PCI CFA cheat sheet

Scope is defined by where cardholder data (CHD) is stored, processed, or transmitted, plus any system that can impact the security of the CDE (connected-to and security-impacting systems).

PCI DSS v4.0 has 12 requirement groups; requirement 12 covers policy, risk assessment, and the designated security-responsible executive.

SAQ selection depends on channel and volume: SAQ A for fully outsourced e-commerce, SAQ D for merchants storing CHD electronically, SAQ P2PE for validated P2PE terminals.

Scoping methods include data-flow mapping, network segmentation testing, and CDE inventory; segmentation must be verified at least every 12 months (v4.0).

Requirement 3.4.1 (v4.0) requires PAN rendered unreadable wherever stored; truncation, hashing, tokenization, and strong cryptography are acceptable methods.

Requirement 10 requires audit trails for all access to CHD; retention is at least 12 months with the most recent 3 months immediately available.

Requirement 11.4.1 mandates internal and external penetration testing at least annually and after significant changes.

A system is out of scope only if it neither stores, processes, nor transmits CHD and cannot impact CDE security; network-level segmentation is the primary isolation control.

Order of volatility: CPU registers and cache, RAM, swap, network state, running processes, disk, remote logs, archival media.

A forensic image must be a bit-for-bit copy verified by hash (MD5/SHA-256); the hash of source and image must match before analysis.

Chain of custody documents who collected, when, where, and every transfer; gaps break evidentiary value.

Write blockers prevent modification of source media during acquisition; acquisition logs record tool name, version, and operator.

Timeline analysis uses MACB (modified, accessed, changed, birth) timestamps; time zone normalization is required for correlation.

Memory acquisition captures encryption keys, running malware, network connections, and credentials not present on disk.

Evidence must be preserved before remediation; containment actions that destroy logs or memory should be documented and justified.

PCI forensics requires determining the scope of compromise, the initial attack vector, and the date of first evidence of compromise.

CDE analysis starts with the data-flow diagram: identify where PAN enters, is stored, and exits; each location is a potential exfiltration point.

Compromise indicators include unexpected outbound connections, new admin accounts, altered POS binaries, and large data transfers near transaction volume.

Track data (full magnetic stripe) must never be stored post-authorization; its presence in logs or memory is a finding.

POS scraping malware reads process memory of payment applications; detection focuses on memory-scraping behavior and injected code.

Tokenization reduces CDE scope only when the tokenization system is isolated and tokens cannot be reversed to PAN without a key stored in the CDE.

Card-testing attacks generate many low-value authorization attempts; correlate merchant IDs, IPs, and BIN ranges across logs.

Assess whether segmentation was actually enforced by reviewing firewall rules, VLANs, and routing between CDE and non-CDE.

Compromise scope must include all systems that could have accessed CHD, not only systems with confirmed malware.

Static analysis examines binaries without execution: strings, imports, PE headers, packing, and embedded configs.

Dynamic analysis executes malware in an isolated sandbox and captures process, registry, file, and network behavior.

Common POS threats include memory scrapers, RAM scrapers, and keyloggers; many use reflective DLL injection to avoid disk artifacts.

Persistence mechanisms include Run keys, services, scheduled tasks, WMI subscriptions, and DLL search-order hijacking.

Command and control may use HTTP(S), DNS tunneling, or domain generation algorithms; beaconing intervals aid detection.

Credential theft tools (Mimikatz-style) extract LSASS memory; detection focuses on process access to lsass.exe.

Ransomware tradecraft includes double extortion: exfiltration before encryption; both are reportable compromise events.

Malware families often use packing and anti-analysis; unpacking requires dynamic execution or emulation.

Key sources: firewall, IDS/IPS, web server, authentication (AD/SSO), endpoint EDR, DNS, and POS application logs.

Correlate by 5-tuple (source IP, destination IP, source port, destination port, protocol) and by user identity across sources.

Log integrity requires centralized collection, NTP synchronization, and tamper protection; missing logs are themselves a finding.

Look for off-hours administrative logons, privilege escalation, and service account use from unusual hosts.

Beaconing appears as regular intervals to the same destination; jitter may obscure it, so analyze distributions.

Data exfiltration indicators include large outbound transfers, unusual DNS query volume, and connections to newly registered domains.

Windows Event IDs: 4624 logon, 4625 failed logon, 4672 special privileges, 4688 process creation, 7045 service install.

Absence of expected logs (gaps) may indicate attacker log clearing; Event ID 1102 records audit log clearing.

PFI reports must state the scope of investigation, methodology, evidence reviewed, findings, and root cause.

Reports must distinguish confirmed facts from inferences; unsupported conclusions undermine the investigation.

Documentation includes chain of custody, acquisition logs, tool versions, and analyst notes with timestamps.

Findings must map to PCI DSS requirements to support remediation and compliance decisions.

The report identifies the date of first evidence of compromise and the period during which CHD was at risk.

Confidentiality: reports contain sensitive data and are distributed only to authorized parties under NDA.

Remediation recommendations should be specific, prioritized, and tied to evidence, not generic checklists.

Retain investigation artifacts and reports per contractual and legal requirements; evidence may be needed for litigation.

Phases: preparation, identification, containment, eradication, recovery, lessons learned.

Containment must preserve evidence; isolate hosts via network segmentation rather than immediate wipe when forensics are needed.

Short-term containment limits spread; long-term containment rebuilds and hardens while maintaining business continuity.

Eradication removes malware, closes the initial vector, and rotates all potentially exposed credentials and keys.

Recovery validates systems are clean before reconnection; re-imaging is preferred over cleaning when integrity is uncertain.

Communication plans include internal stakeholders, acquirers, card brands, and law enforcement as required.

Post-incident review identifies control gaps and updates the incident response plan and PCI scope.

Containment decisions must be documented with rationale, including any actions that altered evidence.