PCI compliance

1. golden rules

1.1. PAN, expiry date and user name are *always* encrypted

1.2. cvv code is *never* written to persistent media

2. big picture

2.1. We have a policy doc

2.2. We have a process which implements the policy doc

3. If all else fails

3.1. "I always ask Paul about that"

4. understanding the development lifecycle

4.1. What's our dev process?

4.1.1. Start with requirements

4.1.2. code to unit tests

4.1.3. check-in

4.1.4. security review

4.1.4.1. may require a mitigation

4.1.5. integration testing

4.1.6. QA

5. purpose of PCI