How to Overcome the 3 Biggest PCI Compliance Challenges

HOW TO OVERCOME THE 3 BIGGEST PCI COMPLIANCE CHALLENGES20 JANUARY 2011

RANDY ROSENBAUM / CPISM / ALERT LOGICJOHNNY HATCH / PRODUCT MANAGER / VISI

/ VISI.COM / 612.395.9090 / © 2011 VISI INCORPORATED. ALL RIGHTS RESERVED.1

AGENDA

VISI INTRODUCTION

PCI DSS 2.0

PCI COMPLIANCE CHALLENGES

COSTLY PITFALLS OF PCI COMPLIANCE

3 BIGGEST PCI COMPLIANCE CHALLENGES

PCI COMPLIANCE IN THE CLOUD

QUESTIONS AND ANSWERS


3 / VISI.COM / 612.395.9090 / © 2011 VISI INCORPORATED. ALL RIGHTS RESERVED.

COMPANY OVERVIEW

ABOUT VISI

FOUNDED IN 1994

MINNESOTA’S MARKET LEADER IN COLOCATION, MANAGED

SERVERS AND CLOUD SERVICES.

WHOLLY OWNED SUBSIDIARY OF TELEPHONE & DATA SYSTEMS.

TELEPHONE & DATA SYSTEMS IS A FORTUNE 500 COMPANY

WITH REVENUES IN EXCESS OF $5B.

PCI DSS 2.0


CHANGES TO PCI DSS

Requirement Change

1 Clarification on secure boundaries between the internet and card holder data environment

3.6 Clarify processes and increase flexibility for cryptographic key changes, retired or replaced keys, and use of split control and dual knowledge

6.2 Update requirement to allow vulnerabilities to be ranked and prioritized according to risk

6.5 Merge 6.3.1 and 6.5 to eliminate redundancy

12.3.10 Update to allow business justification for copy, move, and storage of CHD during remote access

Various Provide guidance on virtualization

Scope Clarify that all locations and flows of cardholder data should be included in scope


PCI COMPLIANCE CHALLENGES


COSTLY PCI PITFALLS

1. ONLY CHECKING THE “I’M COMPLIANT” BOX

DEPLOYING AN EXPENSIVE HARDWARE OR SOFTWARE BASED LOG MANAGEMENT OR IDS SYSTEMS AND NOT REVIEWING THE DATA.

2. WASTING YOUR RESOURCES

USING YOUR RESOURCES TO UPDATE, PATCH, AND MAINTAIN HARDWARE OR SOFTWARE BASED SOLUTIONS.


THE 3 BIGGEST PCI CHALLENGES

EFFECTIVE AND SUSTAINABLE LOG MANAGEMENT

REQUIREMENT 10

MANUALLY REVIEWING AND MANAGING LOG DATA

VULNERABILITY ASSESSMENT

REQUIREMENT 11.2

SELECTING THE RIGHT SOLUTION THAT SCALES TO MATCH YOUR NETWORK SECURITY NEEDS

INTRUSION PROTECTION

REQUIREMENT 11.4

CONFIGURING, IMPLEMENTING, USING, AND SUPPORTING TECHNOLOGY THAT ADAPTS TO YOUR NETWORK SECURITY POLICIES


PCI COMPLIANCE IN THE CLOUD


FOUNDED: 2002

LOCATIONS:

HQ: HOUSTON, TX

DATA CENTERS: HOUSTON & ATLANTA

EMPLOYEES: 90+

CUSTOMERS: 1,200+

We allow you to:Improve security

Comply with regulations

By delivering:Patented SaaS products

Integrated managed servicesContinuous automation


ACTIVEWATCH

INTEGRATED SAAS & MANAGED SERVICES

THREAT MANAGER

LOGREVIEW

LOG MANAGER

Identify and escalate true security incidents by expert analysis of threat and vulnerability data

PCI Approved Scan Vendor for DSS requirements ActiveWatch service provides 24x7 response from certified analysts

Agent-less collection, correlation, storage, search and reporting of disparate log data

Cloud-based grid architecture enable unprecedented scale without local storage LogReview service provides daily review and sign-off of over 20 critical reports for

security and compliance


CLOUD-POWERED DELIVERY MODEL


PCI DSSPenalties: fines, loss of credit card processing, and level 1 merchant requirements


6.2 Identify newly discovered security vulnerabilities

11.2 Perform network vulnerability scans quarterly by an ASV

INTRUSION DETECTION5.1.1 Monitor zero day attacks not covered by Anti-Virus

11.4 Maintain IDS/IPS to monitor & alert personnel, keep engines up to date

LOG MANAGEMENT

10.2 Automated audit trails

10.3 Capture audit trails

10.5 Secure logs

10.6 Review logs at least daily

10.7 Maintain logs online for 3 months

10.7 Retain audit trail for at least 1 year

ADDRESSING PCI DSS MANDATESTH

RE

AT

MA

NA

GE

R

AC

TIV

EW

ATC

HLO

G M

AN

AG

ER

LO

GR

EV

IEW


CHALLENGE 1: LOG MANAGEMENT – EFFECTIVE AND SUSTAINABLE


WHY LOG MANAGEMENT IS OFTEN INEFFECTIVE

0% 10% 20% 30% 40% 50% 60%

Criteria for breach are unclear

Too much time to resolve incidents

Log data is not normalized

Procedures are too flexible to enforce

Management doesn't "get it"

= Most notableSource: PCI Knowledge Base, March 2009


LOG MANAGER + LOGREVIEW

COLLECT LOG DATA FROM HETEROGENEOUS ENVIRONMENTS WITHOUT DEPLOYING AGENTS

SECURELY STORE LOG DATA IN REDUNDANT OFFSITE DATA CENTERS ELIMINATING THE NEED FOR LOCAL SAN

SEARCH AND REPORT ON DATA INSTANTLY FOR FORENSIC ANALYSIS

MAINTAIN SECURITY & COMPLIANCE WITH OUT-OF-THE-BOX REPORTS AND ALERTING

OFFLOAD MONOTONOUS DAILY REVIEW OF LOG DATA (E.G., FOR PCI COMPLIANCE) WITH LOGREVIEW MANAGED SERVICE

Deploy this…

Instead of all this.


10.2.1 ALL INDIVIDUAL ACCESS TO CARD HOLDER DATA


PCI LOG CORRELATION POLICIES


LOG MESSAGES REVIEWED DAILY

Alert Logic LogReviewUnix Failed Logins Network Device Failed Logins

Unix Sudo Access Network Device Policy Change

Windows and Unix FTP/Telnet Failed Logins Unix Switch User Command Success

Unix SSH Failed Logins Excessive Windows Account Lockouts

Database Failed Logins Windows User Account Created

Excessive Windows Failed Logins Windows User Group Created

Windows User Group Modified Excessive Windows Failed Logins by an Admin

Active Directory Global Catalog Change Failed Unix Switch User Command

Active Directory Global Catalog Demotion Excessive Windows Account Lockouts by an Admin

Unix Group Created


CHALLENGE 2: VULNERABILITY ASSESSMENT –SELECTING THE RIGHT SOLUTION


VULNERABILITY ASSESSMENT CHALLENGES

QUARTERLY VULNERABILITY SCANS SHOULD BE THE MINIMUM.

RUNNING SCANS IS EASY; TRACKING DOWN VULNERABILITIES IS HARD.

SOME COMPANIES LOOK FOR THE EASIEST WAY TO GET A “CLEAN” SCAN

“TWEAKING” NETWORK CONFIGURATIONS

REMOVING IP ADDRESSES FROM SCOPE

IT SECURITY TEAM FINDS IT DIFFICULT TO EXPLAIN OR JUSTIFY SCAN RESULTS TO MANAGEMENT



SCHEDULE ONGOING INTERNAL AND EXTERNAL VULNERABILITY SCANS

PERFORM QUARTERLY PCI CERTIFICATION SCANS

RESULTS INTEGRATE WITH INTRUSION PROTECTION FOR OPTIMUM ACCURACY


11.2 RUN PCI APPROVED VULNERABILITY SCANS QUARTERLY


COMPLIANCE DASHBOARD


INTRUSION DETECTION CHALLENGES

INTRUSION DETECTION IS OFTEN DISMISSED BY COMPANIES DUE TO THE REPUTATION FOR FALSE

COMPANIES BUY THE TECHNOLOGY TO ACHIEVE COMPLIANCE – BUT THEY DON’T SPEND THE MONEY OR INVEST THE TIME NEEDED TO EFFECTIVELY USE THE TOOLS

LIMITED EXPERTISE IN IT DEPARTMENTS TO PROPERLY TAKE ACTION ON SECURITY INCIDENTS


THREAT MANAGER + ACTIVEWATCH

Patented Threat Modeling Expert System

IDENTIFY THREATS WITH LEADING INTRUSION DETECTION & VULNERABILITY ASSESSMENT

DASHBOARDS AND REPORTS FOR END-USER SECURITY MANAGEMENT

DEMONSTRATE DUE CARE FOR COMPLIANCE INITIATIVES WITH BUILT-IN WORKFLOW AND CASE MANAGEMENT

PCI APPROVED SCANNING VENDOR (ASV) TO PROVE PCI COMPLIANCE

COST EFFECTIVELY ADD 24X7 EXPERT RESPONSE WITH ACTIVEWATCH MANAGED SERVICE


11.4 USE IDS TO MONITOR NETWORK TRAFFIC


THE 3 BIGGEST PCI CHALLENGES

EFFECTIVE AND SUSTAINABLE LOG MANAGEMENT

REQUIREMENT 10

MANUALLY REVIEWING AND MANAGING LOG DATA


REQUIREMENT 11.2

SELECTING THE RIGHT SOLUTION THAT SCALES TO MATCH YOUR NETWORK SECURITY NEEDS

INTRUSION DETECTION

REQUIREMENT 11.4

CONFIGURING, IMPLEMENTING, USING, AND SUPPORTING TECHNOLOGY THAT ADAPTS TO YOUR NETWORK SECURITY POLICIES


MEETING THE CHALLENGES HEAD ON

MOVE FROM MANUAL TO AUTOMATED LOG MANAGEMENT

KEYS TO SUCCESS: EFFECTIVE AND SUSTAINABLE LOG MANAGEMENT AND REVIEW

CHOOSE A VULNERABILITY ASSESSMENT SOLUTION THAT ALIGNS WITH YOUR NETWORK

KEYS TO SUCCESS: CENTRALIZED VIEW AND REMEDIATION KNOWLEDGE

SELECT AN INTRUSION PROTECTION SOLUTION THAT DOESN’T REQUIRE COSTLY IMPLEMENTATION, CONFIGURATION AND MANAGEMENT

KEYS TO SUCCESS: IMPLEMENT A SOLUTION THAT ADAPTS TO YOUR NETWORK SECURITY POLICIES AND MINIMIZES THE WORK LOAD OF YOUR RESOURCES


32 / VISI.COM / 612.395.9090 / © 2011 VISI INCORPORATED. ALL RIGHTS RESERVED.

CONTACT VISI

VISI HEADQUARTERSEDEN PRAIRIE DATA CENTER10290 West 70th StreetEden Prairie, MN 55344

VISI ST. PAUL DATA CENTER180 East 5th St, Suite 525St. Paul, MN 55101

PHONE 612.395.9090

EMAIL [email protected]

How to Overcome the 3 Biggest PCI Compliance Challenges

Documents

Transcript of How to Overcome the 3 Biggest PCI Compliance Challenges