3 Security Awareness Training Content …………………………………………………………………………………………… 7
3.1 All Personnel………………………………………………………………………………………………………………………………. 8
3.2 Management ………………………………………………………………………………………………………………………………. 9
3.3 Specialized Roles ……………………………………………………………………………………………………………………….. 9
3.3.1 Cashier/Accounting Staff ………………………………………………………………………………………………………. 10
3.3.2 Procurement Team ………………………………………………………………………………………………………………. 10
3.3.3 IT Administrators and Developers ………………………………………………………………………………………….. 10
3.4 Define Metrics to Assess Awareness Training ………………………………………………………………………………. 11
4 Security Awareness Program Checklist ………………………………………………………………………………………. 12
Appendix A: Sample Mapping of PCI DSS Requirements to Different Roles, Materials and Metrics ……….. 13
Appendix B: Security Awareness Program Record ………………………………………………………………………………. 20
Acknowledgements …………………………………………………………………………………………………………………………….. 24
The intent of this document is to provide supplemental information. Information provided here does not replace or supersede requirements in any PCI SSC Standard.
1
Information Supplement • Best Practices for Implementing a Security Awareness Program • October 2014
1 Introduction
In order for an organization to comply with PCI DSS Requirement 12.6, a formal security awareness program
must be in place. There are many aspects to consider when meeting this requirement to develop or revitalize
such a program. The best practices included in this information supplement are intended to be a starting point
for organizations without a program in place, or as a minimum benchmark for those with existing programs
that require revisions to:
Meet PCI DSS requirements;
Address the quickly and ever-changing data security threat environment;
Reinforce the organization’s business culture.
Establishing and maintaining information-security awareness through a security awareness program is vital to
an organization’s progress and success. A robust and properly implemented security awareness program
assists the organization with the education, monitoring, and ongoing maintenance of security awareness
within the organization.
This guidance focuses primarily on the following best practices:
Organizational Security Awareness: A successful security awareness program within an organization
may include assembling a security awareness team, role-based security awareness, metrics,
appropriate training content, and communication of security awareness within the organization.
Security Awareness Content: A critical aspect of training is the determination of the type of content.
Determining the different roles within an organization is the first step to developing the appropriate type
of content and will also help determine the information that should be included in the training.
Security Awareness Training Checklist: Establishing a checklist may help an organization when
developing, monitoring, and/or maintaining a security awareness training program.
The information in this document is intended as supplemental guidance and does not supersede, replace, or
extend PCI DSS requirements. While all references made in this document are to PCI DSS version 3.0, the
general principles and practices offered here may be applied to any version of PCI DSS.
1.1 Importance of Security Awareness
One of the biggest risks to an organization’s information security is often not a weakness in the technology
control environment. Rather it is the action or inaction by employees and other personnel that can lead to
security incidents—for example, through disclosure of information that could be used in a social engineering
attack, not reporting observed unusual activity, accessing sensitive information unrelated to the user’s role
without following the proper procedures, and so on. It is therefore vital that organizations have a security
awareness program in place to ensure employees are aware of the importance of protecting sensitive
information, what they should do to handle information securely, and the risks of mishandling information.
Employees’ understanding of the organizational and personal consequences of mishandling sensitive
information is crucial to an organization’s success. Examples of potential consequences may include
The intent of this document is to provide supplemental information. Information provided here does not replace or supersede requirements in any PCI SSC Standard.
2
Information Supplement • Best Practices for Implementing a Security Awareness Program • October 2014
penalties levied against the organization, reputational harm to the organization and employees, and impact to
an employee’s job. It is important to put potential organizational harm into perspective for personnel, detailing
how such damage to the organization can affect their own roles.
1.2 Intended Audience
This guidance is intended for any organization required to meet PCI DSS Requirement 12.6 to implement a
formal security awareness program within their organization. The guidance is applicable to organizations of all
sizes, budgets, and industries.
1.3 Terminology
Data Loss Prevention (DLP) Scanning: A process of monitoring and preventing sensitive data from leaving
a company environment.
Phishing: A form of social engineering where an attempt to acquire sensitive information (for example,
passwords, usernames, payment card details) from an individual through e-mail, chat, or other means. The
perpetrator often pretends to be someone trustworthy or known to the individual.
Privileged Access: Users who generally have elevated rights or access above that of a general user.
Typically, privileged access is given to those users who need to perform administrative-level functions or
access sensitive data, which may include access to cardholder data (CHD). Privileged Access may
encompass physical and/or logical access.
Social Engineering: As defined by (ISC) 2 : An attack based on deceiving users or administrators at the target
site—for example, a person who illegally enters computer systems by persuading an authorized person to
reveal IDs, passwords, and other confidential information.
The intent of this document is to provide supplemental information. Information provided here does not replace or supersede requirements in any PCI SSC Standard.
3
Information Supplement • Best Practices for Implementing a Security Awareness Program • October 2014
2 Best Practices in Organizational Security Awareness
Security awareness should be conducted as an on-going program to ensure that training and knowledge is
not just delivered as an annual activity, rather it is used to maintain a high level of security awareness on a
daily basis.
Protecting cardholder data (CHD) should form part of any organization-wide information security awareness
program. Ensuring staff is aware of the importance of cardholder data security is important to the success of a
security awareness program and will assist in meeting PCI DSS Requirement 12.6.
2.1 Assemble the Security Awareness Team
The first step in the development of a formal security awareness program is assembling a security awareness
team. This team is responsible for the development, delivery, and maintenance of the security awareness
program. It is recommended the team be staffed with personnel from different areas of the organization, with
differing responsibilities representing a cross-section of the organization. Having a team in place will help
ensure the success of the security awareness program through assignment of responsibility for the program.
The size and membership of the security awareness team will depend on the specific needs of each
organization and its culture.
2.2 Determine Roles for Security Awareness
Role-based security awareness provides organizations a reference for training personnel at the appropriate
levels based on their job functions. The training can be expanded upon—and subject areas combined or
removed—according to the levels of responsibility and roles defined in the organization. The goal is to build a
reference catalogue of various types and depths of training to help organizations deliver the right training to
the right people at the right time. Doing so will improve an organization’s security as well as help maintain PCI
DSS compliance. Whether the focus is a singular, holistic, or a tiered approach, the content can be scoped to
meet an organization’s requirements.
All types of roles may not apply to all organizations, and some roles may need to be divided into subsections
to align with responsibilities. This can be modified according to the requirements of the organization.
2.2.1 Identify levels of responsibility
The first task when scoping a role-based security awareness program is to group individuals according
to their roles (job functions) within the organization. A simplified concept of this is shown in Figure 1 on
the following page.
The intent of this document is to provide supplemental information. Information provided here does not replace or supersede requirements in any PCI SSC Standard.
4
Information Supplement • Best Practices for Implementing a Security Awareness Program • October 2014
Figure 1: Security Awareness Roles for Organizations
The diagram above identifies three types of roles, All Personnel, Specialized Roles, and
Management. A solid awareness program will help All Personnel recognize threats, see security as
beneficial enough to make it a habit at work and at home, and feel comfortable reporting potential
security issues. This group of users should be aware of the sensitivity of payment card data even if their
day-to-day responsibilities do not involve working with payment card data.
Additional training for those in Specialized Roles should focus on the individual’s obligation to follow
secure procedures for handling sensitive information and recognize the associated risks if privileged
access is misused. Examples of users in this category may include those processing payment cards,
writing applications that process payment cards, building databases to hold CHD, or designing and
building networks that CHD traverses. Each of these specialized roles requires additional training and
awareness to build and maintain a secure environment. Additionally, specific training may be required to
include understanding of PCI DSS and PA-DSS requirements.
Management has additional training needs that may differ from the two previous areas. Management
needs to understand the organization’s security policy and security requirements enough to discuss and
positively reinforce the message to staff, encourage staff awareness, and recognize and address
security related issues should they occur. The security awareness level of management may also need
to include an overall understanding of how the different areas fit together. Accordingly, managers of staff
with privileged access should have a solid understanding of the security requirements of their staff,
especially those with access to sensitive data. Management training will also help with decisions for
protecting the organization’s information.
2.2.2 Establish Minimum Security Awareness
Establishing a minimum awareness level for all personnel can be the base of the security awareness
program. Security awareness may be delivered in many ways, including formal training, computer-based
training, e-mails and circulars, memos, notices, bulletins, posters, etc. The security awareness program
The intent of this document is to provide supplemental information. Information provided here does not replace or supersede requirements in any PCI SSC Standard.
5
Information Supplement • Best Practices for Implementing a Security Awareness Program • October 2014
should be delivered in a way that fits the overall culture of the organization and has the most impact to
personnel.
The following diagram depicts how the depth of awareness training should increase as the level of risk
associated with different roles.
Figure 2: Depth of Security Awareness Training
2.2.3 Determine the content of training and applicability based on PCI DSS
Training content can be broken down further to map to applicable PCI DSS requirements. Appendix A
contains a chart listing the high-level requirements of PCI DSS, with examples of roles listed that may
need security awareness training in these control areas. Section 3, Security Awareness Training
Content, contains further information related to training content for the different levels within an
organization.
2.3 Security Awareness throughout the Organization
The key to an effective security awareness program is in targeting the delivery of relevant material to the
appropriate audience in a timely and efficient manner. To be effective, the communication channel should
also fit the organization’s culture. By disseminating security awareness training via multiple communication
channels, the organization ensures that personnel are exposed to the same information multiple times in
different ways. This greatly improves how people remember the information presented to them. Content may
need to be adapted depending on the communication channel—for example, the content in an electronic
bulletin may be different than content in an instructor-led training seminar, even though both have the same
underlying message. The communication channel used should match the audience receiving the training
content and the type of content, as well as the content itself.
The intent of this document is to provide supplemental information. Information provided here does not replace or supersede requirements in any PCI SSC Standard.
6
Information Supplement • Best Practices for Implementing a Security Awareness Program • October 2014
Electronic communication methods can include e-mail notifications, eLearning, internal social media, etc. It is
important to target electronic security awareness notifications to the appropriate audience to ensure the
information is read and understood. It is easier for electronic notifications to go unread or ignored by busy
personnel. By targeting the material and communication channel to relevant personnel, the security
awareness team can improve adoption of the security awareness program.
Non-electronic notifications may include posters, internal mailers, newsletters, and instructor-led training
events. In-person security awareness events that involve active participation by personnel can be extremely
effective. Audience size in an instructor-led presentation is important: the larger the group, the greater risk
that content may not be communicated effectively, as individuals may lose focus on the material presented if
they do not feel engaged. Including activities that engage the audience, such as scenario-based activities,
helps ensure the concepts are understood and remembered. For example, a structured social-engineering
exercise will teach personnel quickly how to identify a social-engineering attack and react appropriately.
Internal seminars, training provided during lunch breaks (commonly called “lunch-and-learns” or “brown bag”),
and employee social events are also great opportunities for the security awareness team to interact with
personnel and introduce security concepts. Appendix B provides a list of the common methods to
communicate security awareness throughout the organization.
It is recommended that communication of security awareness be included in new-hire processes, as well as
role changes for existing personnel. Security awareness training may be combined with other organizational
requirements, such as confidentiality and ethics agreements. Each job position in the organization should be
identified based on level of data access required. See Section 2.2, Determine Roles for Security Awareness,
for more information. To ensure that the security awareness team is notified whenever a role identified as
needing security awareness is filled, it is recommended this step be included in the process for all new-
hire/re-classifications. Inclusion in the new-hire/re-classification process ensures the overall training goals are
promoted without reliance on individual organizational units.
Management leadership and support for the security awareness program is crucial to its successful adoption
by staff. Managers are encouraged to:
Actively encourage personnel to participate and uphold the security awareness principles.
Model the appropriate security awareness approach to reinforce the learning obtained from the
program.
Include security awareness metrics into management and staff performance reviews.
The intent of this document is to provide supplemental information. Information provided here does not replace or supersede requirements in any PCI SSC Standard.
7
Information Supplement • Best Practices for Implementing a Security Awareness Program • October 2014
3 Security Awareness Training Content
As discussed in Section 2.2, Determining Roles of Security Awareness, it is recommended training content be
determined based on the role and the organization’s culture. The security awareness team may wish to
coordinate with the appropriate organizational units to classify each role in order to determine the level of
security awareness training required for those specific job duties. This is vital in development of content, as it
is just as easy to “over-train” an employee as it is to “under-train” an employee. In both cases, if information is
not properly absorbed, it could lead to unnecessary organizational risk. Regardless of role, it is recommended
that all staff receive basic security awareness training, developed in accordance with organizational policy. In
addition to general security awareness training, it is recommended personnel be exposed to general concepts
of cardholder data security, to promote proper data handling throughout the organization, according to their
role in the organization.
Training materials should be available for all areas of the organization. Security awareness and training
materials may be developed in-house, adapted from a professional organization’s work, or purchased from a
vendor. There are security awareness vendors that provide prepared materials such as computer-based
training (CBT), posters, and newsletters. For example, PCI SSC and other eLearning vendors offer training on
topics such as understanding PCI DSS, secure password practices, avoiding social engineering, avoiding
malicious downloads, etc.
The following are examples of reference materials that may help in the development of a Security Awareness
Program:
National Institute of Standards and Technology (NIST) Special Publication 800-50, Building an
Information Technology Security Awareness and Training Program, www.nist.gov
International Standards Organization (ISO) 27002:2013, Information technology — Security techniques
— Code of practice for information security controls, www.iso.org
International Standards Organization (ISO) 27001:2013, Information technology — Security techniques
— Information security management systems, www.iso.org
COBIT 5 Appendix F.2, Detailed Guidance: Services, Infrastructure and Applications Enabler, Security
Awareness, www.isaca.org/cobit
Additionally, due to the increased focus on cyber security awareness, many government agencies and
industry bodies provide training materials to the public at no cost.
Choosing which materials to use in a security awareness training program is highly dependent on the
organization. Each organization should consider the time, resources, and culture when selecting the materials
to use for the security awareness training. Please see “Training Materials” in Appendix A for more
information and examples. All best practices listed here may be included in an organization’s security
awareness program; however, the best practices are not a requirement.
The intent of this document is to provide supplemental information. Information provided here does not replace or supersede requirements in any PCI SSC Standard.
8
Information Supplement • Best Practices for Implementing a Security Awareness Program • October 2014
3.1 All Personnel
It is recommended that general security training for all personnel include defining what constitutes cardholder
data (CHD) and sensitive authentication data (SAD) and the organization’s responsibility to safeguard both. A
high level overview of the importance of the PCI DSS may also be included; to ensure personnel fully
understands the purpose behind an organizational policy to safeguard cardholder data. To ensure all
personnel are engaged stakeholders in the security awareness program, the roles and responsibilities of all
staff to protect CHD and SAD should be outlined during all security awareness training, in accordance with
organizational policy.
Because data is at risk both in electronic form and in non-electronic (paper) form, it is recommended that the
different ways to safeguard information for different media be covered at a basic level for all personnel. For
instance, considerations for protecting data in electronic format may include secure storage, transmission and
disposal. Considerations for paper-based formats may also include secure storage and disposal as well as a
“clear desk” policy. Without an understanding of how different media types need to be protected, personnel
may inadvertently handle data in an insecure manner.
Another important consideration for inclusion in general security training is awareness of social engineering
attacks. One way an attacker may use social engineering is to acquire a user’s credentials and work their way
through the organization from a low-security area to a high security area. Tailoring this awareness to reflect
the types of attacks that the organization may encounter provides the most effective results. Users should be
aware of the common methods by which fraudsters, hackers or other malicious individuals might try to obtain
credentials, payment card data, and other sensitive data, to minimize the risk of personnel unintentionally
disseminating sensitive information to outsiders. Training in organizational policies and procedures that
specify proper data handling, including sharing and transmission of sensitive data, is also recommended.
The training program should require personnel to acknowledge they have received and understand the
content being delivered. This is crucial to the success of the security awareness program. If content is being
delivered and not understood, the employee may still inadvertently put the organization’s information at risk.
Feedback on training content and comprehension are key to ensuring personnel understand the content and
the organization’s security policies.
Below is an example of content that is commonly included in general security awareness training:
Organization’s Security awareness policy
Impact of unauthorized access (for example: to systems or facilities)
Awareness of CHD security requirements for different payment environments
Card present environments
Card-not-present environments
Phone (individual or call center)
Fax
Online (eCommerce)
Where to get further information on protecting CHD in the organization (for example, security officer,
management, etc.)
The intent of this document is to provide supplemental information. Information provided here does not replace or supersede requirements in any PCI SSC Standard.
9
Information Supplement • Best Practices for Implementing a Security Awareness Program • October 2014
Importance of strong passwords and password controls
Secure e-mail practices
Secure practices for working remotely
Avoiding malicious software – viruses, spyware, adware, etc.
Secure browsing practices
Mobile device security including BYOD
Secure use of social media
How to report a potential security incident and who to report it to (see PCI DSS Requirement 12.10)
Protecting against social engineering attacks
In Person – Physical Access
Phone – Caller ID Spoofing
E-mail – Phishing, Spear Phishing – E-mail Address Spoofing
Instant Messaging
Physical security
Shoulder Surfing
Dumpster Diving
NOTE: General security awareness training should be implemented even for organizations that outsource all
payment acceptance and processing, to ensure personnel are aware that sensitive information, including
CHD, must be protected.
3.2 Management
In addition to content for all personnel, management training should include more detailed information
regarding the consequences of a breach to management stakeholders. Management should understand not
only the monetary penalties of failing to safeguard CHD, but also the lasting harm to the organization due to
reputational (brand) damage. This factor is often overlooked when organizations outsource payment
processing, but is critically important.
As previously discussed, management will need to understand security requirements enough to discuss and
reinforce them, and encourage personnel to follow the requirements. It is recommended that management
security awareness training include specific co
Collepals.com Plagiarism Free Papers
Are you looking for custom essay writing service or even dissertation writing services? Just request for our write my paper service, and we'll match you with the best essay writer in your subject! With an exceptional team of professional academic experts in a wide range of subjects, we can guarantee you an unrivaled quality of custom-written papers.
Get ZERO PLAGIARISM, HUMAN WRITTEN ESSAYS
Why Hire Collepals.com writers to do your paper?
Quality- We are experienced and have access to ample research materials.
We write plagiarism Free Content
Confidential- We never share or sell your personal information to third parties.
Support-Chat with us today! We are always waiting to answer all your questions.