Take your PCI compliance to the next level

Think about how many times each day you pull a credit or debit card out of your wallet to pay for gas, groceries, a cup of coffee, or a new pair of shoes.

Think about how many times each day you pull a credit or debit card out of your wallet to pay for gas, groceries, a cup of coffee, or a new pair of shoes. Now, think about how many times each week you make online purchases. If you’re a frequent shopper on a particular website, you may have saved your credit card information on the website.

These behaviours are pretty common and illustrate the point that credit card data is everywhere … on company networks anywhere around the world … right this very minute. And hackers are working diligently to get their hands on that data.

Over the past few years there have been several news stories about major retailer data breaches, which became a huge wake-up call for company executives. The companies who were targeted had to spend millions of dollars replacing customers’ store credit cards. For some, stock prices took a nosedive and the company also had to deal with the very public fallout from both a PR perspective, and even more importantly, the loss of customer trust.

You may think that your company isn’t at risk of a credit card data breach for a variety of reasons, but the reality is, any company that uses credit or debit card transactions is at risk for a data security breach.

What steps can your company take to protect your customer payment card data?

Don’t assume that because your company is PCI compliant, you’re safe from a databreach.

PCI compliance is the baseline for payment card data protection; no matter the size of your organization, it should be a top priority to avoid the costly liabilities and reputational damages associated with a data breach.

First, ensure that your organization is compliant with payment card industry (PCI) standards for data security. The PCI Security Standards Council has outlined very specific regulations and best practices to help businesses store, process, transmit, and protect consumer credit card data. Large organizations may have an entire department devoted to PCI compliance with regular data audits, network monitoring and testing programs, IT security policies, and vulnerability plans. Smaller organizations may not have a team of people specifically overseeing PCI compliance, but it should still be a top priority to avoid damaging and costly liabilities.

Here are a few questions to think about as you determine if your company is PCI compliant[1]:

  • Are you tracking and monitoring all access to your network resources that are connected to cardholder data?
  • Have you created a PCI zone?
  • Have you identified and implemented specific controls to ensure the security of your systems?
  • Do you regularly test your network security systems?
  • Do you have a plan to conduct internal PCI data audits?

Second, don’t assume that because your company is PCI compliant, you’re safe from a data breach. PCI compliance should be your baseline for credit card data protection, but it doesn’t cover all potential security issues. To truly become secure, you should examine your network to find vulnerability gaps, and you should take steps to fill any gaps to make sure it’s as secure as possible. These questions are often overlooked when performing a data security gap analysis:

  • Are you maintaining DNS and DHCP logs as part of your PCI compliance program?
  • Do the logs provide sufficient audit details, such as time and date stamps?
  • How and where are you storing these logs?
  • Is your stored DNS and DHCP data encrypted?
  • Do you have a process for reviewing the security logs to look for abnormal patterns or behaviors?

If you need help ensuring that your network is PCI compliant or if you want to boost your network security beyond the regulations of PCI compliance, BlueCat can help you. We offer robust threat protection solutions, such as:

BlueCat IPAM, which gives you complete visibility and control over your IP address management data by tracking the movement of devices and network resources, as well as the discovery of unknown devices.

BlueCat DNS Security™, which provides visibility into every device on your network to help spot inappropriate behavior before it becomes a major data breach.

PCI compliance is the baseline for payment card data protection; no matter the size of your organization, it should be a top priority to avoid the costly liabilities and reputational damages associated with a data breach. Moreover, your company should continuously strive to find and fill vulnerability gaps in order to keep your network secure.

Contact us to find out more.

[1] LEGAL DISCLAIMER: The information contained in this post is provided as-is and for general purposes of interest only. This post does not contain legal advice and is only intended to provide general guidance on PCI compliance. While we have attempted to ensure that the information has been obtained from reliable sources, BlueCat is not responsible for the accuracy of this information or for the results obtained from the use of this information. In no event will BlueCat, or its affiliates, be liable for any damages or losses resulting from the use of information in this post.

 


An avatar of the author

BlueCat provides core services and solutions that help our customers and their teams deliver change-ready networks. With BlueCat, organizations can build reliable, secure, and agile mission-critical networks that can support transformation initiatives such as cloud adoption and automation. BlueCat’s growing portfolio includes services and solutions for automated and unified DDI management, network security, multicloud management, and network observability and health.

Related content

Detect anomalies and CVE risks with Infrastructure Assurance 8.4 

The Infrastructure Assurance 8.4 release features an anomaly detection engine for outliers and a CVE analysis engine to uncover device vulnerabilities.

Read more

Get fast, resilient, and flexible DDI management with Integrity 9.6

With Integrity 9.6, network admins can get support for new DNS record types, architect and configure multi-primary DNS, and automate IP assignments.

Read more

Deepen your security insight with Infrastructure Assurance 8.3

BlueCat Infrastructure Assurance 8.3, with an enhanced analytics dashboard, including interactive widgets and top 10 alerts, is now available.

Read more

Security, automation, cloud integration keys to DDI solution success

Only 40% of enterprises believe they are fully successful with their DDI solution. Learn how to find greater success with new research from EMA and BlueCat.

Read more

Our commitment to Micetro customers and product investment

From CEO Stephen Devito, a word on BlueCat’s ongoing commitment to supporting Micetro customers and Micetro’s evolution as a network management tool.

Read more

Seven reasons to rethink firewall monitoring and boost automation 

With BlueCat Infrastructure Assurance, you can better protect your network with automated alerts and suggested remedies for hidden issues in your firewalls.

Read more