PCI-DSS & IT Compliance Keamanan Transaksi Kartu & Infrastruktur Pembayaran Digital
PCI-DSS & IT Compliance Keamanan Transaksi Kartu & Infrastruktur Pembayaran Digital
Description
Payment Card Industry Data Security Standard (PCI DSS) menjadi salah satu kerangka keamanan penting untuk melindungi data pembayaran dan lingkungan yang memproses, menyimpan, atau mentransmisikan data pemegang kartu. Dalam implementasinya, PCI DSS perlu ditempatkan dalam konteks IT governance, cybersecurity, risk management, data protection, vendor management, dan compliance framework BPD.
Kepatuhan terhadap PCI DSS bukan sekadar pemenuhan checklist teknis. Bank perlu memahami cardholder data environment (CDE), scope, security controls, access management, encryption, vulnerability management, logging, monitoring, incident response, dan evidence of compliance. Dengan demikian, penerapan PCI DSS dapat menjadi bagian dari strategi penguatan keamanan infrastruktur pembayaran digital secara menyeluruh.
Pelatihan “PCI-DSS & IT Compliance: Keamanan Transaksi Kartu & Infrastruktur Pembayaran Digital” dirancang untuk memberikan pemahaman praktis mengenai prinsip PCI DSS, pengamanan cardholder data, pengelolaan CDE, IT controls, compliance monitoring, serta kesiapan menghadapi assessment dan audit keamanan.
Objectives
- Memahami konsep dan tujuan PCI DSS dalam ekosistem pembayaran kartu.
- Memahami struktur dan persyaratan utama PCI DSS.
- Mengidentifikasi Cardholder Data Environment (CDE) dan menentukan scope kepatuhan.
- Mengidentifikasi risiko keamanan pada sistem dan infrastruktur pembayaran digital.
- Memahami pengamanan data pemegang kartu selama data disimpan, diproses, dan ditransmisikan.
- Menerapkan prinsip access control, authentication, encryption, dan network security.
- Memahami vulnerability management dan security testing dalam lingkungan pembayaran.
- Membangun logging, monitoring, dan incident response yang sesuai kebutuhan keamanan.
- Mengelola risiko keamanan pihak ketiga yang terhubung dengan ekosistem pembayaran
Course outline
A. Fundamental PCI DSS & Payment Security
- Pengertian dan tujuan PCI DSS
- Payment card security ecosystem
- Peran bank, merchant, payment processor, acquirer, issuer, dan service provider
- Cardholder Data (CHD)
- Sensitive Authentication Data (SAD)
- Cardholder Data Environment (CDE)
- Prinsip need-to-know dan least privilege
- PCI DSS sebagai bagian dari IT governance dan cybersecurity
B. PCI DSS Requirements & Compliance Framework
- Struktur PCI DSS
- Requirement dan security objectives
- Scope dan applicability
- Compliance responsibilities
- Security policy dan governance
- Control ownership
- Compliance monitoring
- Evidence management
- Self-assessment dan external assessment
- Corrective Action Plan
C. Cardholder Data Environment (CDE)
- Identifikasi aset dalam CDE
- Data flow mapping
- Cardholder data discovery
- System components
- Network segmentation
- Connected systems
- Scope reduction
- Third-party connectivity
- CDE inventory
- Data flow dan trust boundary analysis
D. Protection of Cardholder Data
- Data minimization
- Data retention
- Secure storage
- Encryption at rest
- Encryption in transit
- Key management
- Tokenization
- Masking
- Truncation
- Pengelolaan PAN
- Secure deletion
- Pencegahan data leakage
E. Network & Infrastructure Security
- Network segmentation
- Firewall configuration
- Secure network architecture
- Wireless security
- DMZ
- Secure remote access
- Administrative access
- Network monitoring
- Intrusion Detection/Prevention
- Secure configuration dan hardening
- Zero Trust principles
F. Identity & Access Management
- User access management
- Privileged access management
- Least privilege
- Role-Based Access Control
- Multi-Factor Authentication
- Authentication mechanisms
- Password security
- Service accounts
- Access review
- Joiner-Mover-Leaver process
- Monitoring privileged activity
G. Vulnerability Management & Security Testing
- Vulnerability scanning
- Patch management
- Secure configuration
- Malware protection
- Penetration testing
- Application security testing
- Network security testing
- Web application security
- Remediation management
- Risk-based vulnerability prioritization
- Validation dan retesting
H. Application & Digital Payment Security
- Secure Software Development Lifecycle
- Secure coding
- Application security
- API security
- Payment gateway security
- Mobile banking security
- E-commerce/payment integration
- Authentication dan transaction authorization
- Session security
- API access control
- Protection against common application attacks
Participants
- Information Technology
- Compliance & APUPPT
- Risk Management
- Banking
- Audit Internal
- Finance, Accounting & Tax
- Law
- Perencanaan & Pengembangan
- Leadership Program
- Treasury & Investment
Method
- Pre-test
- Presentation
- Discussion
- Case study
- Post-test
Facilities
- Ruang Meeting Representatif
- Sertifikat Pelatihan Resmi
- Instruktur Profesional & Berpengalaman
- Training Kit Eksklusif
- Souvenir
- Pick Up Participant (Yogyakarta)
