Task № 5_1.

PCI DSS standard read and review.

The control objectives are implemented via 12 requirements, as stated at

https://www.pcisecuritystandards.org/pci_security/maintaining_payment_securi
ty:
Please, review this standard and understand this 12 requirements:
1. Install and maintain a firewall configuration to protect cardholder data.
2. Do not use vendor-supplied defaults for system passwords and other security
parameters.
3. Protect stored cardholder data.
4. Encrypt transmission of cardholder data across open, public networks.
5. Use and regularly update anti-virus software or programs.
6. Develop and maintain secure systems and applications.
7. Restrict access to cardholder data by business need to know.
8. Assign a unique ID to each person with computer access.
9. Restrict physical access to cardholder data.
10. Track and monitor all access to network resources and cardholder data.
11. Regularly test security systems and processes.
12. Maintain a policy that addresses information security for employees and
contractors.

Task № 1.
Match each this requirement with appropriate SANS critical control.

The answer:

PCI DSS requirement SANS Critical control

1 Install and maintain a firewall 13 Network monitoring and defense
configuration to protect cardholder
data.
2. Do not use vendor-supplied 5 Account management, 6 access
defaults for system passwords and control management, 4 Secure
other security parameters. configuration of enterprise assets and
software
3. Protect stored cardholder data. 3 Data Protection
4. Encrypt transmission of cardholder 13 Network monitoring and defense
data across open, public networks.
5. Use and regularly update anti-virus 10. Malware Defenses
software or programs.
6. Develop and maintain secure 7 Continuous Vulnerability
systems and applications. management, 8, 10, 11, 13, 17
7. Restrict access to cardholder data 6 Access Control management
by business need to know.
8. Assign a unique ID to each person Audit Log management, account
with computer access. management
9. Restrict physical access to Inventory and control of enterprise
cardholder data. assets
10. Track and monitor all access to Audit log management
network resources and cardholder
data.
11. Regularly test security systems Penetration testing, Data recovery
and processes.
12. Maintain a policy that addresses Security awareness and skills training
information security for employees
and contractors.

GDPR standard review and understand.

https://www.itgovernance.eu/blog/en/the-gdpr-understanding-the-6-data-
protection-principles

Task № 2.
One company providing service of Taxi.
They need to comply with GDPR standard.
Company collects such information: Name, Phone number and geolocation.
Combination of these data – is a personally identifiable information.
 GDPR requirements:
1. End user’s information must be encrypted
2. Company must have a function to delete user information after his request.

We have a database in such view:

Name of client Phone number Location
//////////// ////////////// //////////
///////// /////////// ////////////

*//////////// -------- (encrypted form)

Which additional steps are necessary to implement?

The answer:
1. We need to add additional column – user id.
2. It is necessary to build the second database, which will have two
columns: 1 column with user id, the second column with phone number.
Database № 1
User id Name of client Phone number Location
1 ///////////// ////////////// //////////
2 ///////// /////////// ////////////

Database № 2.
User id Phone number
1 +7707777777
2

Combination user id with phone number – it is not a personally identifiable

information. So, we could store this information in clear text.
And we could find and delete person’s information after his request.