Basel Ismail

The paper, which was completed over two years, shed light on the implications of the Payment Card Industry Data Security Standard (PCI DSS) requirements on all forms of merchants and suppliers that allow the use of payment cards, provided background on the creation of the PCI DSS council, and most importantly, on how organizations in this industry handled digital incidents and on how they completed digital forensic investigations. Due to the unique nature of the business environments that… Show more

The paper, which was completed over two years, shed light on the implications of the Payment Card Industry Data Security Standard (PCI DSS) requirements on all forms of merchants and suppliers that allow the use of payment cards, provided background on the creation of the PCI DSS council, and most importantly, on how organizations in this industry handled digital incidents and on how they completed digital forensic investigations. Due to the unique nature of the business environments that American Express operates in, that was the primary point of research and evaluation.

Also, there was a walk through of how incidents are typically handled internally by American Express. The paper provided an overview of the following response processes: triage, expertise, escalation, tracking, and communications. Afterwards, a thorough breakdown was provided on how to ensure professionalism is maintained internally throughout the organization and externally with partner agencies, an outline of the top priorities for managing a Computer Security Incident Response Team (CSIRT) in the payment card industry, and finally an overview on how CSIRT staff were being managed effectively.

Finally, there were concluding remarks and specific recommendations that any computer forensic team can review to potentially strengthen their information assurance program. Show less

The paper provided an overview of the range of Computer Security Incident Response Team (CSIRT) styles found in the travel industry. A trend analysis was conducted on all CSIRT management styles as well as emergency response processes, afterwards the non-statistical results were shared at a high-level. In addition to the above, there was an evaluation on some key CSIRTs identified across organizations of different sizes.

Also, there were multiple sections detailing how travel… Show more

The paper provided an overview of the range of Computer Security Incident Response Team (CSIRT) styles found in the travel industry. A trend analysis was conducted on all CSIRT management styles as well as emergency response processes, afterwards the non-statistical results were shared at a high-level. In addition to the above, there was an evaluation on some key CSIRTs identified across organizations of different sizes.

Also, there were multiple sections detailing how travel organizations currently manage their CSIRT, including but not limited to: a thorough breakdown of how to ensure professionalism is maintained internally throughout the organization and externally with partner agencies, an outline of the top priorities for managing a CSIRT in the travel industry, and finally an overview of how to manage CSIRT staff. Finally, there were valuable lessons shared on how to learn from emergencies during the postmortem review process. Thoughts were shared on how receptive typical organizations are in accepting outside recommendations to improve their overall information assurance programs.

The document largely limited its discussion to technologies, standards, definitions, and frameworks either recommended or created by Open Travel Alliance (OTA), OASIS, Infosys, Centrify, Sabre Travel, Amadeus Travel, TravelPort Apollo and Galileo, American Express Technologies (AET), American Express, Carlson Wagonlit, BCD Travel, HRG, and finally International SOS (iSOS). Show less

The purpose of this paper was to share my findings on the effectiveness of information assurance programs found at organizations in the corporate payments industry. Several proposed recommendations were made to remedy some of the weaknesses identified, specifically: what could be done to improve them; project timeline, cost, and prioritization typically seen in the travel industry; and finally an evaluation on how the recommendations will fit with the existing travel industry culture and… Show more

The purpose of this paper was to share my findings on the effectiveness of information assurance programs found at organizations in the corporate payments industry. Several proposed recommendations were made to remedy some of the weaknesses identified, specifically: what could be done to improve them; project timeline, cost, and prioritization typically seen in the travel industry; and finally an evaluation on how the recommendations will fit with the existing travel industry culture and whether or not a shift will be required. This required soliciting feedback from key stakeholders in the industry on how to improve the recommendations that have been put forth.

A significant portion of the research was focused on reviewing the major compliance acts that have impacted the travel industry the most, such as the Sarbanes-Oxley 404 (SOX) act, Federal Trade Commission (FTC) act, Gramm-Leach-Bliley Act (GLBA), and the Health Insurance Portability and Accountability Act (HIPAA). There was a special focus on the key areas of the SOX act that have impacted the travel industry the most, including a review of SOX sections 302, 402, and 404. The paper concentrated on specifically section 404 of the SOX act as it had the most relevance to the travel industry and had the most applicability to information assurance. Also included was: an investigation of what organizations are currently doing to cope with these demanding requirements; an analysis of typical methods and key financial performance indicators (KPIs) used by management to scope the projects properly; a discussion of whether or not these methods are effective and sufficient in scope and depth; and finally an evaluation on the level of support that the travel industry is providing its members.

Finally, recommendations were made on how organizations could strengthen their information assurance programs holistically by using formal management and analytics processes and tools. Show less