Given emerging trend of fraud and breaches of cardholder data on the global payment system especially for card-not-present transactions, which have witnessed spike in breaches/frauds in recent times leading to financial loss and reputational damage to organizations, the need for organizations that collect, process, store and transmit cardholder information to be Payment Card Industry Data Security Standard (PCIDSS) compliant cannot be overemphasized. Stolen payment card records via unsecured applications, servers and/or networks has led to huge financial losses, reputational damages and litigations against financial institution, card issuers, acquirers and payment switches/processors that are found to be negligent. Applications and systems that stored, process, transmit and retrieve cardholder information have been seen to be vulnerable to attacks and all manner of security breaches due to poor configurations, inadequate security controls and non-adherence to standard operating procedures. Also, lack of good process controls has contributed to the failures in this regard. As such, it is important to promote good security practices and ensure that standard baseline configuration is enforced in these processes, systems and applications.
To ensure good risk management practice, it is important personnel with security oversight responsibilities over the payment card infrastructures and environment put in context organization’s uniqueness in terms of its information security policies, procedures, security baselines, regulatory and legal requirements while conducting their security assessment or reviews to know how best to protect them. Identifying vulnerabilities/risk inherent in the systems, processes and applications that transmit, store, process and retrieve cardholder information, their implication/impact to the business as well as the recommended countermeasure or risk treatment plan that will mitigate or eliminate the risk is what this book is meant to achieve.
This book is therefore a documentation of risks and vulnerabilities associated with Payment card environment and infrastructure (processes, systems and applications), threats and threat agents that could exploit those weaknesses, their impact on the organization and actions required to mitigate the risks. It serves as a risk assessment checklist/guide for risk assurance practitioners (IT Risk Manager, Cyber/Information Security Analysts, Information Systems Auditors and Systems Control Analysts) and enable them understand as well as identify some of the risks inherent in the infrastructures, implications/impact of such risks/vulnerabilities and ways to mitigate them. The book is a risk assessment checklist/program guide for risk assurance practitioners and provides unique/rich database of vulnerabilities/risk, control lapses, process failures and substandard practices associated with payment card environment. This risk assessment checklist can easily be integrated with popular audit management software such as teammatessolutions or MKinsight.
Intended for card issuers, acquirers, switches/processors, banks and other financial institutions desirous of building a risk management program around their payment card infrastructure and environment (processes, systems and applications) from the ground up or strengthen an existing one. Below are sample pages of the payment card environment risk assessment checklist/program. For full access to the document, you can subscribe to our membership plan for full access to all risk assessment checklists available on our site (this inclusive) or purchase only this book by clicking the Buy Now button below.