PCI DSS Compliance and Security: Harmony or Discord?

PCI DSS Compliance and

Security: Harmony or

Discord?

Today’s Agenda

•The evolving threat and compliance landscape

•How to use compliance as a catalyst for developing and implementing an effective security program

•The six critical elements to PCI DSS compliance

•How to go beyond PCI DSS and secure critical information

2

Today’s Speakers

3

Chris MerrittDirector of Solution MarketingLumension

Michael RasmussenRisk & Compliance AdvisorCorporate Integrity, LLC

William BellDirector of Information SystemsEC Suite

The Evolving Threat and Compliance Landscape

Slide 5© 2010, Corporate Integrity, LLC www.Corp-Integrity.com

The Evolving Threat Landscape

•85% of attacks were not considered highly difficult

•Web application vulnerabilities continue to be the attack vector of choice

•Cybercriminals used stolen account logons in 38% of successful data breaches, accounting for 86% of the records compromised

Source: Verizon, 2010 Data Breach Investigations Report


Are you focused only on what you see?

“Never in all history have we harnessed such formidable technology. Every scientific advancement known to man has been incorporated into its design. The operational controls are sound and foolproof!”

E.J. Smith, Captain of the Titanic

RiskAwareness

RiskIgnorance


Silos Lead to Greater IT Risk

• A reactive and siloed approach to IT GRC is a recipe for disaster and leads to . . .

– Lack of visibility. A reactive approach to risk and compliance leads to siloed initiatives that never see the big picture.

– Wasted and/or inefficient use of resources. Silos of risk and compliance lead to wasted resources.

– Unnecessary complexity. Varying risk and compliance approaches introduce greater complexity to the business environment.

– Lack of flexibility. Complexity drives inflexibility - the organization is not agile to the dynamic business environment it operates in.

– Vulnerability and exposure. A reactive approach leads to greater exposure and vulnerability.


Compliance & Security: Harmony or Discord?

• PCI DSS provides payment card data protection requirements

• However, compliance and security are not the same– An organization can be compliant and still experience a security breach,

and can also be non-compliant and maintain a secure infrastructure.

• What is the value of compliance?– Use as a catalyst for implementing effective security measures– Requires an understanding of the principles behind the requirements, not

just adherence to minimum requirements. – Security is more than a list of checkboxes — it involves a holistic

approach and processes to protect the organization. – Compliance standards such as PCI DSS provide a foundation for

achieving security, but by itself it does not adequately protect the organization.


A grim view of the current state…

Source: Open Compliance & Ethics Group


Big Picture of Compliance

OBJECTIVESstrategic, operational, customer, process, compliance objectives

BUSINESS MODELstrategy, people, process, technology and infrastructure in place to drive toward objectives

MANDATED BOUNDARYboundary established by external forces including laws, government regulation and other mandates.

VOLUNTARY BOUNDARYboundary defined by management including public commitments, organizational values, contractual obligations, and other voluntary policies.

OPPORTUNITIES

OPPORTUNITIES

OPPORTUNITIES

OBS

TACL

ESSource: Open Compliance & Ethics Group


Components of Compliance & Data Protection

INFORM &INTEGRATE

DETECT & DISCERN

ORGANIZE & OVERSEE

ASSESS & ALIGNMONITOR &

MEASURE

PREVENT & PROMOTE

RESPOND & RESOLVE

Source: Open Compliance & Ethics Group


Sample IT Risk Assessment Process

6 Critical Elements to Achieve Economies in PCI DSS Compliance & Beyond


6 Economies of PCI DSS Compliance & Beyond


1 - Agility

• Ensure continuous compliance:– Full ongoing discovery of the IT environment, its

information and technology assets.– Understand where cardholder data is stored and who has

access.– Automatically assess the network and devices that

connect to it.– Automate IT risk-assessment to provide structure around

the collecting evidence for compliance controls.– Enforce policy for software updates, security patches

and standardized configurations.– Flexibility to handle unique needs and requirements.


2 - Consistency

• Streamline compliance workflows and processes:– Comprehensive inventory and management of IT systems

that store, communicate, transmit and interact with cardholder data.

• Consolidated console for visibility of physical and virtual environments.

• IT asset management - applications, databases, servers, networks, data centers, people and processes.

– Continuously monitor compliance and IT risk postures and enforce mandatory baseline for systems interacting with cardholder data.

– Add, create, define, edit and import/export security configurations and checklists.

– Normalize common controls across standard and regulatory requirements into a single control.


3 - Efficiency

• Automate compliance and security processes:– Address multiple management needs through a single

compliance architecture.– Maximum organizational and IT flexibility with

automated enforcement, saving both time and effort by IT staff.

– Implement standard configuration checklists with a repository of software vulnerabilities, which provides context to properly maintain security and control of cardholder data.

– Automate risk-profile analysis to save time over manual risk-analysis practices.


4 - Transparency

• Ensure visibility of IT risk across the organization:– Provide harmonization of compliance controls across a

range of mandates.– Understand the holistic risk of cardholder data that flows

among multiple information systems, processes, and departments.

• Collect device, security and configuration information to provide consolidated visibility for system owners.

• Provide a global view of vulnerability status for all organization assets with an at-a-glance understanding of risk and system status.

– Document changes and demonstrate progress toward audit and compliance requirements. Be fully prepared for PCI DSS QSA audits, with relevant information ready for auditors.


5 - Accountability

• Ensure no stones are left unturned:– Complete view of PCI DSS compliance covering specific assets,

requirements, and organization systems/processes.– Constant audit readiness through centralized and automated

collection of vulnerability assessments.– Workflow-based surveys to ensure accountability for

procedural and physical controls. – Stakeholder surveys to determine the business impact of risk

scenarios that compromise the CIA of cardholder data.– Risk-based analysis of IT posture to enable drill down on

suspicious behavior for further investigation.– Information system and role-based reporting and

administration.– Comprehensive reporting to management and authorities at a

moment’s notice.


6 - Security

• Ensure continuous security policy enforcement:– Identify controls that enhance security of cardholder data while

meeting PCI DSS compliance requirements.– Assess threats, vulnerabilities, patch status, security

configurations, installed software and hardware inventory.– Remediate software and endpoints that store, transmit, and

interact with cardholder data. – Automate enforcement of malware protection and endpoint

security.– Quickly respond to issues and visibility across the organization’s

information systems environment.– Continuously monitor security policies, particularly when new

information, processes, and technology assets are added that interact with cardholder data.


PCI Compliance, Security & Beyond

• Go beyond securing credit cardholder data and enforce policies to protect all critical information:

Discover, inventory, and categorize information systems Monitor vulnerability exposure and PCI DSS compliance Remediate and maintain compliance to PCI DSS Manage security configurations across all endpoints Control removable device use and enforce data encryption Streamline overlapping technical and procedural controls

across compliance obligations Maintain trusted application use on information systems Enforce compliance with evolving requirements Enable reporting and monitoring of PCI DSS compliance and

your entire IT risk posture

Panel Discussion and Q&A

Conclusion

Resources and Tools

• Whitepapers» 6 Critical Elements to Achieving Economical

PCI DSS Compliance» Reducing Your Cost to Achieve PCI DSS

Compliance with Lumension» Shift Happens: The Evolution of Application

Whitelisting

• Other Resources» EC Suite ROI Case Study» Podcasts, Videos, Webcasts, eBooks» On-Demand Demos» Scanners

• Product Software Evaluations» Virtual Environment» Full Software Download

24

Global Headquarters8660 East Hartford Drive

Suite 300

Scottsdale, AZ 85255

1.888.725.7828

[email protected]

blog.lumension.com

mailto:[email protected]

http://blog.lumension.com/

PCI DSS Compliance and Security: Harmony or Discord?

Technology

compliance security

compliance lead

pci dss compliance

compliance approaches

compliance standards

value of compliance

security breach

open compliance ethics