PCI ISA Fundamentals Exam with accurate ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
detailed solutions ||\\//||
Methods identified as being used to remove stolen data from the environments: ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Use of stolen credentials to access the POS environment
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Outdated patches or poor system patching processes
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- The use of default or static vendor credentials / brute force
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- POS skimming malware being installed on POS controllers
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- POI physical skimming devices
||\\//|| ||\\//|| ||\\//|| ||\\//||
95% of breaches feature||\\//|| ||\\//|| ||\\//||
The use of stolen credentials leveraging vendor remote access to hack into customers POS
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
environments.
Skimming
Copying payment card numbers either by tampering with: ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- POS Devices
||\\//|| ||\\//||
- ATMs
||\\//||
- Kiosks
||\\//||
Or by copying the card's magnetic stripe manually using handheld skimmers.
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
,Phishing
Reconnaissance
- Information gathering from various online sources and social networking sites
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Business applications and software
||\\//|| ||\\//|| ||\\//|| ||\\//||
Social Engineering ||\\//||
- Phishing emails or messages coming from a target's social network
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Phone call from an assumed known entity
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
Break-In
- Delivery through email
||\\//|| ||\\//|| ||\\//||
- Software vulnerabilities
||\\//|| ||\\//||
Common methods for monetizing stolen card data:||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Skimmed full track data and transaction information used to replicate a physical payment
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
card, which can then be used for fraudulent transactions in face-to-face environments, or
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
ATM transactions
||\\//||
,- Captured cardholder data is used where card-not-present transactions are accepted, such
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
as e-commerce or mail-order / telephone order (MO/TO) transactions
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Stolen cardholder data and sensitive authentication data are sold in bulk to other
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
criminals who perform their own fraud using the stolen data ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
Commonly targeted industries ||\\//|| ||\\//||
- Retail - 45% of breaches
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Food and Beverage - 24% of breaches
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Hospitality - 9% of breaches
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Financial Services - 7% of breaches
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Nonprofit - 3%
||\\//|| ||\\//|| ||\\//||
PCI SSC founding payment brands include:
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- American Express
||\\//|| ||\\//||
- Discover Financial
||\\//|| ||\\//||
- JCB International
||\\//|| ||\\//||
- MasterCard
||\\//||
- Visa, Inc.
||\\//|| ||\\//||
PCI DSS: ||\\//||
, Covers security of the environments that store, process, or transmit account data
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Environments receive account data from payment applications and other sources (e.g.,
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
acquirers)
PCI PA-DSS ||\\//||
Covers secure payment applications to support PCI DSS compliance
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
Payment application receives account data from PIN-entry devices (PEDs) or other devices
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
and begins payment transaction
||\\//|| ||\\//|| ||\\//||
PCI P2PE ||\\//||
Covers encryption, decryption, and key management requirements for point-to-point
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
encryption solutions ||\\//||
PCI PTS - POI ||\\//|| ||\\//|| ||\\//||
Covers the protection of sensitive data at point-of-interaction devices and their secure
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
components, including cardholder PINs and account data, and the cryptographic keys used ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
in connection with the protection of that cardholder data
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
PCI PTS - PIN Security||\\//|| ||\\//|| ||\\//|| ||\\//||
Covers secure management, processing and transmission of personal identificationnumber
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
(PIN) data during online and offline payment card transaction processing
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
detailed solutions ||\\//||
Methods identified as being used to remove stolen data from the environments: ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Use of stolen credentials to access the POS environment
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Outdated patches or poor system patching processes
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- The use of default or static vendor credentials / brute force
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- POS skimming malware being installed on POS controllers
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- POI physical skimming devices
||\\//|| ||\\//|| ||\\//|| ||\\//||
95% of breaches feature||\\//|| ||\\//|| ||\\//||
The use of stolen credentials leveraging vendor remote access to hack into customers POS
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
environments.
Skimming
Copying payment card numbers either by tampering with: ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- POS Devices
||\\//|| ||\\//||
- ATMs
||\\//||
- Kiosks
||\\//||
Or by copying the card's magnetic stripe manually using handheld skimmers.
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
,Phishing
Reconnaissance
- Information gathering from various online sources and social networking sites
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Business applications and software
||\\//|| ||\\//|| ||\\//|| ||\\//||
Social Engineering ||\\//||
- Phishing emails or messages coming from a target's social network
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Phone call from an assumed known entity
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
Break-In
- Delivery through email
||\\//|| ||\\//|| ||\\//||
- Software vulnerabilities
||\\//|| ||\\//||
Common methods for monetizing stolen card data:||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Skimmed full track data and transaction information used to replicate a physical payment
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
card, which can then be used for fraudulent transactions in face-to-face environments, or
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
ATM transactions
||\\//||
,- Captured cardholder data is used where card-not-present transactions are accepted, such
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
as e-commerce or mail-order / telephone order (MO/TO) transactions
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Stolen cardholder data and sensitive authentication data are sold in bulk to other
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
criminals who perform their own fraud using the stolen data ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
Commonly targeted industries ||\\//|| ||\\//||
- Retail - 45% of breaches
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Food and Beverage - 24% of breaches
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Hospitality - 9% of breaches
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Financial Services - 7% of breaches
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Nonprofit - 3%
||\\//|| ||\\//|| ||\\//||
PCI SSC founding payment brands include:
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- American Express
||\\//|| ||\\//||
- Discover Financial
||\\//|| ||\\//||
- JCB International
||\\//|| ||\\//||
- MasterCard
||\\//||
- Visa, Inc.
||\\//|| ||\\//||
PCI DSS: ||\\//||
, Covers security of the environments that store, process, or transmit account data
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
- Environments receive account data from payment applications and other sources (e.g.,
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
acquirers)
PCI PA-DSS ||\\//||
Covers secure payment applications to support PCI DSS compliance
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
Payment application receives account data from PIN-entry devices (PEDs) or other devices
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
and begins payment transaction
||\\//|| ||\\//|| ||\\//||
PCI P2PE ||\\//||
Covers encryption, decryption, and key management requirements for point-to-point
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
encryption solutions ||\\//||
PCI PTS - POI ||\\//|| ||\\//|| ||\\//||
Covers the protection of sensitive data at point-of-interaction devices and their secure
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
components, including cardholder PINs and account data, and the cryptographic keys used ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
in connection with the protection of that cardholder data
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
PCI PTS - PIN Security||\\//|| ||\\//|| ||\\//|| ||\\//||
Covers secure management, processing and transmission of personal identificationnumber
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
(PIN) data during online and offline payment card transaction processing
||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//|| ||\\//||
