PCI DSS Bootcamp: The A-Z™ Information Security Course

Learn who must comply with PCI DSS and why it matters for payments. PCI DSS is a standard for all handling cardholder data, with 12 requirements across four levels.

Trace the history of PCI DSS and payment security standards. Explore how CSP, versions 1.0–3.2.1, and tokenization support service providers in compliance.

Understand how a qualified security assessor validates PCI DSS compliance and learn to choose a PCI QSA by verifying qualifications, documentation, and on-site support.

Implementing PCI DSS reduces data breach and identity theft risk by enforcing controls like firewalls and encryption while protecting cardholder information.

Define information as data with real world importance guiding identity, organizations, and decisions. Show how data analytics and baselines support problem solving; next lecture covers assets, documents, and records.

Explore assets such as data, people, processes, software, and code; define documents and records with examples like resumes and copyright approvals, and distinguish information security from cyber security.

Explore the six major elements of information security—confidentiality, integrity, availability, non-repudiation, authentication, and access control—and how they form the foundation of security, with practical examples.

Maintain confidentiality by enforcing authentication and authorization, applying access controls across all assets to limit access to authorized users.

Maintain the integrity of information by ensuring data is accurate, authentic, complete, and not modified except by authorized people, using encryption and hashing to protect data during transfer.

Ensure data availability by defining the medium, timing, data type, and recipients, while applying confidentiality, integrity, authentication, and access control for secure online data delivery.

Learn authentication fundamentals, distinguish authentication from authorization within the triple a framework, and explore factors such as password, digital signature, cryptographic key, fingerprint, and one time password.

Learn how non-repudiation ensures senders cannot deny messages by using digital signatures, private and public keys, and verifiable email logs in IT infrastructure.

Explore how access control protects resources through authentication and authorization, covering mandatory, discretionary, role-based, and attribute-based models with real-world examples.

Define vulnerability as a design flaw or weakness allowing unauthorized access, and emphasize testing, vulnerability assessment, and common types like misconfigurations, default passwords, and zero-day risks.

Learn what constitutes a threat in information security, including accidental, man-made, natural, cyber terrorism, and technical failures, and how threats can harm assets, processes, or reputation.

Explore impact in information security, defining how threats and vulnerabilities affect organizational assets, processes, business outcomes, and stakeholders. Learn how positive or negative outcomes arise and why risk management matters.

Begin a new section exploring the first two PCI DSS requirements, explaining how meeting criteria protects cardholder data, and previewing the firewall requirement to safeguard data.

Explains the four PCI DSS versions and introduces requirement 1, detailing five sub-requirements for documenting and maintaining network security controls around the cardholder data environment.

Review pci dss version 4 requirement 1.1, covering sub-requirements 1.1.1 on security policies and document retention and 1.1.2 on defining and following roles and responsibilities.

Ensure policies and procedures are documented, updated, and regularly reviewed (at least yearly) to support governance; test compliance by reviewing documentation and interviewing key stakeholders to verify awareness.

Define and document roles and responsibilities in the organization to enable proper awareness, governance, and segregation of duties under PCI DSS sub-requirement 1.1.2.

Explore the eight sub-requirements of PCI DSS 1.2, covering network security controls, configuration, and security. Understand standards, change management, diagrams, approval of services, and periodic reviews to secure network infrastructure.

Define and document network security controls, implement and maintain configurations, and verify that ports, protocols, and services align with the organization's documented policy and standards.

Define and document network security controls and their configuration standards. Implement and maintain configurations to align ports, protocols, and services with policy, then review documentation for compliance.

Explore pci-dss requirement 2 by avoiding vendor supplied default passwords and removing unused accounts. Develop configuration standards, encrypt administrative access, maintain asset inventories, and document security policies.

Explore PCI DSS requirements for protecting cardholder data, focusing on protecting stored cardholder data under requirement three and understanding encryption and cryptography under requirement four.

Implement PCI DSS requirement 3 to protect stored cardholder data by limiting storage, discarding sensitive authentication data after authorization, masking and rendering pan unreadable, and enforcing secure key management procedures.

Learn how to protect cardholder data during transmission by applying strong cryptography and secure network practices, covering encryption, confidentiality, integrity, and compliant documentation for PCI DSS requirement 4.

Learn how a proper vulnerability management program protects systems against malware and supports developing and maintaining secure systems and applications within the PCI DSS framework.

Deploy antivirus software on all systems, update it regularly to defend against malware, ensure it stays active and not disabled by users, and document security policies for all employees.

Develop and maintain secure systems by identifying vulnerabilities, conducting pen tests, and integrating secure coding, sdlc practices, and change control with cross-vendor antivirus protection and documented policies.

Learn to implement strong access control for cardholder data, focusing on restricting access to authorized personnel, identification and authentication, and physical access controls per PCI DSS requirements.

Explore the four authentication factors that validate identity: something you know, something you have, something you are, and somewhere you are. Includes passwords, OTPs, biometrics, and VPN access.

Discover how authorization grants permissions after authentication, defining which resources a user can access and do, and how it protects sensitive documents from insider threats.

Accounting, the third factor in the triple A, tracks user activity and resource usage, generating audit logs to monitor access over time and detect insider threats or unusual activity.

Explore the four major authentication systems: single factor, two factor, multi factor, and centralized; learn how combinations like username and password, one-time passwords, and biometrics validate identity.

Learn how access control protects resources through authentication and authorization, with mac, dac, rbac, and abac approaches, using real-world identity and access management scenarios and role distinctions.

Explore mandatory access control, where the operating system grants access based on data confidentiality and user clearance levels, with administrators configuring access policies and security attributes.

Learn how authentication verifies a user’s identity before accessing resources, exploring factors from passwords to biometrics and multi-factor methods, and how authentication differs from authorization.

Delve into discretionary access control (DAC), an identity-based model where data owners assign permissions via access control lists (ACL), while role-based and rule-based systems govern who edits data.

Explore access control mechanisms that validate user identity via username and password, time-based OTPs, biometrics, and smart cards, used in banking and high-security applications.

Master user account management by enforcing unique ids, authentication, and rbac-based access; manage normal, administrator, guest, service, and privileged accounts, and disable accounts on termination while auditing access.

Password management in identity and access management: enforce seven-character minimums with special characters, avoid username in passwords, apply password history and changes, and disable rather than delete accounts for auditing.

Restrict access to cardholder data and system components to only those who need to know, by implementing a strong access control mechanism and documenting and communicating policies organization-wide.

Enforce strict physical access to cardholder data by implementing entry controls, distinguishing employees from visitors, authorizing access by job function, securing media, and destroying media when no longer needed.

Monitor and test physical and wireless networks to prevent data breaches by tracking access to network resources and cardholder data, and regularly testing security systems to identify weaknesses.

Track and monitor all network access with automated audit trails linking access to individual users, maintain records, review security logs daily, and retain audit history for at least one year.

Regularly test security systems to protect cardholder data, performing quarterly vulnerability scans, wireless access point discovery, and annual or semiannual pen testing, with ids/ips monitoring and weekly change detection.

Publish and maintain an information security policy, annually review it, and implement a risk management process for cardholder data and critical technologies.