PCI Compliance Evolved

PCI Compliance Evolved: Perpetual Compliance for 2.0 and Beyond
Mike Smart
Product and Solutions Director
mike_smart@safenet-inc.com

Agenda
Growing Challenges with Compliance and the Cost of Breaches and Vulnerabilities
PCI Version 2.0
Holistic Compliance
New Technologies Beyond 2.0
Ease Compliance Management

What We Do: Compliance
SafeNet delivers compliance-ready infrastructures that enable customers to persistently comply with evolving regulations, reduce audit complexity, and capitalize on new business models.

The Growing Compliance Challenge

Cost of Breaches and Vulnerabilities:Across Industries
Cost per Breach: $204/ Record
*Ponemon Institute Study 2010

Cost of Breaches and Vulnerabilities:Across Industries
Portable Devices
Laptop encryption and access
Mobile smart phones access and payment security
Unintended Disclosure
Control access and distribution of
Structured Data: Database environments
Unstructured Data: File and folder
Hacking and Malware
Man-in-the Browser Attacks
Phishing and Pharming Attacks
DNSSEC Heirarchy Signing

Audit Complexity, and Emerging InfrastructuresNumerous Points of Vulnerability
Web 2.0 Application
Cloud
Services
Laptop
SaaS Cloud
Internet
WAN
Branch Office
Mobile
Extranet
Data Center
Flash-drive
Media
Forever Protection
Ubiquitous Controls
Each Data-use is Tracked
Granular Access Controls
Assured User Authentication
Mobile Data LOCKED!
Cryptographic Perimeter
Application & DB Data
File-based Endpoints
Removable Media contained
Remote Replication

Emerging Infrastructures:Sensitive Data Is Virtualized
The cloud changes everything
Multiple uses for a virtual resource that contains sensitive data make it difficult to apply the needed controls
The cloud changes nothing
Every rule of a mandate still applies when migrating sensitive data to the cloud
Many infrastructure roles and responsibilities may drop out of view once data moves into the cloud, but compliance responsibility remains the responsibility of the organization

What’s New in PCI Version 2.0?Highlights

Holistic Approach to Perpetual ComplianceData Protection Strategies Must Change as Well
Data Protection 2.0
Data Protection 1.0
Perimeter focused security
Data-centric protection—intelligence to protect the data itself throughout its lifecycle
Granular, selective protection over subset of unstructured or structured data (files, fields, and columns)
All-or-nothing encryption
Granular data protection for authorized users, assure compartmentalization
Keep bad guys out, authorized users get full access
Centrally managed solution that addresses business, compliance, data governance & security
Multiple products to meet business and security needs
High level or very specific policy only,
No proper central policy management
Centralized policy and key management providing data use tracking and control

Holistic Approach to Perpetual ComplianceTwo Important Considerations:

Approaches to Data Protection

Technology Beyond PCI v. 2.0Approach #1: Application Encryption

Technology Beyond PCI v. 2.0 Approach #2: Database Encryption

Technology Beyond PCI v. 2.0 Approach #3: File Encryption

Technology Beyond PCI v. 2.0 Approach #4: Storage Encryption

Technology Beyond PCI v. 2.0 Approach #5: Tokenization

Critical Step: Tackle Requirement 3 and Reduce the Key Management Scope
Source: Oasis

What’s the cost of unmanageable key management?
Planning time:
Some organizations spent up to a year planning for key management issues including breaches and notifications*
Audit prep time
Demonstrate which apps and networks are using the keys and where in the world they are
Data Loss:
Up to 39 percent of organizations who have experienced key loss also lose data permanently or disrupt business operations.
Maintenance costs:
Disparate systems means no economy of scale for maintenance costs. Each encryption system and key management solution could have 15-20% annual maintenance fees.
* Source: TrustCatalyst

Thankyou
Questions?

PCI Compliance Evolved

by SafeNet

Accessibility

Categories

Upload Details

Usage Rights

Statistics

PCI Compliance Evolved Presentation Transcript