Simplify PCI DSS Compliance

What is PCI DSS Compliance?

PCI compliance is a rigorous set of requirements to aid businesses of all sizes to reduce security breaches and protect data.

For years, the financial services industry was the most targeted industry for sophisticated cyber attackers (and some not so sophisticated). This was never too surprising—attackers often follow the money, starting with the low-hanging fruit.

Out of all the credit card breaches that have been made public in the last several years, not many (if any) companies were truly compliant with Payment Card Industry Data Security Standards (PCI DSS).

At the same time, being compliant also doesn’t mean that you are truly protecting the data that is important. Any company dealing with credit card transactions knows PCI compliance can cause major headaches.

The key is to implement a plan for evaluation, remediation, and ongoing management.

Getting Started with a Qualified Security Assessor (QSA)

You might have 500 people in your company on a 1Gb connection. But your PCI scope could be just 50 endpoints generating 10Mb of traffic. The cost differences are massive, so defining your scope is a critical first step to compliance.

This is why you work with a Qualified Security Assessor (QSA) before upgrading your cyber security infrastructure.

A QSA will conduct a comprehensive analysis of your existing environment and provide a gap assessment for achieving compliance.

The results of a security assessment are often overwhelming—especially for inexperienced organizations. Many companies don’t have the staff or security budget to completely overhaul their infrastructures, and may not need to. But, getting your scope properly identified first will help.

A QSA will definitely help you with this, but understanding where your data exists and how you intend to secure your environment helps as well. Partnering with an MSSP is also an easy and effective way to get help in addressing PCI compliance issues and implementing your controls properly.

Rather than suffering through a list of objectives from a QSA, you can work with people who have expertise and experience in proper compliance implementation.

There’s More to PCI Compliance than the Data Security Standard

There are overlapping security requirements, sometimes requiring organizations to comply with multiple frameworks simultaneously. These all have the same goal in mind; protect the data and implement best-practice security measures.

For the more traditional financial services companies, this is just another regulation to manage. But for SMBs, Regulation 500 will bring entirely new, more specific, rules to comply with; possibly in addition to PCI and in some cases HIPAA.

Key Compliance Programs Tips

Have a plan to analyze all of your Internet traffic – Ingress and Egress traffic can identify potential attacks.
Create a plan to implement a SIEM or to collect your logs and analyze them on a daily basis. This will cover a large number of compliance requirements in any framework, but is not an undertaking that should be taken lightly – it can be a complex process and takes a great deal of planning to implement properly.
Do internal AND external vulnerability assessments.
Evaluate the resources you have to help with implementing these compliance controls as well as managing them long-term.
Choose a security partner or MSSP that understands emerging regulations like PCI and NY 500.

Whether utilizing a SIEM, IDS, IPS, firewall, and/or any other tools to meet compliance, having TAPs and packet brokers in place to filter company-wide traffic into these tools is essential.