Financial Data Services Provider Achieves PCI DSS Compliance for Virtual Desktop Infrastructure

Transcription

1 Financial Services PCI Financial Data Services Provider Achieves PCI DSS Compliance for Virtual Desktop Infrastructure Case Study Customer: A leading Fortune 500 corporation providing financial data services with 19,000 employees generated in excess of $4 billion in revenue from clients including financial institutions, telecommunications and utility companies, healthcare and insurance providers, retailers and municipalities. Business Challenge An important component of this commerce systems provider s business operations involves maintaining credit and debit card information on be half of financial services clients. In order to provide the highest levels of security and customer confidence, it participates in the Payment Card Industry s Data Security Standard (PCI DSS) which provides a stringent set of requirements for handling and protecting sensitive card-related data. The company, a long-standing supporter of PCI DSS, has always been proactive in ensuring that its environment exceeds the expected compliance requirements. As part of the initial ramp up to gain compliance the company determined the need for a robust, centralized encryption and key management solution. We continue to appreciate that our selection of Vormetric Data Security has never restricted our ability to choose the optimal platform, operating system, application or repository for any given implementation. It gives us a cross-platform, cross-database encryption solution with an easy to use Web-based management console. Technical Project Manager Technical Challenge Potential data security solutions were identified and evaluated against a detailed set of criteria. In addition to flawless performance in encryption and key management, contenders were assessed on heterogeneous capabilities, impact on transaction processing time and the ability to handle a wide variety of applications and data repositories. The Technical Project Manager for the commerce systems provider recalled, We looked at many products, including native solutions for our Linux and IBM AIX platforms, and even several open source candidates. It rapidly became apparent that the Vormetric Data Security solution was coming out on top.

2 Financial Services PCI Solution Having selected Vormetric Data Security, a two month proof of concept was conducted using data located in servers running the IBM AIX operating system. The Technical Project Manager commented, We deliberately picked a very challenging scenario to test the application. We knew that if things worked well, deployment into a more standard environment would be easy. After a highly successful proof of concept, the Vormetric Data Security solution was fully incorporated into the commerce systems provider s diverse infrastructure. Results Following the Vormetric Data Security deployment, the company was able to attain PCI DSS compliance within its planned implementation schedule. The current infrastructure utilizes virtual desktop infrastructure (VDI) and Hypervisor from VMware, with direct-attached SCSI drives containing approximately 5 TB of encrypted data. The Technical Project Manager stated, The combination of Vormetric Data Security and our VMware VDI environment provides us with great protection. There is multi-factor authentication to get to the virtual environment and then an arsenal of policies to guard the data inside of the VDI; all contributing to helping us exceed the rigorous PCI DSS audit requirements. In the three years since the original proof of concept was completed, the solution has continued to excel. The Technical Project Manager commented, Once configured, the Vormetric solution really just runs itself. We don t have to explicitly manage anything and despite the sophistication of the product, the Web-based management console makes administration a very straightforward task. He continued, Right from the outset, we knew that we could not tolerate any negative impact on the speed of processing card transactions. We ve been able to successfully layer the comprehensive Vormetric capabilities on top of our existing heterogeneous environment with no discernable drop in transaction throughput. Vormetric Helps Achieve PCI DSS Compliance Business Need: Exceeding PCI DSS compliance requirements for credit and debit card data security. Technology Need: Providing encryption and key management capabilities for data located in a VDI environment involving multiple operating systems. Solution: Vormetric Data Security encrypting data on servers running Linux and IBM AIX operating systems. Result: PCI DSS compliance achieved within desired timelines across VDI environment. The Vormetric support team is always accessible and committed to doing whatever it takes to ensure we are successful. It is very clear that the whole company views our relationship as a true partnership. Vormetric Data Security Vormetric provides a proven data security solution to enable rapid compliance with multiple aspects of PCI DSS. Vormetric Data Security delivers industryleading data encryption and key management capabilities without the need to modify existing infrastructure components. High-performance encryption methods ensure negligible impact on transaction throughput and a sophisticated Web-based management console minimizes incremental operational overhead. About Vormetric Vormetric is the leader in enterprise encryption and key management for physical, virtual and cloud environments. For more information, please call (888) or visit Copyright 2013 Vormetric, Inc. All rights reserved. Vormetric is a registered trademark of Vormetric, Inc. All other trademarks are the property of their respective owners. No part of this publication may be reproduced, stored in a retrieval system or transmitted, in any form or by any means, photocopying, recording or otherwise, without prior written consent of Vormetric. Vormetric, Inc N. 1st Street, San Jose, CA United States: United Kingdom: South Korea: info@vormetric.com

3 Focus Services Call Center Meets PCI Standard Swiftly with Vormetric Data Security Founded in 1995, Focus Services is a privately owned call center service provider, specializing in multi-product telesales and customer relationship management. Headquartered in Roy, Utah, the company currently has 2,000 employees working at eight facilities worldwide. Focus Services has built its business on the simple premise that if its staff can sell, it will always have clients who need its services and this principle has enabled the company to excel in both the highly competitive, complex consumer and B2B markets. Business Challenge As an outsourced call center, Focus Services doesn t directly store credit card data because payment processing is conducted via portals supplied by its clients. However, as Bill Wiser, VP of information systems, security and networks for Focus Services, pointed out, We audio record 100 percent of our communications with customers and these recordings where credit card data is discussed now fall within the scope for PCI DSS compliance under which information must be encrypted. Aside from meeting this standard we also want to make sure we re always providing a totally secure environment for our customers data. Technical Challenge Focus Services has a corporate policy to store call recordings in-house for a minimum period of three years and some clients require up to a seven-year retention period. The recordings currently occupy about 12 TB of storage, stated Wiser. While it s not a massive amount of space it is significant and definitely a headache to attempt to individually encrypt the files. We were looking for an easy way to encrypt and decrypt that data. Vormetric s support of the majority of file types and storage methods enables us to work with clients that request us to store credit card data within a CRM system and still be in compliance with the PCI standard. Bill Wiser, VP of information systems, security and networks, Focus Services The only surprise we had with Vormetric Data Security was how easy it was to deploy and manage. Bill Wiser, VP of information systems, security and networks, Focus Services Developed in-house, the application that Focus Services relies on to manage recordings enables employees to search using any piece of client information, to instantly retrieve a recording. Wiser explained, We can locate and have immediate access to an audio file, consequently we wanted an encryption/decryption capability that allowed us to keep as close to real-time as possible. The company wanted to avoid an expensive, complex encryption solution, Wiser described, We needed to gain this new level of security in a way that would easily integrate with our current systems and that wouldn t require hours of implementation effort. TM

4 Focus Services Solution The company s PCI compliance auditors suggested Wiser investigate Vormetric Data Security because of previous experience with its effectiveness in the call center industry. They made the suggestion based on what they saw as being a good fit for us, and a quality product, recalled Wiser. So we contacted Vormetric and that s where the relationship started. We were able to configure our Windows server with its storage area network to be protected by a single Vormetric Data Security Manager appliance. With the help of a Vormetric consultant we had it operational in our infrastructure in under four hours: Despite the sophistication of the solution, it more than met my requirements for a simple and straightforward install. Results Focus Services employees have not experienced any degradation in recording retrieval or latency of any kind associated with encryption. All of the transactions for call recordings take place right on the server where they are stored, explained Wiser, And there s been no perceptible change in performance, which is really pleasing. I d anticipated that implementing encryption would require a lot of complex technical work, but I was very surprised by quickly it was to roll out: Kudos to Vormetric for making it so easy to deploy and operate. Simply Easy Encryption Wiser plans to expand Focus Services use of Vormetric Encryption in the near future. He commented, We ve created a cloud-based solution to integrate all of our worldwide call centers into one logical view so we can see all of our agents showing on a single dashboard and we will need to secure the call recordings on the hosted system. We are also looking at an additional backup system for disaster recovery. Both of these new environments will end up being protected by Vormetric Data Security. He summarized, Vormetric Encryption is very simple to set up, and very easy to manage and operate: I don t have to think about it every day; it s just there and running. Additionally it gives us the ability to scale quickly when needed, knowing that it will cover a wide range of file types to give us data-level protection and PCI compliance no matter what our clients ask of us. Sophisticated solution, simple setup Business Need: Achieve PCI DSS compliance and provide a secure environment for customers data Technology Need: Introduce nominal impact on transaction throughput, with minimal setup and operational overhead Solution: Vormetric Data Security Result: Achieved data-level protection and PCI compliance with imperceptible performance impact and operational burden About Vormetric Vormetric (@Vormetric) is the industry leader in data security solutions that span physical, virtual and cloud environments. Data is the new currency and Vormetric helps over 1100 customers, including 17 of the Fortune 25 and many of the world s most security conscious government organizations, to meet compliance requirements and protect what matters their sensitive data from both internal and external threats. The company s scalable solution suite protects any file, any database and any application anywhere it resides with a high performance, market-leading data firewall that incorporates application transparent encryption, privileged user access controls, automation and security intelligence. Copyright 2013 Vormetric, Inc. All rights reserved. Vormetric is a registered trademark of Vormetric, Inc. All other trademarks are the property of their respective owners. No part of this publication may be reproduced, stored in a retrieval system or transmitted, in any form or by any means, photocopying, recording or otherwise, without prior written consent of Vormetric. Vormetric, Inc N. 1st Street, San Jose, CA United States: United Kingdom: South Korea: info@vormetric.com TM

5 RewardsNOW RewardsNOW Enjoys PCI DSS Compliance with Vormetric Data Encryption Founded in 1997, RewardsNOW offers fully turnkey, enterprise-wide loyalty programs also known as relationship rewards programs for hundreds of financial institutions. On the INC s fastest growing companies for the past five successive years, it has enjoyed proven success in helping credit unions, and commnuity, regional and national banks provide individualized programs to offer rewards to their customers and members. Now over $15 million in revenue, the company has recently expanded into additional industry verticals such as retail, associations and organizations, health-related, and other organizations outside of the financial industry attract, retain and grow their customer bases. The company also launched a merchant-funded shopping network, called ShoppingFLING that provides additional value as part of a rewards program. ShoppingFLING also has been implemented as a standalone product. In order to build a tailored program containing reward discounts or other special offers to encourage continued loyalty, RewardsNOW has to assemble a detailed profile of the engagement patterns of a client s customers. Richard Tremblay, Security Officer for Rewards- NOW, explained, We receive full data feeds of customers debit and credit card transactions to comb through using business rules that have been jointly defined to create customized programs that will actively incent further participation. Business Challenge The volume of transactional data needed to construct a comprehensive understanding of each client s business environment can be enormous, and always requires careful and diligent handling. Tremblay elaborated, As we receive credit and debit card information we have to make sure that it is stored securely and in complete compliance with the Payment Card Industry Data Security Standard (PCI DSS). Paul Butler, RewardsNOW s Database Development Team Leader, noted, While we don t actually process credit card transactions, it s our storing of the sensitive data that makes it essential to ensure the security of the data and to conform to thepci DSS standards. Technical Challenge A key component of complying with the PCI DSS is the protection of cardholder information. We wanted encryption for our file transfer protocol (FTP) server from the point we receive customer feeds, as well as other servers that needed protection, stated Butler. In addition, we were always concerned with the overhead imposed by key management activities and therefore wanted to streamline this function. Tremblay added, Prior to the first audit we worked with our Qualified Security Assessor (QSA) to do a preliminary review to prepare us for attaining PCI Level 1 certification. Even though the SQL Server database had built-in encryption, the QSA advised us that it did not satisfy the PCI Council s criteria for data encryption at either the database or operating system levels. Vormetric is easy to install and manage, and it just works! It s hard to put a price on having such a solid, worry-free solution. Paul Butler, Database Development Team Leader, RewardsNOW

6 RewardsNOW Solution We did a lot of research to find the right tools that could deliver the levels of encryption and functionality we required with a goal to select best-of-breed components, recalled Butler. Tremblay noted, Doing due diligence, we looked at a variety of options, including open source tools, to identify possible solutions. We found nothing suitable in open source, but among vendor solutions our investigations showed Vormetric Data Security satisfied all of our requirements and more! Vormetric provides a proven data security solution to enable rapid compliance with multiple aspects of PCI DSS. Vormetric Data Security delivers industry-leading data encryption and key management capabilities without the need to modify existing infrastructure components. High performance encryption methods ensure negligible impact on transaction throughput and a sophisticated Web-based management console minimizes incremental operational overhead. While many companies go through a proof of concept with new security solutions, we were sufficiently confident to just bring in the Vormetric appliances, said Butler. A Vormetric consultant arrived onsite and helped set up the environment. The deployment experience was awesome and totally painless! The consultant walked us through device configuration using the Web-based portal to define encryption rules and mount points. We did the FTP server first and it worked perfectly right from the get-go. RewardsNOW s production data center is hosted by a company based in the southwest U.S. Encryption was set up to cover the core Windows-based SQL Server database cluster. We configured guard points on all nodes of the SQL Server configuration because we run an active-active cluster and wanted to protect the database files, logs, backups and also the file shares that hang off the cluster, stated Tremblay. Results Under PCI DSS specifications, encryption key rotation must be performed at least once a year. We had a Vormetric support technician on the phone and he walked us through the key rotation process; it was quick and totally straightforward, said Butler. This was huge accomplishment because we didn t have to rekey each individual guard point. It was a ten minute exercise at most! reflected Tremblay. Most importantly, RewardsNOW achieved its goal of being PCI DSS Level 1 compliant on schedule. The Vormetric implementation was so fast and smooth it allowed us to focus on other areas that needed to be addressed to meet the regulations in the tight timeframe, remarked Butler. Flexibility for Future Growth In addition to the current server cluster, the company is evaluating locating a secondary site for disaster recovery purposes on the east coast. The Vormetric solution can handle a geographically dispersed active-passive cluster configuration just as well as it protects our current configuration, stated Butler, and we really appreciate the flexibility that this provides. Tremblay concurred, To be able to have a transparent solution that can flexibly accommodate any infrastructure configuration as we continue to grow is very valuable to us, and will obviously save us capital expenditure in the future. He concluded, We are a modest IT organization in a rapidly growing company so we look for partners that can deliver reliable products that work as described, provide support when we need it, and accommodate our growth: Vormetric does exactly all of this. About Vormetric Vormetric is the leader in enterprise encryption and key management for physical, virtual and cloud environments. For more information, please call (888) or visit Copyright 2013 Vormetric, Inc. All rights reserved. Vormetric is a registered trademark of Vormetric, Inc. All other trademarks are the property of their respective owners. No part of this publication may be reproduced, stored in a retrieval system or transmitted, in any form or by any means, photocopying, recording or otherwise, without prior written consent of Vormetric. Vormetric Protects RSIEH Data Business Need: Encrypting data to satisfy PCI DSS requirements. Technology Need: Ensuring security of unstructured cardholder data in CLS Collection- Master application without significant performance impact. Securing cardholder information in SQL Server database Solution: Vormetric Data Security Result: Vormetric Transparently protects RSIEH data with no discernible performance impact. Vormetric, Inc N. 1st Street, San Jose, CA United States: United Kingdom: South Korea: info@vormetric.com

7 Tab Bank TAB Bank Comfortably Trucks Past PCI DSS Compliance With Vormetric Founded in 1998, TAB Bank was originally started by parent company, Flying J, Inc. now FJ Management, Inc. to serve the financial needs of the $300B US and Canadian trucking industry. It quickly built one of the largest portfolios of trucking relationships and became the leader in transportation-related financing with over $800M in assets and $28M net revenue. TAB Bank has subsequently expanded into other commercial industries by providing a wide range of working capital facilities, equipment financing and deposit products. Vormetric Data Security is quick and easy to administer while having negligible impact on performance; it s the perfect solution for meeting PCI DSS requirements. Daryl Belfry Director of IT TAB Bank Business Challenge TAB Bank desired Payment Card Industry Data Security Standard (PCI DSS) compliance because this certification is an important component for banks. Daryl Belfry, Director of IT for TAB Bank, stated, PCI DSS requires that all stored cardholder data is encrypted, irrespective of the file type or location. We understood why this is so important but were concerned that it could negatively impact the performance of our whole infrastructure. Technical Challenge He continued, We knew that the encryption solution we ultimately selected had to allow us to manage access policies via a simple and intuitive front end. We needed to precisely control how users could access data such as selectively limiting the copying of files to a removable USB device or local hard drive as well as being able to implement explicit system policies like encrypting specific archived data. Solution Belfry and his staff investigated a number of encryption solutions. We felt that the user interface and policy management capabilities of the Vormetric solution were a lot better than the competition, noted Belfry. We liked the simplicity of the Vormetric approach and the manageability from an administrator perspective; System Administrators can be configured to allow execution of certain functions, while a Security Officer can be granted a superset of administration access. We are a rapidly expanding and dynamic business, and the flexibility Vormetric provides is crucial to the bank: It s a solution that grows with us and allows us to securely maintain our data at all times Daryl Belfry Director of IT TAB Bank

8 Tab Bank John Hillas, TAB Bank s Senior Systems Administrator, commented, The majority of our environment is virtualized using VMware with a virtual desktop infrastructure (VDI) but we also have some separate SQL Server and AIXbased database servers. Vormetric s coverage of a wide variety of operating systems and infrastructure configurations allowed us to protect our complete environment, making it very attractive to us. A demonstration of the Vormetric solution proved that it had minimal impact on infrastructure performance, and we were so impressed we decided a proof of concept would not be necessary. Vormetric provides a proven data security solution to enable rapid compliance with multiple aspects of PCI DSS. Vormetric Data Security delivers industryleading data encryption and key management capabilities without the need to modify existing infrastructure components. High performance encryption methods ensure negligible impact on transaction throughput and a sophisticated Web-based management console minimizes incremental operational overhead. Vormetric appliances were installed in the bank s primary data center in Ogden, Utah and at a disaster recovery facility in Salt Lake City, Utah. We had a Vormetric consultant booked for three days onsite, recalled Hillas, but after the first day we had already achieved everything we needed! The whole implementation process was far more intuitive than we had anticipated. Business Need: Becoming PCI DSS compliant Technology Need: Implement comprehensive encryption solution with nominal operational or performance impact Results The decision was made to keep all data, including backups, encrypted by Vormetric even though the tape archival system provided its own encryption mechanism. Hillas reflected, We explicitly configured which programs are permitted to decrypt data, so in order to facilitate controlled access to tapebased archive files we needed to know what executable code our backup system software was utilizing. Log files generated from the Vormetric learn mode enabled the capture and identification of the specific application modules that would be granted permission to perform the decryption. We love the learn mode capability, enthused Belfry. It logs user interactions so administrators see how data is being accessed and can then configure our data access policies to take these patterns into consideration. Hillas added, It s so easy to implement the right policies from the outset. Solution Result: Vormetric Data Security implemented across diverse environment for online and archived data Result: Vormetric Data Security facilitates PCI DSS compliance Exceeding Expectations The Vormetric solution provides us with all the encryption capabilities we needed to attain PCI DSS compliance, summarized Belfry. Since going live we ve experienced no impact on systems performance. Vormetric appliances work as described and more, and we are delighted with the solution. About Vormetric Vormetric is the only provider of high-speed, policy-based encryption for data residing on heterogeneous databases, servers and storage. The largest, most regulated and security-conscious organizations in the world rely on Vormetric to secure data within performance-sensitive, mission-critical systems. Vormetric has over 500 customers and maintains strategic partnerships with IBM for database encryption and Symantec for backup encryption. Copyright 2013 Vormetric, Inc. All rights reserved. Vormetric is a registered trademark of Vormetric, Inc. All other trademarks are the property of their respective owners. No part of this publication may be reproduced, stored in a retrieval system or transmitted, in any form or by any means, photocopying, recording or otherwise, without prior written consent of Vormetric. Vormetric, Inc N. 1st Street, San Jose, CA United States: United Kingdom: South Korea: info@vormetric.com