Passing PCI compliance can be a painful experience. According to Verizon’s 2015 PCI report, only 9% of breached organizations were compliant with Requirement 11—a fundamental requirement which ensures that an organization is prepared for a range of attack types. Does your organization have the change detection requirement under control? Tim Erlin, Director of Security and Risk Strategist for Tripwire, and Glenn Rogers, Acting CIO for the Girl Scouts of Northern California, provide a practical discussion on: • How GSNorCal saved time and money by changing their PCI approach • The three most common change detection audit mistakes and how to correct them • A sneak peek at the impact of PCi v3.2 released this year

2. Glenn Rogers
CIO
Girl Scouts of
Northern California
Tim Erlin
Dir. IT Risk and
Security Strategist
Tripwire

9. 1: Build and
Maintain a
Secure Network
2: Protect
Cardholder Data
3: Maintain a
Vulnerability
Management
Program
4: Implement
Strong Access
Control Measures
5: Regularly
Monitor and Test
Networks
6: Maintain an
Information
Security Policy
Requirement 1:
Install and maintain
a firewall
configuration to
Protect Cardholder
Data
Requirement 3:
Protect stored
cardholder data
Requirement 5:
Protect all systems
against malware and
regularly update anti-
virus software or
programs
Requirement 7:
Restrict access to
cardholder data by
business need to
know
Requirement 10:
Track and monitor
all access to
network resources
and cardholder
data
Requirement 12:
Maintain a policy that
addresses information
security for all
personnel
Requirement 2:
Do not use vendor-
supplied defaults for
system passwords
and other security
parameters
Requirement 4:
Encrypt transmission
of cardholder data
across open, public
networks
Requirement 6:
Develop and maintain
secure systems and
applications
Requirement 8:
Identify and
authenticate access
to system
components
Requirement 11:
Regularly test
security systems
and processes
Requirement 9:
Restrict physical
access to cardholder
data
Validates
Provides
Supports

11. Tripwire and PCI DSS 3.2

12. Continuous Monitoring
Risk Reduction
Threat Detection and Response
Operational Cost Reduction
INTEGRATION
AUTOM
ATION
CONTEXT