Posts Tagged PCI-DSS

Take a Proactive Approach to New PCI Standards

Posted by on Friday, 11 March, 2016

For some organizations, the 36 month lifecycle of new Payment Card Industry Data Security Standards (PCI DSS) can be a grueling schedule to tackle. With the release of PCI DSS 3.2 just around the corner, many organizations are trying to estimate the effort required to remain compliant. Wouldn’t it be nice if there was a way to predict what was on the minds of the folks on the PCI Security Standard Council before the new standards were released? Well, there just might be a way.

In June, 2015, the Council published a document called The PCI DSS DESV (Designated Entities Supplemental Validation). Inside that document are “extra requirements” which apply to entities requiring “additional validation”. These could be organizations that deal with Payment Card Data in large volume, serve as an aggregation point for cardholder data, or suffered significant or repeated breaches.

As folks in the world of security know, defense in depth is a rule we all live by. Extraordinary soon becomes ordinary. Exceptional soon becomes standard. Supplemental soon becomes required.

pci compliant future versionsThrough the DESV, it’s possible to glimpse the future of PCI DSS.  By implementing these controls and processes, your organization gains even more protection than what is currently and commonly required. By doing so, you can prepare – to some extent – for the surprises lurking down the road. At the very least, your processes will be better defined and your controls will be more secure. Implementing best practices early could give you the competitive edge you need to respond quickly when those practices become required.

This idea is based on more than just speculation. In a Council blog, “Preparing for PCI DSS 3.2: What to Expect in 2016”, posted on February 17, 2016, chief technology officer Troy Leach eluded to some updates in the standard they were considering, which included the following:

  • Multi-factor authentication for administrators
  • Incorporating some of the DESV criteria for service providers
  • Clarifying masking criteria for primary account numbers when displayed
  • Updating migration dates for SSL/early TLS that were published in December 2015

As a developer of enterprise managed file transfer and encryption solutions, Linoma Software remains vigilant in keeping up with the latest PCI DSS standards so we can help organizations to protect their most sensitive data assets and meet compliance requirements.

Retailers Struggle to Protect Against Data Breach

Posted by on Tuesday, 12 February, 2013

data breach, data securityAs thousands of harried spouses and romantically entangled Americans scramble to find the right Valentine’s Day gifts this week, many are pulling out the credit cards and ordering online or over the phone or waiting in line to swipe their debit cards at the florist or candy store.  That’s a lot of personal data zooming through cyberspace, which can make the perfect gift for hackers.

One of the compliance regulations that controls how merchants and others handle credit card data is PCI DSS, established to prevent, detect and react to unauthorized access to personal payment information.  The standards are strict and penalties can be stiff.

The challenge comes when retailers, overwhelmed with busy shopping seasons and lines of customers, have so many things to manage that their vigilance protecting customer data can lose priority.  And yet, it just takes one misstep to open the doors to a data breach.

That’s why it’s critical that retailers and other organizations who handle credit card information regularly assess their data protection policies and processes, and implement effective encryption and data transfer tools that can automate the process of keeping data secure so they can focus on keeping their customers happy.

Check out this story in today’s Omaha World Herald about the challenges businesses of all sizes face when trying to avoid a costly data breach.  And for more information about how Linoma Software can help keep your data safe at rest and in motion, email Solutions@LinomaSoftware.com.

Finding the Path to PCI DSS Compliance

Posted by on Wednesday, 28 March, 2012

PCI DSS Compliance with Managed File TransferIf you’re doing business and collecting payments via credit card, debit card, or other e-commerce options that allow you to store and/or transmit cardholder data, you are subject to PCI DSS compliance regulations.

In an attempt to reduce credit card fraud, the Payment Card Industry Security Standards Council developed an information security standard for those with access to consumers’ transactions and card numbers.  This standard continues to evolve, and is now labeled PCI DSS 2.0.  While the compliance verification process isn’t formal for all organizations, they all must meet the standard to manage liability in case of credit card fraud.

Linoma Software has published a new white paper entitled PCI DSS Compliance with Managed File Transfer that reviews the requirements for PCI DSS 2.0, and explains what role implementing a managed file transfer solution can have in meeting several aspects of the regulations, especially the protection of cardholder data. Download the white paper now, and review other resources available at GoAnywhereMFT.com.

Silence the Nagging By Securing Your Data

Posted by on Monday, 6 February, 2012

Compliance issues and the ever-growing list of compliance regulation acronyms (HIPAA, PCI, SOX, etc.) are persistently nagging IT folks who must meet tough mandates and overly complicated rules.

compliance, HIPAA, PCI DSS, data securityOf course, the real reason we must now pay so much attention to compliance is others’ irresponsible abuse. Somewhere along the data strewn path, a few malicious malcontents had to succumb to the voice of greed and abuse their technological skill sets.  All IT professionals’ jobs are tougher thanks to those that through hacking, sniffing, or lifting data sources chose to steal and sell inadequately secured information.

The truth is, though, that “data” really is sensitive information and we live in a paranoid modern world where dastardly damage is done with a just a little twist of the facts.  So in response to the cries of outrage among our citizens, politicians have wrung their bureaucratic hands and offered plenty of passing legislation designed to protect our data.

Because IT is responsible for the company’s data, we need to stay abreast of the laws that apply to it. We also need to to fully understand and implement the three types of data protection: physical, transitional, and procedural.

Physical

Physical protection is probably the easiest. We secure the data on our servers, backup tapes and offsite facilities with technologies such as passwords, drive encryption, backup encryption, data center surveillance, physical locks, etc. We spare no expense in securing the physical because we can see it and believe it is secured. Or so we think.

Transitional

Transitional protection is a little more difficult.  Any data files that leave our networks should be secured with managed FTP solutions that encrypt the files with SFTP, FTPS, HTTPS, PGP, and other protocols.  Firewalls are set up to control what can leave or enter our data domain. DMZ gateways are set up to increase the virtual protection of the data and still allow designated users access to it.

Procedural

Procedural security is a type of data protection that is least understood and implemented.  A clear and understandable security policy needs to be communicated to the end users so they become familiar with sensitive data is secured, and what consequences may loom if procedures aren’t followed.

The majority of us in IT are protective about who has access to our own sensitive data, so we can understand the reason for protecting everyone else, too.  Yes, it’s a lot of work, but it’s part of the new normal.

Reverse Proxy Gateway Video Now Live

Posted by on Monday, 21 November, 2011

Rounding out our series of GoAnywhere product videos, we’ve recently added an overview of GoAnywhere Gateway.  It explains how incorporating a reverse proxy and a forward proxy into your managed file transfer processes adds an extra layer of protection for your private network.reverse proxy DMZ gateway

When GoAnywhere Gateway is implemented, trading partners can exchange files with your organization without gaining access to your private network because no inbound ports will need to be opened to complete the exchange.  This feature is especially important to auditors evaluating compliance with regulations such as PCI DSS, HIPAA, and SOX.

Our Gateway video premier coincides with the release of our latest white paper entitled DMZ Gateways: Secret Weapons for Data Security.  Please let us know if you’d like to learn more about how our reverse proxy DMZ gateway can improve your secure file transfer system.