SECURING YOUR DATA AND MEETING PCI DSS REQUIREMENTS BY USING GUARDIUM

With the widespread use of payment cards, and growing global use, the industry has faced a high rise in the number of incidents of financial fraud. So, the leading payment card companies worked together to develop a set of technical and operational requirements designed to protect cardholder data, commonly referred as PCI DSS (Payment Card Industry Data Security Standard).
The recent high profile data thefts, along with industry statistics, indicate that significant work remains to be done in most organizations to implement PCI DSS.
Most organizations subject to PCI DSS are currently relying on various forms of log management to try to achieve compliance with the monitoring and auditing aspects of the standard. Logging at the detailed level required to achieve compliance imposes a severe performance penalty on systems, while requiring substantial technical resources on an on-going basis to collect and analyze the logs. Security Information and Event Management (SIEM) or centralized logging systems can help with aggregation but lack the detailed data views or analytical tools to address the needs of the payment card industry. And other additional drawbacks in the logging approach include the fact that it does not deal with the substantial issue of insider threats or provide the separation of duties (SOD) required by auditors. So, this clearly indicates that the logging process is inadequate.
So, the solution is Guardium that can,
1. Automatically locate and classify sensitive information, like cardholder data.
2. Assess database vulnerabilities and configuration flaws,
3. Provide 100% visibility at a granular level into all database transactions involving sensitive data,
4. Monitor and enforce a wide range of policies like restricting sensitive data access, privileged user actions and database change control,
5. Create a single secure centralized audit repository across large numbers of heterogeneous systems and databases,
6. Automate the entire compliance auditing process, including creating and distributing reports as well as capturing comments and signatures.
Guardium provides a comprehensive solution that addresses database security and auditing needs across the enterprise, securing all kinds of sensitive data such as financial statements, personnel records and intellectual property. It also has PCI accelerator, an optional software module designed to harness the capabilities of the core Guardium product in order to address the specific requirements of PCI DSS. The key goal of PCI DSS is to ensure protection of cardholder data as stated in Requirement 3. Requirement 10 stipulates very granular data requirements for monitoring movement of sensitive data such as CVV or PIN data.
Similarly, Requirement 7 calls for restricting access to hose with a business need to know. That is, it implements strong access control measure.
Requirement 2 states that vendor—supplied passwords and security parameter should not be used and requirement 11 specifies regular testing of security systems and processes for ensuring discovery of software vulnerabilities in your cardholder environment.