If PCI Is Your Whole Security Program, You’re Not Doing Your Job Right

For most CISOs, the pain of an audit is part of the job, but it doesn’t have to be the nightmare that most of the IT community envisions. While attending the SOURCE Boston conference last week, your faithful SecurityWeek correspondent attended a rather frank discussion centered on the pain of a PCI assessment, and why the said pain is completely unwarranted. Here’s a recap of the talk.

Presented by Michelle Klinger, a Sr. Consultant with EMC, and Martin Fisher, the Director of Information Security for WellStar Health System, the talk looked at the PCI assessment process from the perspective of a former QSA and an active security manager.

The goal was to highlight some basic processes that business leaders can follow in order to get through the assessment with as little stress as possible, a task that seems harder than it actually is.

Making the best of the situation

The talk started with a simple fact. Most of what those in the IT community think they know about PCI assessments is wrong.

“Horror stories that you’ve heard about assessments are generally that – horror stories,” Fisher said, expanding on his statement.

“Like most stories there’s two sides to it. Most of the horror stories that I’ve personally experienced, eighty percent of the blame went on the CISO at the time, and with the way he tried to manipulate the situation.”

At the same time, when the experience is a positive one, this too can be placed at the feet of the executive that is leading it. No matter what, the general tone of the process is set before the assessment starts.

Before The Assessment

One of the first things that a QSA will look to accomplish is the establishment of an initial rapport with the organization’s leadership and their teams. The idea is to discover what it is that the company is looking for. Obviously, Klinger explained, they want a compliant ROC (Report on Compliance), but what if there’s more? Organizations that are clear on what it is they hope to accomplish, such as using the ROC to push various security initiatives, will be helping themselves as well as the QSA in the long run.

The other side to this helpfulness is documentation. Assessments can sometimes require lots of documentation. Having the proper documents in place can mean the difference between a useless assessment, and one that actually gets stuff done, Klinger explained.

It isn’t as if the documents a QSA needs or how the validate the PCI process are a secret, it’s well documented. Yet this area sometimes causes problems, as organizations come to the table unprepared, which in turn leads to issues further on.

With that said, prior to the QSA arriving onsite, make sure that an agenda has been discussed previously and make sure that all the people need for the meeting are available and documents are in order to prevent time being wasted, Klinger added. The documentation itself should have timestamps and dates whenever possible, especially if they are screenshots.

The documentation should be as close to real time as possible, as to show what is going on in the organization’s environment.

Even better, when the documentation is collected, present it to the QSA as a map. This will enable the organization to show the QSA that document X is looking to satisfy requirement Y. In the long run, the document map is a timesaver and will benefit both sides of the process.

“From a CISO perspective, if you don’t start this process well you’re going to be hosed,” Fisher said. “While as a CISO or a director, you might not be able to pick the QSA firm... you do have the ability to choose who the individual assessor is. This is a critical, key first step.”

CISOs should interview potential QSA candidates as if they were interviewing an employee. For example, Fisher added, use hypothetical questions and situations. “If their personality is one that will rub everybody on your team wrong, don’t use that person.”

Another thing for CISOs to consider is the truth.

“You need to be honest as a CISO. I’m not saying it’s like walking into a confession booth, ‘forgive me assessor for I have sinned,’ and just lay everything out. I’m not advocating that at all. But don’t lie. Because once you’ve lost your credibility with the QSA, their only recourse is to do a fishing expedition. It’s ugly and it’s painful, and you don’t want to be there,” Fisher explained.

“You also need to make sure that your team understands that lying to the QSA, is going to give them the opportunity to add value to other organizations – other than your own – very quickly. Don’t tolerate it from your staff.”

During the Assessment

One of the things a QSA will look for is inconsistencies. This isn’t that they are searching for lies, but they are looking for communication breakdowns between policy makers and those with “boots on the ground.”

This is why making sure that the documentation is prepared, and the correct people with the relevant information are available from the start. It’s also why honesty is important. Communication breakdowns happen, and often no one is aware of them, so this provides an opportunity to correct them and better strengthen the organization.

“I can’t tell you how many times I’ve been stood up for meetings,” Klinger said. “The QSA, you have to understand, as well as the people being interviewed, want this to be done.”

Planning meetings with a QSA and then canceling them at the last moment or not showing up entirely wastes time, and time can translate into money. Cancelations are expected, but if a meeting has to be canceled, then there should be as much notice as possible and an alternative date and time proposed in order to reschedule.

It’s basic politeness in many cases, but it can go a long way towards keeping the assessment process smooth. The last thing an organization or its staff needs is a QSA hunting people down. Most times these meetings can be painful, which in some cases are why they’re avoided. But, Fisher added, the CISO should make it clear that the meetings are important and the pain from the meeting is nothing compared to the pain that could come from blowing them off or neglecting them.

Another thing for organizations to remember, particularly the CISO, is the importance of managerial support. CISOs need to be supportive of their teams during the process and encourage them to work with the QSA, not against them. Again, being honest and open will play a large role in this.

However, on the other side of support is influence. CISOs that try to strong arm the QSA, or improperly influence the process, will cause more harm than good. In short, this is a career-ending move in some business segments.

Never let the QSA to be in charge. They need scope and boundaries, and the CISO needs to enforce this. If the QSA doubts the CISO or his staff’s honestly, “you’re done,” Fisher explained.

“Their not going to believe anything you say. The assessment will take longer, and instead of giving you the benefit of the doubt on something that’s on the cusp – you’re toast.”

The bottom line is that given the fact that one cannot improperly influence the QSA or even appear as if they’re doing so, should there be a problem with the QSA, the CISO needs to address this with the QSA’s boss. However, if the QSA was interviewed previously, this shouldn’t be an issue.

After the Onsite Assessment

Before the QSA leaves, get a meeting with them to offer an overview of the major items that they’ve identified. This helps management get an idea on the level of effort needed for remediation. It also helps with identifying potential discrepancies.

In addition, the organization needs to make sure that outstanding items are delivered in a timely fashion. Outstanding items happen. This is part of the process, but it’s something that must be addressed sooner rather than later. Also, make sure that the QSA sends a list of findings is delivered.

CISOs should just expect this, but make sure that it’s clear to the QSA that this is to be delivered ASAP. The QSA is relying on the organization to review the findings and discuss them. As remediation begins, keep the QSA in the loop and communicate with them periodically as changes are made.

“The biggest mistake that too many CISOs make is they don’t realize the ROC is negotiable,” Fisher said.

“Now I’m not saying that you can bend reality. I’m not saying that at all. But for example, in certain industries, certain words [have different meanings]... If in your conversation with the assessor, if they keep using a word that to them is a middle sized problem, but in your world it means the four horsemen are saddling up, explain to them the cultural context of that word...”

Doing so, will the ROC to represent language that the organization’s board of directors and senior leadership understands. It also enables the CISO to ensure that the ROC is accurate.

From there, the CISO needs to use the ROC and determine where the organization “needs to go from here,” Fisher adds. However, while it is vital that the CISO form a plan, they cannot use the list of remediation items as their plan.

“If you do that, you suck,” he said. “PCI is not your whole program. If PCI is your whole program, you’re not doing your job right.”

In the end, assessments can be heaven or hell. “You either get a Scotch that’s warm and peaty or you get a warm bottle of Zima,” Fisher humorously concluded.

The quality of beverage (and the assessment) and the level of pain, is completely in the hands of the organization. With a little effort and some focus, it’s entirely possible for CISOs and their teams to not only survive a PCI assessment, but also survive it with their sanity intact.

SOURCE