The UK Data Protection Act (1998) requires any organisations that receives, transmits, stores or processes personal information to comply with the eight basic principles contained in Schedule 1 of the Act.

The essence of the eight principles can be summarised as follows:

• Personal data shall be processed fairly and lawfully


• Personal data shall be obtained only for lawful purposes


• Personal data shall be adequate, relevant and not excessive


• Personal data shall be accurate and kept up to date


• Personal data shall not be kept longer than necessary


• Personal data shall be processed in accordance with the rights of data subjects under this Act


• Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing


• Personal data shall not be transferred to a country or territory outside the EU except in specific instances where equivalency of safe-harbour applies

Compliance with the Data Protection Act is a legal requirement for all organisations operating in the United Kingdom which collect, store or process personally identifiable information. Ensuring ongoing compliance with the Act is therefore an essential management activity for any company or organisation which engages is the abovementioned activities.

In addition to potential penalties that may be imposed by the courts or the Information Commissioner’s Office, most modern organisations are reliant on their brand reputation to attract and retain customers and partners in the private sector or to achieve their organsational or statutory goals in the public sector.

As such a breach of data privacy could have far wider consequences than any sanction imposed by the Information Commissioner or any other regulatory body and could compromise a key commercial relationship or prejudice your organisation’s ability to win and retain customers.

Achieving compliance with the Data Protection Act should begin with the selection of an expert third party advisor and is achievable through a regime of analysis and assessment, training and awareness initiatives, organsational support and policy implementation all of which need to be underpinned by appropriate technological architectural and infrastructure investments.

In conjunction with the expert advisor, the next step will be assess your organisation against the eight principles of Schedule One of the Act and determine a remediation plan that will close off any shortcomings identified in the most pragmatic and cost efficient manner.

This is usually achieved by a process involving the following steps:

1. Scoping of private data environment


2. Gap analysis and assessment of current level of compliance


3. Remediation phase to address identified gaps


4. Re-assessment and issue of Report on Compliance

The expert advisor will also recommend how best to deal with subject data requests by data subjects whose personal data your organisation controls.

How can Sysnet Global Solutions help?
Sysnet has a team of information security consultants whom are well versed in the governance, risk and compliance of personal data. Sysnet is able to provide advice on how to protect your data as well as distributing this data in a safe and a secure manner. Our consultants have strong experience in dealing with data protection issues and how the movement and the storage of data can impact your business operational tasks. Not only can Sysnet provide consultancy advice on how to protect your data but also what to do if there is a data breach and how best to contain any unfortunate events that may happen.

For further information on our Information Security Services, please contact one of our Sales representatives by calling +353 (0)1 495 1300 or by completing our Online Enquiry Form or Request a Call Back Form.

Overview of the main changes between v1.2.1 and v2.0 of the PCI DSS

Prior to its release, the latest version of PCI DSS has sparked debate as to whether there would be significant changes to the standard.

PCI DSS v2.0 was officially released in October 2010 and demonstrated that changes had been made mainly for clarity to maintain the quality of assessments. There have been numerous changes, many of which seek to be more specific around test procedures that are required. The other main changes to the standard are highlighted below:

• Scoping;
• Inclusion of Virtualisation;
• Storage;
• Time Synchronisation;
• Scanning;
• Wireless and IDS/IPS;
• Evolving Requirements: Applications.

Each of these areas will be broken down below to cover the high level salient changes that have occurred to the PCI DSS.

Scoping
As with any PCI DSS assessment, it is important that proper scoping is conducted. Changes have been made to ensure that the scope has been clearly defined with emphasis on the following points:

1. Requirement to identify all locations of cardholder data flow;
2. Explicit requirement for merchants / service providers to identify and explicitly define all of the locations and flows of cardholder data annually before they begin their assessment;
3. Documentation must be presented that shows how the PCI DSS scope was confirmed and the scoping results so that the assessor can review and accept as evidence if appropriate;
4. Consider all areas of stored electronic and physical media containing cardholder data. This should include (but not be limited to) databases, mail orders, faxes, call recordings, emails, temporary files and log files;
5. “System components” also include any virtualisation components.

Main impact:

• Organisations may need to be more proactive and spend more time understanding where cardholder data is processed, stored or transmitted;
• Expect the QSA to spend more time verifying the scope, specifically the data flows and storage locations;
• Expect to be asked to present evidence of how the controls are adequate to segment the scope, and prove that testing has been conducted outside of this scope to ensure that there is no additional pollution.

Virtualisation
Virtualisation is now officially recognised and therefore all virtualised system components should be reviewed to determine whether they are in scope for PCI DSS. If they are in scope, then the PCI DSS controls will apply depending on the context of the components. For example:

1. Virtualised servers would require all PCI DSS requirements applicable for servers;
2. Virtualised firewalls and routers would require all PCI DSS requirements applicable for firewalls and routers;
3. Virtualised system components would require all PCI DSS requirements applicable for that particular type of system component.

Main impact:

• Including virtualised system components within the scope should not come as a surprise. If virtualisation technologies have not been included in the scope before, then your QSA may spend time reviewing the setup and corresponding documentation for that component;
• Sysnet have always applied the requirements in this manner, so there should be minimal uplift to any customers engaged with our QSA’s.

Storage
Emphasis has been made to prevent access to both truncated and hashed versions of the PAN as well as the PAN itself. With special tools, it takes a trivial amount of time and effort to use these two elements to generate a PAN.

Review the following:

1. Implementation of controls to ensure that the hashed and truncated values cannot be correlated to reconstruct the original PAN;
2. Whether you need to keep both truncated and hashed versions –if you don’t need it, don’t store it.

Main impact:

• Adding additional controls may provide additional expenses;
• It may prove difficult to add additional controls depending on your implementation;
• Storage of both versions may be by design currently, and making this change may prove difficult. Further work would need to be conducted to understand the risk and impact around any change.

Time Synchronisation
It is important to ensure that your clocks are accurate, in order to aid any forensic work. To support this, there must be clear and documented processes for distributing time through your cardholder data environment.

Previously there has been a bias towards using NTP. In the new standard references to any particular technology is removed.

Whatever time synchronisation you decide to use, make sure you use approved sources and have the distribution of time documented appropriately.

Main impact:

• Flexibility to use other time synchronisation technologies that may be more suitable for your environment;

Scanning
This is a very important area to consider. PCI DSS requirement 11.2 is now split into further subtests to explicitly conduct internal (11.2.1) and external (11.2.2) test procedures for vulnerability scanning. Why? In many cases organisations may rely on external vendors to conduct external testing. This change may indicate that organisations fall into trouble when required to demonstrate internal testing.

Don’t neglect internal scanning. Remember to:

• Conduct internal testing at least on a quarterly basis;
• Conduct internal rescans until there is a passing scan;
• Document scanning procedures and provide document evidence of the outcome of both internal and external scans.

Main impact:

• For those who have not conducted internal testing you should start this process as soon as possible. Failure to demonstrate the required internal testing evidence could jeopardise your next PCI compliance review.

Wireless and IDS & IPS
Organisation should not neglect the fact that rogue wireless devices are easy to implement and therefore post a significant threat. A few changes have been made:

• PCI DSS requirement 2.1.1 is split into further test procedures, but something is missing? There is no reference to WPA (or in fact any wireless technology);
• PCI DSS requirement 11.1 includes “physical/logical inspections of system components and infrastructure”;
• PCI DSS v2.0 mandates that IDS/IPS may be configured to monitor the perimeter and all critical points within the cardholder data environment.

Main impact:

• Organisations will need to give consideration to moving to WPA2 some serious thought. Or they will need to bolster the current wireless implementations with enterprise level security rather than just using Pre-Shared Keys (PSK). A better position may be to, ask yourself “Is sending cardholder data over wireless the best way”. Again, if you don’t need it then don’t use it;
• Physical/logical inspections of system components provides greater flexibility to meet the test procedures, especially for small organisations with few resources, who currently may not be knowledgeable in using specialist wireless scanning and IDS/IPS software;
• Wireless IDS/IPS systems at critical points in the CDE, may mean less system management overheads and potentially less false positives.

Evolving Requirements
Two extra requirements that PCI DSS v2.0 has included to spice things up will keep those involved with software development and patching busy:

• PCI DSS requirement 6.2 not only requires the ability to identify security vulnerabilities, but also to assign a risk ranking;
• PCI DSS 6.5 has been refined as a reminder that the requirements apply to all software and not just web applications. Furthermore, 6.5.6 requires addressing of “High” risk vulnerabilities, which have been identified using the new risk ranking processes in PCI DSS requirement 6.2.

Main impact:

• Organisations must start developing risk ranking processes at their earliest opportunity;
• This risk ranking could also work in your favour. The standard risk ranking provided by the vendors may not be appropriate within your environment. This may allow additional time for testing and scheduled rollout rather than reactionary installation;
• Organisations will be required to spend time demonstrating proper secure software development lifecycle for all internally-developed applications within scope for PCI DSS.

How will v2.0 impact on organisations seeking to attain/retain PCI DSS compliance?
To the relief for most organisations, PCI DSS will have minimal impact. The changes made have been for clarity of the test procedures and in recognition of advancing technology and threats. The main points are:

• Organisations should properly scope where their cardholder data is. It is difficult to secure the data if it is not known where it is;
• Expect your QSA to spend more time verifying the scope, reviewing the current technologies (which may now be considered not fit for purpose) and gathering evidence.

Will there be future updates to the PCI DSS?
The PCI DSS now uses a three-year life cycle and the next standard should be released around October 2013. The following diagram is taken from the official Lifecycle for Changes to PCI DSS and PA-DSS demonstrating the phases of the three year cycle.

Based on PCI DSS v2.0, it is envisaged that the new version will:

• Have further improvements in scoping;
• Clarifying assessment procedures;
• Include considerations for advances in technology as well as threats;
• Other areas as we do not yet know what the future holds.

Final reminder to organisations
It is imperative that organisations focus on their business processes and not just the technology. All organisations must understand they are obliged to protect customers cardholder data –PCI DSS applies all year and it is not just for the assessment.

As advances are made to technology, standards and regulations, organisations must not stand still. All organisations should consider undergoing QSA lead “health-checks” throughout the year to accommodate and review the impact of the change, in order to assist them with remaining PCI DSS compliant.

For further information on our PCI compliance services, please contact one of our Sales representatives by calling +353 (0)1 495 1300 or by completing our Online Enquiry Form or Request a Call Back Form.

PCI DSS Overview

The Payment Card Industry Standard (PCI DSS) is a compliance standard that governs the processing, storage or transmission of cardholder data. PCI DSS applies to any organisation which processes, stores or transmits cardholder data. Organisations can be classified as a merchant or service provider. An important point to note is that the standard is not just an IT compliance standard it effects all areas of an organisation.

PCI DSS Background
The PCI DSS was founded in December 2004 by 5 major card brands – Visa, MasterCard, American Express, Discover and JCB. The ongoing maintenance and updates to the standard are performed by the Payment Security Standards Council (PCI SSC), an independent organisation, joint funded by all the participating card brands and participating organisations. The PCI DSS is now on its 4th major release which is now at v2.0.

It is important to note that compliance is not a legal requirement but it is driven by the contractual agreements between merchants and acquiring banks that cannot be ignored.

PCI DSS Requirements
The PCI DSS are broken down into 6 domains that have various sections and associated requirements within each section which are as follows:

• Build and Maintain a Secure Network
  
  1. Install and maintain a firewall configuration to protect cardholder data
  
  2. Do not use vendor-supplied defaults for system passwords and other security parameters


• Protect Cardholder Data
  
  3. Protect stored cardholder data
  
  4. Encrypt transmission of cardholder data across open, public networks


• Maintain a Vulnerability Management Program
  
  5. Use and regularly update anti-virus software on all systems commonly affected by malware
  6. Develop and maintain secure systems and applications


• Implement Strong Access Control Measures
  
  7. Restrict access to cardholder data by business need-to-know
  
  8. Assign a unique ID to each person with computer access
  
  9. Restrict physical access to cardholder data


• Regularly Monitor and Test Networks
  
  10. Track and monitor all access to network resources and cardholder data
  
  11. Regularly test security systems and processes


• Maintain an Information Security Policy
  
  12. Maintain a policy that addresses information security

Why should an organisation comply with the PCI DSS?
There are a number of benefits of attaining PCI DSS compliance;

• Provides your customers with assurance that card transactions will be handled securely by your organisation


• Level 1 service providers who achieve PCI DSS compliance can ask to be added to the Visa and


• MasterCard lists of approved service providers


• Avoidance of financial penalties which are divided into two areas:

1. Non–Compliance Costs


2. Data Breach Costs Can include:
   
   o Fines levied by your acquirer for the cardholder data breach
   
   o Elevation to a level 1 merchant, increasing your ongoing compliance costs
   
   o The need to have an onsite QSA assessment which will add significant overhead to the demonstration of compliance
   
   o Consultancy costs for forensic assessments & remediation advice
   
   o Potential liability for consequential losses due to the card data breach
   
   o The fines which may be levied for non-compliance are potentially unlimited

Common Misconceptions
The following are common misconceptions in relation to PCI DSS compliance;

• You can’t fully outsource all your PCI DSS accountability although you can outsource most of the responsibility for the provision of services; remember some areas of the standard will ALWAYS remain in scope.


• Using a PA DSS compliant application – or a PCI PTS compliant PED does not automatically make your company PCI DSS compliant


• A PCI DSS assessment/ SAQ completion is just a snap-shot. Compliance with PCI DSS must be maintained at all times, and evidence of this needs to be available


• PCI DSS is NOT an IT compliance standard, it affects all facets of an organisation

For further information on our PCI compliance services, please contact one of our Sales representatives by calling +353 (0)1 495 1300 or by completing our Online Enquiry Form or Request a Call Back Form.

Sysnet Global Solutions attains Approved Payment Forensics Investigator (PFI) status

Sysnet Global Solutions, a leading worldwide provider of information security and assurance services, today announced that they have attained the status of approved Payment Forensics Investigator (PFI), confirmed by the PCI Security Standards Council (PCI-SSC). Sysnet are now listed on the PCI-SCC website as approved PCI Forensic Investigators;
www.pcisecuritystandards.org/approved_companies_providers/pfi_companies.php

The PCI Security Standards Council’s PFI program establishes and maintains the rules and requirements regarding eligibility, selection and performance of companies that provide forensic investigation services to ensure they meet PCI Security Standards. The PFI program aims to help simplify and expedite procedures for approving and engaging forensic investigators. The PFI list will replace the previous ‘QFI’ list as of March 1, 2011. After March 1, the card brands will only accept forensic reports from companies that are on the PFI list.

With the growing threat of credit card fraud across the globe and more aggressive tactics shown by organised criminal groups, if an Account Data Compromise (ADC) does occur and an investigation is required, Sysnet are well equipped to minimise the potential loss and ensure that the affected organisation is back to trading in a safe, compliant manner as soon as possible.

“This achievement is the result of the cumulative effort of a number of people at Sysnet and we are delighted that we are now on the PFI list” said Nick Prescot, Senior Consultant of the Data Forensics team at Sysnet Global Solutions “Whilst we wish that no organisation suffers a data compromise, we can now demonstrate that the Sysnet approach to quality, dedication and thoroughness will ensure that, should the worst happen, the end result will be an organisation that is not only above and beyond the requirements of today’s compliance but also well prepared for the future.”

In preparing and rehearsing against potential account data compromises, Sysnet Global Solutions offer incident management workshops, intelligence briefings on the latest trends, briefings on best practice in securing personal data, guidance on how to deal with the legal aspects of an investigation and insurance services that enable organisations to be best prepared in the event of a data compromise.

“This is a very important achievement for Sysnet” said Gabriel Moynagh, General Manager at Sysnet Global Solutions “Our PFI status compliments the extensive range of products and services we currently provide and further increases our ability to assist our clients in protecting vital business information assets.”

For further information on our PFI Consultancy Services, please contact one of our Sales representatives by calling +353 (0)1 495 1300 or by completing our Online Enquiry Form or Request a Call Back Form.

Sysnet to present at the Vendorcom PCI & Payment Security Retailer Breakfast Briefing

Sysnet Global Solutions, a leading worldwide provider of information security and assurance services, will present at the Vendorcom PCI & Payment Security Retailer Breakfast Briefing on March 1st 2011. The event, which takes place in London, will address the information security issues faced by merchants.

The briefing will take the form of short presentations that will provide attendees with up-to-date information that will help improve the security of payment data and move PCI to a business as usual process.

“The data forensics team at Sysnet are very excited to be part of the Vendorcom breakfast briefings” said Nick Prescott, Senior Consultant – Data Forensics, at Sysnet Global Solutions, “Cyber warfare is a relatively new and growing phenomenon and no more so than within the realms of cardholder data. We are passionate about educating, preventing and, when an unfortunate event happens, responding to incidents and ensuring that all businesses affected from a breach emerge from an incident with a renewed confidence in security.”

The presentations will be followed by a Questions & Answers session, during which the speakers will be joined by Nick Heape of Visa Europe and Phil Jones of Barclaycard.

The briefing will take place at the Herschel Room, 76 Portland Place, London, W1B 1NT and will commence at 8.00am and will conclude at 10.30am.

To register a place at this briefing, please go to the following link: www.vendorcom.com/register.php?event_id=78

PCI & Payment Security Retailer Breakfast Briefing – Tuesday 1st March, London

and supported by BARCLAYCARD & VISA EUROPE

Sysnet Global Solutions is proud to be supporting – and speaking at – the Vendorcom PCI & Payment Security Retailer Breakfast Briefing on March 1st and we’d be delighted if you could join us.

This briefing will take the form of short, punchy, focused presentations that will provide you with up to date, accurate information that will help you improve the security of your payment data, move PCI to a business as usual process and ensure that you keep both the business and the customer happy; all this – and not a sales pitch in sight!!

In this briefing, with the help of both ourselves and Tripwire, Vendorcom will be looking at the business impact of PCI & Payment Security:

• What is the cost of compliance (versus non compliance)?
• How do you work with your suppliers to minimise the risk of a security breach?
• If you are breached, what steps can you take to minimise the impact both directly on your customer and on your brand?

Following these presentations, there will also be a Q&A panel, where the speakers will be joined by Nick Heape of Visa Europe and Phil Jones of Barclaycard. This is the opportunity to ask ourselves and the rest of the expert panel your unanswered PCI & Payment Security questions. There will also be time after the session to stay on, ask any additional questions that may not have been answered in the group session – and to network with your peers, the panellists and the Vendorcom team.

It may not always feel like it, but as an industry we are here to help – please take advantage of us!!

Please Note: This briefing is FREE to attend

Agenda:

0800 - 0830 Registration, Breakfast & Networking

0830 - 0840 Welcome & Introduction
Paul Rodgers, Chairman – Vendorcom

0840 - 0905 The True Cost of Compliance

Tripwire have recently completed research into the True Cost of Compliance to determine the full costs associated with an organisation’s compliance efforts. This presentation will highlight the recently released benchmark study of multinational organisations providing a clear understanding of the differences between compliance and non-compliance costs incurred when complying with laws, regulations and policies.
Mike Shanahan, Account Director - Tripwire

0905 – 0930 The Security Breach: Guarding Against and Reacting To!

The PCI DSS is designed to help us guard our business against security breaches – that’s all well and good, but how do we work better with suppliers to ensure that they’re working to reduce our risk as well? And if the worst happens and we are breached, what is the best course of action? In essence, this session will encourage you to prepare for a breach, know how to limit your exposure to the risk of a breach and understand what best to do in the event of an account data compromise.
Nick Prescot, Senior Consultant, Forensics – Sysnet Global Solutions

0930 – 1000 Q&A Panel

What do you really want to know? What is the most burning question you have about PCI & Payment Security that remains unanswered? Now is your chance to ask it!!
Mike Shanahan (Tripwire), Nick Prescot (Sysnet), Nick Heape (Visa Europe), Phil Jones (Barclaycard), Paul Rodgers (Vendorcom)

1000 – 1030 Coffee & Networking

Your time away from the business is precious, we recognise that, and that’s why we’ve kept this session short and snappy! However, we also know that there’s never enough time to answer everybody’s questions in an open session – and indeed there may well be questions that you don’t want to ask in an open session.

So, the Vendorcom team, our speakers and our panel will all be staying on for coffee after the session so that, if you want to, you can spend an extra few minutes/half an hour, asking questions and taking the opportunity to share experiences with your peers – who knows what additional nuggets of information you could pick up that might just help your business!

Date: Tuesday 1st March 2011

Time: 0800 (for a prompt 0830 start) – 1000 (with opportunity to stay on through to 1030 to ask additional questions/network)

Venue: Herschel Room, 76 Portland Place, London, W1B 1NT

Map: Click here
Nearest Underground Station: Regents Park (Bakerloo Line), Great Portland Street (Circle, Hammersmith & City, Metropolitan Lines)

Cost: This event is FREE to attend

Registration: To confirm your place at this event: Register Here

We hope that you will be able to join us, Vendorcom and Tripwire on 1st March.

Sysnet Global Solutions announces appointment of new Regional Manager for North America

Sysnet Global Solutions, a leading worldwide provider of information security and assurance services, today announced the appointment of Bill Hodge as Regional Manager for North America with immediate effect. Bill will be based in Knoxville, Tennessee.

In this role, Bill will oversee Sysnet’s North American based business activities with an emphasis on new business development and client relationship management.

“We are very pleased to welcome Bill to the company” said Tom Moynagh, Managing Director at Sysnet, “Bill has considerable experience in the Information Security industry having provided consultancy, audit and risk assessment services to businesses operating in a wide variety of industries. We look forward to working with Bill and to the further development of our US based business.

“I am delighted that Sysnet have identified North America as a key region for business growth.” said Bill Hodge, Regional Manager for North America “This is a critical time for many organizations as they struggle to both maintain regulatory compliance and protect their businesses whilst also adhering to strict budget controls. I am confident that Sysnet can provide the best value services to assist such organisations in meeting all of these requirements.”

Bill graduated from East Tennessee State University with Bachelor and Masters Degrees after serving in the United State Marine Corps. He also holds AAS in Computer Science from the Pellissippi State Technical Community College, and has earned the CISA and CISSP certifications.

Further key personnel appointments for the North American region are expected in the near future.