|
Organizations of all sizes face a myriad of evolving
regulations governing personal and confidential information
protection as well as proper internal controls. These
standards require different security measures and processes
to be in place around data protection and system integrity,
and also require detailed audit trails that prove regulatory
or policy compliance. While enterprises face mounting
threats from external and inside forces, policies must be
established and enforced throughout the organization, in
order to maintain system integrity and confidentiality of
intellectual property, personal medical records, classified
data, or financial information.
Lumension’s Security Management Software Helps Organizations Comply with Regulations and Policies
Lumension’s security management software is designed to
protect the integrity, confidentiality and availability of
sensitive data throughout the network in alignment with
internal company policies as well as with regulations.
Lumension Security solutions provide visibility into an
organization’s security practices and delivers policy-based
endpoint controls to effectively comply with security
regulations:
- Discover assets through network and
agent-based security assessments
- Develop endpoint security policies
and mandatory baselines
- Assess and remediate vulnerabilities
and configuration issues
- Enforce application and device use
policies at the endpoint
- Audit security policies through
detailed and actionable reporting
Lumension security management solutions have achieved the
rigorous international standards of Common Criteria EAL2
certification from the Common Criteria Evaluation and
Validation Scheme (CCEVS) Validation Body.
Regulations that Lumension security management solutions address include the following:
Financial Services Regulations that Require
Security Management Software
- Basel II -
Global
Basel II establishes
minimum capital
requirements for banking
organizations to reduce
operational risks.
-
Gramm-Leach-Bliley Act (GLBA)
- US
GLBA seeks to protect
the personal information
of consumers stored in
financial institutions
by requiring all
financial institutions
to implement and
maintain security
measures to protect
customer information and
prevent unauthorized
access and use of
customer records.
-
Payment Card Industry (PCI) Security
Standard - Global
PCI Security Standard
seeks to ensure
consistency of security
standards for credit
card issuers, and to
assure cardholders that
their account
information is secure,
regardless of where the
card was used for
payment.
Government/Public Sector Regulations that Require
Security Management Software
- Federal Information Security
Management Act (FISMA) - US
The Federal Information
Security Management Act was established
to bolster computer and network security
within the Federal Government and
affiliated parties (such as government
contractors) by mandating yearly audits.
- Office of Management and
Budget (OMB) M-06-16 Mandate - US
OMB M-06-16 Mandate requires agencies to
establish safeguards for sensitive
agency data on laptops and workstations.
Cross-Industry Regulations that Require Security
Management Software
- Sarbanes-Oxley Act (SOX) -
US
SOX was developed in 2002 to
protect investors by improving the
accuracy and reliability of corporate
disclosure.
- BS ISO/IEC 27001:2005
Compliance - UK
The BS ISO/IEC 27001:2005 standard
provides a comprehensive set of controls
comprising best practices in information
security, intended to serve as a single
reference point for identifying the
range of controls needed for most
situations where information systems are
used in industry and commerce, and to be
used by large, medium and small profit
and non-profit organizations.
- Data Protection Act (DPA) -
UK
The Data Protection Act was implemented
in 1998 with the purpose of safeguarding
the fundamental rights of individuals
with regard to the processing of
personal data and the free movement of
such data.
Achieving Payment Card Industry (PCI) Data Security Standard Compliance
PCI Data Security Standard
The continuation of massive credit card data breaches
at many high profile organizations, prompted the
development of the Payment Card Industry Data Security
Standard (PCI DSS), which standardizes how credit card
data should be protected. Under the PCI DSS, a business
or organization should be able to assure their customers
that its credit card data/account information and
transaction information is safe from hackers or any
malicious system intrusion, whether from those outside
the organization or from within:
- 65 percent of financial services
institutions worldwide experienced
repeated external breaches within
the past 12 months¹
- 30 percent of these global
institutions suffered repeated
internal breaches during the same
timeframe¹
To achieve compliance with the PCI Security Standard,
vendors and service providers must adhere to six major
categories of requirements, with a total of twelve
PCI-required controls, covering access management,
network security, incident response, network monitoring
and testing and information security policies.
Lumension’s Security Management Solutions Help Credit Card Issuers and Processors Comply with PCI
Lumension’s endpoint security solutions enable credit
card issuers and processors to ensure the
confidentiality of customers’ financial records and to
ensure a stable and secure network environment.
Lumension Security solutions include:
-
PatchLink Security Configuration
Management - Out-of-the-box
regulatory and standards-based
assessment to ensure endpoints are
properly configured.
-
PatchLink Update - Proactive
management of threats through
automated collection, analysis, and
delivery of patches (all major
operating systems and applications)
across heterogeneous networks.
-
PatchLink Scan - Complete
network-based scanning solution
enables assessment and analysis of
threats impacting all network
devices.
-
Sanctuary Application Control -
Policy-based enforcement of
application use to secure your
endpoints from malware, spyware and
unwanted or unlicensed software.
-
Sanctuary Device Control -
Policy-based enforcement of
removable device use to control the
flow of inbound and outbound data
from your endpoints.
Lumension proactively addresses PCI standards by
continuously monitoring and assessing enterprise
networks for software and configuration vulnerabilities,
rapidly patching and remediating vulnerabilities and
applying user access control policies across
applications and removable devices.
PCI DSS
Build and maintain a
secure network
Requirement 1: Install and maintain a
firewall configuration to protect data
Requirement 2: Do not use vendor-supplied
defaults for system passwords and other
security parameters |
Protect Cardholder Data
Requirement 3: Protect stored data
Requirement 4: Encrypt transmission of
cardholder data and sensitive information
across public networks |
Maintain a vulnerability
management program
Requirement 5: Use and regularly update
anti-virus software
Requirement 6: Develop and maintain secure
systems and applications |
Implement strong access
control measures
Requirement 7: Restrict access to data by
business need-to-know
Requirement 8: Assign a unique ID to each
person with computer access
Requirement 9: Restrict physical access to
cardholder data |
Regularly Monitor and
Test Networks
Requirement 10: Restrict access to data by
business need-to-know
Requirement 11: Assign a unique ID to each
person with computer access |
Maintain an Information
Security Policy
Requirement 12: Restrict physical access to
cardholder data |
The Cost of Non-Compliance
Non-compliance with PCI can result in financial
penalties levied against any vendor or service provider
or even the denial of the ability of the merchant to
accept or process credit card transactions. Costs also
include:
- Monthly fines
for noncompliance
range from
$5,000-$25,000
- Lost business -
if acquirer refuses
to process card
payments for a
merchant after data
breach occurs
- Damaged
reputation –
consumers prefer to
conduct business
with company whose
reputation is
untarnished and
never experienced
data breach
1 - Deloitte Global Financial Services Industry 2007 Global Security Survey
|
Regulatory
and Policy Compliance that Requires Security Management
Software