PCI DSS a Practical Guide to Implementation

PCI DSS: A Practical Guide to Implementation is written by Steve Wright, a consultant and lecturer with extensive experience in the design and implementation of security architecture and information security governance frameworks, including PCI DSS. Steve has successfully executed information security projects for several UK government agencies and has completed many consulting engagements for global corporations in sectors including business process outsourcing, manufacturing, telecoms, IT and healthcare. He currently manages a successful security management practice and is active as a lecturer and trainer on Information Risk Management and many British Computer Society ISEB courses. Not only does this book do the above, it also functions as a key support reference for those who are involved in the PCI compliance process in their day-to-day activities. If you are looking for a concise, straightforward and reliable reference to PCI DSS compliance, then this is the book you need. There is a large amount of information on the PCI DSS freely available, but it does not necessarily answer the fundamental questions you have. This is where this book excels, it covers most the ins and outs of PCI compliance.

Table of Contents:
BACKGROUND What is PCI? Why PCI? How does PCI compliance work? Getting started with PCI A prioritised approach to compliance The approach of this book CHAPTER 1: STEP 1 - ESTABLISHING THE PCI PROJECT What is the project initiation workshop objective? What are the workshop deliverables? CHAPTER 2: STEP 2 - DETERMINE THE SCOPE Scoping the PCI target environment The approach used to determine the exact scope CHAPTER 3: STEP 3 - REVIEW THE INFORMATION SECURITY POLICY CHAPTER 4: STEP 4 - CONDUCT GAP ANALYSIS Gap analysis objectives Gap analysis approach PCI gap analysis reporting and security improvement plan CHAPTER 5: STEP 5 - CONDUCT RISK ANALYSIS78 The goal of the risk management process The benefits of risk management The elements of the risk management process CHAPTER 6: STEP 6 - ESTABLISH THE BASELINE Build and maintain a secure network Protect cardholder data Maintain a vulnerability management programme Implement strong access control measures Regularly monitor and test networks Maintain an information security policy CHAPTER 7: STEP 7 - AUDITING Initiation of the audit (objectives and scope) Auditor preparation Conduct the audit Report the findings Agree follow-up action and clearance of any findings CHAPTER 8: STEP 8 - REMEDIATION PLANNING CHAPTER 9: STEP 9 - MAINTAINING AND DEMONSTRATING COMPLIANCE Validation requirements How to meet these requirements Using log management information for PCI compliance Regular monitoring and testing Arriving where you want to be: PCI compliant Demonstrating compliance - ROC CHAPTER 10: PCI DSS AND ISO27001 PCI and ISO27001 - the comparisons APPENDIX 1 - PROJECT CHECKLIST APPENDIX 2 - PCI DSS PROJECT PLAN APPENDIX 3 - BIBLIOGRAPHY AND SOURCE APPENDIX 4 - FURTHER USEFUL INFORMATION APPENDIX 5 - PCI DSS MAPPING TO ISO27001 ITG RESOURCES

About the Author :
Steve Wright is a 'security' subject matter expert in the area of information security and governance with years of experience in design and implementation of security architecture and information security governance frameworks. He also founded the UK ISO27002 information security knowledge portal - www.ISO27002.Info. Steve has successfully executed information security projects for a number of United Kingdom government agencies and has also provided information security consulting to a large number of government supporting organisations. In the commercial sector he has completed many consulting engagements for global clients, including business process and outsourcing providers, manufacturing, telecoms and IT providers, financial services and healthcare sectors. He is currently responsible for managing a successful security practice at PricewaterhouseCoopers (Risk Assurance Services). Steve has dual expertise as a hybrid technical and business information security consultant with a pragmatic and holistic approach to the management of information security.