Information security standards in payment card industry

Vitomir Banjac (2016) Information security standards in payment card industry. MSc thesis.

Preview

PDF Download (2572Kb)

Abstract

Data security is an important activity in many companies, especially if they operate in an environment with sensitive data. To facilitate the implementation of data security measures, a variety of standards, frameworks and best practices are available as a guidelines according to which a company can or must act. These standards can be different in their requirements, while some of their requirements and chapters can be similar. This work examines theoretical background of information security in the processing of payments, while selected standards and frameworks that help to safeguard information are also analysed. The case of implementation of the standard PCI DSS and ISO/IEC 20000 using ITIL in companies in the business of processing payment transactions is presented. Additionally, implementation in cases of risk and vulnerability, modelled in the ArchiMate language, is also demonstrated. The main aim of the master thesis is to examine how the company could at minimum cost and use of various sources implement standard ISO/IEC 27001 on the basis of what is already available from the standards PCI DSS and ITIL. For this purpose, the master thesis reviews, compares and conducts mapping of various requirements between those standards. On this basis, the concept of the implementation model of ISO / IEC 27001 with the integration of the PCI DSS and ITIL is developed. Through this model, companies could lower their costs and more easily implement the new standard as well as reduce the level of risk. The conclusion of the thesis offers overview of the findings and suggestions for further work. In this master thesis knowledge acquired in postgraduate study of Information Systems and decision-making at the Faculty of Engineering and Computer Science is used. Moreover, this thesis makes use of the knowledge and experience gained from my work in the field of software development, in particular web applications and web services, as well as the implementation of safety standards in the network which is discussed in this thesis. In addition to this, domestic and foreign scientific, technical articles, conference contributions, standards and frameworks are used as a relevant knowledge sources.

Actions (login required)