Jim Seaman - Pci Dss: An Integrated Data Security Standard Guide

Protected Category

Consequently, the value of ensuring that these assets were adequately protected was fully understood by the organization, and comprehensive defenses were applied using the Defence Manual of Security (Joint Service Publication (JSP) 440).

Each asset was categorized against the category descriptions (Figures) and afforded the appropriate levels of protection. The need for suitable protection was fully appreciated, and as a result, the concept of applying the minimum standard was never a consideration, with the protective measures being aligned with their perceived levels of risk.

Thus, during my 10 years working on Counter Intelligence duties, even through security risk assessments, I never heard the term compliant.Some of these principles and lessons learned have been incorporated into the development of this book.

The PCI DSS framework can be seen as being extremely complex, expensive, and difficult to achieve and maintain. However, the reality is that it provides a comprehensive suite of baseline of mitigation security controls to help businesses fortify their payment card operations and to help reduce the opportunist attackers to exploit bad practices. The cost of not, at least, establishing a baseline and allowing your payment card operations to be compromised or your customers payment card data to be stolen would far exceed time, resources, and costs associated with aligning with PCI DSS.

However, I wanted to design and develop a book that went a little bit further so as to expand on the intent of the PCI DSS framework, the objective being not to be a direct regurgitation of the underlying controls but to provide both Cyber/Information Security professionals and the companys key stakeholders with a comprehensive guide on the benefits of aligning your businesss payment card operations with the PCI DSS framework and how this might be applicable to different business types.

Consequently, the readers do not need to have a detailed understanding of the specifics of the PCI DSS framework(as the latest version and additional supplementary support information is made freely available in the PCI councils Document Library)to gain an improved appreciation for the framework and how it might be applicable to your organization.

Additionally, this guide provides examples of real-life events and incidents, where the attackers have pounced on vulnerabilities which would have been addressed through the implementation of the PCI DSS mitigating controls.

The readers of this book will gain an improved understanding of the principles and objectives of the 6 goals and 12 requirements of PCI DSS and how this can be used in support of building an effective data privacy and security strategy.

Having read this book, the readers will better appreciate how alignment with the PCI DSS framework should be seen as an important business investment, helping to defend the company from opportunist attackers and to reduce the risks associated with a compromise or data breach.