DotSec's AOC saves you money!

Payment card information remains one of the most targeted forms of data. For Australian organisations that store, process or transmit cardholder data, PCI DSS compliance is essential — not simply as an annual requirement, but as a way to reduce risk and improve the security of systems that support payment operations.

DotSec has more than 25 years of experience securing payment environments for government, APRA-regulated entities, financial institutions, utilities and national retail organisations. We focus on what PCI DSS was designed to achieve: practical, risk-driven improvements that reduce the likelihood and impact of compromise, not superficial checkbox activity.

PCI DSS compliance

DotSec is a PCI DSS compliant service provider and we’ll use this blog post to look specifically at what service providers need to know to operate within the context of the PCI DSS. And even if PCI DSS is not relevant to you, you might like to read on, anyhow: Whether you are a third-party service provider or the client of one, the ideas around formalisation and documentation of service-provider engagements and responsibility-allocation may still be of assistance.

The PCI DSS describes how a merchant may use a third-party service provider to:

Store, process, or transmit cardholder data on the merchant’s behalf, and/or
Manage components such as firewalls and routers, call centres and call recordings, databases, physical security, and/or servers, once again on the merchant’s behalf.

In either case, the service provider’s activities may impact the security of the Cardholder Data Environment (CDE). If that’s the case, then as noted in the DSS:

“There are two options for third-party service providers to validate [their] compliance:

Annual assessment: Service providers can undergo an annual PCI DSS assessment(s) on their own and provide evidence to their customers to demonstrate their compliance; or
Multiple, on-demand assessments: If they do not undergo their own annual PCI DSS assessments, service providers must undergo assessments upon request of their customers and/or participate in each of their customer’s PCI DSS reviews, with the results of each review provided to the respective customer(s)”

As part of our process of continuous improvement, we spent most of 2020 revising and improving our PCI DSS service provider policies, processes and personnel-training. As a result of that work (and yes, it was much harder than expected :-)) we are now able to confirm that DotSec has completed Self-Assessment Questionnaire D and an Attestation of Compliance (AOC) for Service Providers, with an overall COMPLIANT rating!

This achievement has significant benefits for DotSec’s customers:

As described in the PCI DSS, a service provider that provides services that can affect the security of the customer’s Card Holder Environment (CDE), but that cannot produce a SAQ D and AOC, will be brought into the scope of the customer’s PCI DSS assessment. This increases the customer’s compliance costs and also increases the risk of non-compliance since a non-compliant finding against the service provider will be reflected in the customer’s non-compliant SAQ or ROC.
By contrast, any of DotSec’s managed SIEM customers that need to comply with the PCI DSS can rely on DotSec’s SAQ D and AOC, thereby significantly reducing the scope, cost, complexity and risk of the customer’s PCI DSS compliance efforts.

About DotSec's managed SIEM (and the PCI DSS)

DotSec’s Managed SIEM service provides centralised aggregation and storage of event logs generated by customer systems that may be in-scope for PCI DSS compliance. In-scope systems are configured to forward event logs to the Managed SIEM environment which is deployed on AWS infrastructure, and DotSec cyber security professionals will use the Managed SIEM service to monitor log events and raise alerts when reportable (suspicious or anomalous) activity is detected.

DotSec is already a long-standing Payment Card Industry (PCI) Qualified Security Assessor (QSA) company meaning that DotSec is qualified to assess entities (including on-line merchants, payment processors and service providers) for compliance with the PCI Data Security Standard (DSS). Our completion of the AOC for Service Providers is further evidence of our commitment to payment card security and our process of continual improvement.

What about that responsibility thing?

Merchants and their service providers should clearly identify the services and system components which are included in the scope of the service provider’s PCI DSS assessment, the specific PCI DSS requirements covered by the service provider, and any requirements which the service provider’s customer must include in their own PCI DSS reviews.

Service providers are responsible for demonstrating their PCI DSS compliance, and may be required to do so by the payment brands. Service providers should contact their acquirer and/or payment brand to determine the appropriate compliance validation.

By way of example, here is a Responsibility Allocation Matrix (RAM) that is associated with one of our managed SIEM customers. As you can see, the RAM clearly allocates responsibility for each of the PCI DSS controls that are relevant to the managed SIEM service. The RAM is then referenced in the Service Level Agreement (SLA) and there is no confusion as to who was responsible for what when assessment time comes around.

Description	PCI DSS Req #	Who is Responsible?
Configure/maintain/patch all managed SIEM components.	2.1, 2.2, 2.3, 6.2, 6.4.5, 7.1, 7.2, 8.1, 8.2, 8.5	DotSec
Collect and secure audit trails via the managed SIEM so they cannot be altered	10.5.1, 10.5.2, 10.5.3, 10.5.4, 10.5.5, 10.5.6	DotSec
Monitor/review logs and security events forwarded to the managed SIEM and raise alerts in case of anomalies or suspicious activity	10.6.1, 10.6.2	DotSec
Prepare monthly monitoring report for Customer.	10.6.1, 10.6.2	DotSec
Retain audit trail history for at least one year, with a minimum of three months immediately available for analysis	10.7	DotSec
Monitor host log forwarding and raise alerts in case of failure.	10.8	DotSec
Monitor availability of the managed SIEM components, raise alerts in case of failure, and restore monitoring functionality in a timely manner.	10.8	DotSec
Monitor availability of OS platforms that host managed SIEM components and raise alerts in case of failure, and restore functionality in a timely manner.	10.8	DotSec
Configure/maintain/patch OS that runs the managed SIEM components.	2.1, 2.2, 2.3, 5.1, 5.2, 5.3, 6.2, 6.4.5, 7.1, 7.2, 8.1, 8.2, 8.3, 8.5 10.1, 10.2	DotSec
Configure/maintain/patch, and monitor the availability of the OSs that run any log-forwarding functionality and should such componenets fail, notify customer in a timely manner.	2.1, 2.2, 2.3, 5.1, 5.2, 5.3, 6.2, 6.4.5, 7.1, 7.2, 8.1, 8.2, 8.3, 8.5 10.1, 10.2, 10.8	DotSec
Install/maintain/patch in-scope hosts to generate and forward event log entries.	6.2, 10.1, 10.2, 10.3, 10.4, 10.5.3, 10.5.4	Customer
Remediate log-source and log-forwarding issues, and follow up on alerts and reports of anomalies and/or suspicious activity in a timely manner when notified by DotSec.	10.5.3, 10.5.4, 10.6.3	Customer
Maintain in-scope logging-host list and advise DotSec of additions/deletions to that list.	2.4, 10.5.3, 10.5.4	Customer

Conclusions

Standards like CPS 234 and the PCI DSS are becoming more relevant as cyber-security service providers are increasingly on the hook when it comes to the certification and accreditation of their paying clients. In order to reduce our clients’ risk and costs DotSec has therefore completed Self-Assessment Questionnaire D and an Attestation of Compliance (AOC) for Service Providers.

Please feel free to get in contact if you have any questions or comments, or would like to enquire further about our AOC.

[1] No, not Peter Parker in 2017… Winston Churchill in 1906… at least according to Wikipedia! 🙂

OUR CYBER SERVICES

ISO 27001 consulting

Practical and experienced Australian ISO 27001 and ISMS consulting services. We will help you to establish, implement and maintain an effective information security management system (ISMS).

Penetration tests

DotSec’s penetration tests are conducted by experienced, Australian testers who understand real-world attacks and secure-system development. Clear, actionable recommendations, every time.

PCI DSS

dotSec stands out among other PCI DSS companies in Australia: We are not only a PCI QSA company, we are a PCI DSS-compliant service provider so we have first-hand compliance experience.

WAF and app-sec

Web Application Firewalls (WAFs) are critical for protecting web applications and services, by inspecting and filtering out malicious requests before they reach your web servers

Identity management

Multi-Factor Authentication (MFA) and Single Sign-On (SSO) reduce password risks, simplify access, letting verified and authorised users reach sensitive systems, services and apps.

Vulnerability management

dotSec provides comprehensive vulnerability management services. And we analyse findings in the context of your specific environment, priorities and threat landscape.

Phishing and soc eng

We don’t just test whether users will click a suspicious link — we also run exercises, simulating phishing attacks that are capable of bypassing multi-factor authentication (MFA) protections.

Penetration testing

DotSec’s penetration testing services help you identify and reduce technical security risks across your applications, cloud services and internal networks. Clear, actionable recommendations, every time!

Managed SOC/SIEM

dotSec has provided Australian managed SOC, SIEM and EDR services for 15 years. PCI DSS-compliant and ISO 27001-certified. Advanced log analytics, threat detection and expert investigation services.

Secure configuration

We provide prioritised, practical guidance on how to implement secure configurations properly. Choose from automated deployment via Intune for Windows, Ansible for Linux or Cloud Formation for AWS.

Secure cloud hosting

Secure web hosting is fundamental to protecting online assets and customer data. We have over a decade of AWS experience providing highly secure, scalable, and reliable cloud infrastructure.

Essential eight

DotSec helps organisations to benefit from the ACSC Essential Eight by assessing maturity levels, applying practical security controls, assessing compliance, and improving resilience against attacks.

Advisory services

We have over 25 years of cyber security experience, providing practical risk-based guidance, advisory and CISO services to a wide range of public and private organisations across Australia.

DotSec's AOC saves you money!​