PCI Wireless Compliance with AirTight WIPS

Size: px
Start display at page:

Download "PCI Wireless Compliance with AirTight WIPS"

Transcription

1 A White Paper by AirTight Networks, Inc. 339 N. Bernardo Avenue, Suite 200, Mountain View, CA AirTight Networks, Inc. All rights reserved.

2 Introduction Although [use of a wireless analyzer for scanning] is technically possible for a small number of locations, it is often operationally tedious, error-prone, and costly for organizations that have several CDE locations. For large organizations, it is recommended that wireless scanning be automated with a wireless IDS/IPS system. - PCI Wireless Security Standards Council Wireless SIG Recent incidents have highlighted the growing popularity of wireless among cybercriminals to gain sensitive data from both wired and wireless networks. The TJX incident the largest known wireless security breach in the U.S. history is a prime example. Hackers used unsecured wireless as an entry point to access TJX networks worldwide. Over 90 million credit- and debitcard records and personal information such as social security numbers, driver s license numbers, and military identification of more than 451,000 customers were stolen. A total of nine retail chains including Office Max, Boston Market, Barnes & Noble, Sports Authority, Forever 21, and DSW were victims of this heist. Forrester Research estimated the cost incurred to cover financial losses and lawsuit settlements to be one billion dollars. Notably the wireless networks that were hacked during this incident were not necessarily being used for processing cardholder data, but were connected to wired networks that were part of the cardholder data environment (CDE). This highlighted the need to comprehensively secure the CDE against all types of wireless threats including those initiated outside it and those initiated from Rogue wireless access points and clients installed unofficially inside the CDE. The Payment Card Industry Security Standards Council (PCI SSC) responded promptly by releasing the version 1.2 of the PCI Data Security Standard (PCI DSS) in October 2008, later amended to the version 2.0 in October The PCI SSC s Wireless Special Interest Group (SIG) complemented these efforts with a PCI DSS Wireless Guideline document in July 2009 that clarified the wireless security requirements for the PCI compliance, and provided guidance on implementing the wireless security measures for protecting the CDE. This document describes how AirTight WIPS helps organizations achieve compliance with the wireless security sections of the PCI DSS 2.0 standard AirTight Networks, Inc. All rights reserved. 2

3 AirTight WIPS Architecture AirTight WIPS consists of wireless security monitoring Sensors installed at the distributed locations. The Sensors continuously scan the wireless environment in their neighborhood and report the summarized information to the centralized Server. The Server provides centralized web-based console for system configuration, to view and act on scan data and alerts, and to schedule and generate PCI compliance reports. The Sensors can also act as APs to provide Wi-Fi access. Distributed Sensors communicate with the Server using AirTight s lightweight and secure SpectraTalk protocol. Alternatively, SSL is also supported for Sensor- Server communication. AirTight Sensor/AP Central Location AirTight Server Notification Console Location- and brandcontext aware centralized console facilitates ease of management AirTight Networks, Inc. All rights reserved. 3

4 PCI DSS 2.0 Compliance with AirTight WIPS Requirements Applicable to All CDEs: PCI DSS Requirement Testing Procedures How AirTight Meets the Requirement 11.1 Test for the presence of wireless access points and detect unauthorized wireless access points on a quarterly basis. Note: Methods that may be used in the process include but are not limited to wireless network scans, physical/ logical inspections of system components and infrastructure, network access control (NAC), or wireless IDS/IPS. Whichever methods are used, they must be sufficient to detect and identify any unauthorized devices a Verify that the entity has a documented process to detect and identify wireless access points on a quarterly basis b Verify that the methodology is adequate to detect and identify any unauthorized wireless access points, including at least the following: WLAN cards inserted into system components Portable wireless devices connected to system components (for example, by USB, etc.) Wireless devices attached to a network port or network device 11.1.c Verify that the documented process to identify unauthorized wireless access points is performed at least quarterly for all system components and facilities d If automated monitoring is utilized (for example, wireless IDS/IPS, NAC, etc.), verify the configuration will generate alerts to personnel a Sensors continuously scan wireless environment to detect and report wireless devices (APs, clients and their connections) visible in the wireless neighborhood b All types of unauthorized wireless devices (including all commercially available AP devices, and portable USB, PCMCIA and soft APs running on the end user devices) connected to the monitored network are detected. At the same time, legitimate neighborhood APs in the surrounding that do not pose any threat are positively identified to eliminate false positives on Rogue APs. This is facilitated by accurate and lightweight (not requiring interaction with the managed switches) AP network connectivity detection using AirTight s unique patented Marker Packet technology, which uses active packet injection to positively test AP s network connectivity to the monitored network c The unauthorized AP detection as described above works on a continuous basis. The unauthorized APs within the radio coverage of the Sensor and connected anywhere on the subnets monitored by the Sensor are detected as Rogue APs d Alert notification is supported in a number of ways: Alert display on console to administrator Inclusion of the PCI related alerts in the pre-configured PCI wireless compliance report SNMP, syslog, ArcSight notification (AirTight only) 12.9 Implement an incident response plan. Be prepared to respond immediately to a system breach e Verify the organization s incident response plan (Requirement 12.9) includes a response in the event unauthorized wireless devices are detected Obtain and examine the Incident Response Plan and related procedures [snip]... The pre-configured PCI wireless compliance report also catches any mis-configurations of the PCI related alert notification options e and 12.9 Following facilities are provided to implement the incident response plan: Alert notification to the administrator. Various notification options as described above are supported. Automatic prevention policy to instantly block the communication of the detected unauthorized wireless devices. Alternatively, the device blocking can also be manually triggered from the console. Smart Forensics wizard maintains an audit trail and lets administrator or auditor view information about the incident such as devices involved, duration of incident, and actions taken by the AirTight system or the administrator. The pre-configured PCI wireless compliance report also catches any mis-configurations of the PCI related incident response actions AirTight Networks, Inc. All rights reserved. 4

5 Requirements Applicable to CDEs Encompassing Authorized WLAN: PCI DSS Requirement Testing Procedures How AirTight Meets the Requirement For wireless environments connected to the cardholder data environment or transmitting cardholder data, change wireless vendor defaults, including but not limited to default wireless encryption keys, passwords, and SNMP community strings Ensure wireless networks transmitting cardholder data or connected to the cardholder data environment, use industry best practices (for example, IEEE i) to implement strong encryption for authentication and transmission. Note: The use of WEP as a security control was prohibited as of 30 June Write logs for external-facing technologies onto a log server on the internal LAN Verify the following regarding vendor default settings for wireless environments: a Verify encryption keys were changed from default at installation, and are changed anytime anyone with knowledge of the keys leaves the company or changes positions b Verify default SNMP community strings on wireless devices were changed c Verify default passwords/ passphrases on access points were changed d Verify firmware on wireless devices is updated to support strong encryption for authentication and transmission over wireless networks e Verify other security-related wireless vendor defaults were changed, if applicable For wireless networks transmitting cardholder data or connected to the cardholder data environment, verify that industry best practices (for example, IEEE i) are used to implement strong encryption for authentication and transmission Verify that logs for externalfacing technologies (for example, wireless, firewalls, DNS, mail) are offloaded or copied onto a secure centralized internal log server or media. Continued on next page,,, SNMP access is disabled on AirTight Sensor/ APs. Also, AirTight Sensor/APs do not ship with any default encryption keys or passwords. AirTight Sensor/APs support latest industry standard encryption and authentication protocols, as follows: WPA2 [AES encryption and 802.1x or PSK authentication], WPA [TKIP encryption and 802.1x or PSK authentication], WEP is supported, but not recommended Any authorized APs using Open, WEP, or WPA encryption are detected and corresponding notifications are included in the pre-configured PCI wireless compliance report. In addition, compliance of AP authentication and encryption with the configured wireless security policy (802.11i) is constantly monitored. In case of a mismatch, an alert is generated on the mis-configured AP, and optionally, the AP s communication can be automatically blocked AirTight supports automatic daily/weekly/ monthly backup for the system data including events, listing of detected devices, archived reports, and system configuration AirTight Networks, Inc. All rights reserved. 5

6 11.4 Use intrusion-detection systems, and/or intrusion-prevention systems to monitor all traffic at the perimeter of the cardholder data environment as well as at critical points inside of the cardholder data environment, and alert personnel to suspected compromises. Keep all intrusion-detection and prevention engines, baselines, and signatures up-to-date a Verify the use of intrusiondetection systems and/or intrusionprevention systems and that all traffic at the perimeter of the cardholder data environment as well as at critical points in the cardholder data environment is monitored b Confirm IDS and/or IPS are configured to alert personnel of suspected compromises c Examine IDS/IPS configurations and confirm IDS/IPS devices are configured, maintained, and updated per vendor instructions to ensure optimal protection. 11.4a AirTight WIPS and AirTight Cloud Services are complete wireless intrusion detection/ prevention systems (WIPS). In particular, the unauthorized APs within the radio coverage of the Sensor and connected anywhere on the subnets monitored by the Sensor are detected. Single Sensor can monitor multiple subnets (VLANs), including the PCI VLAN and other VLANs sharing switch resources with the PCI VLAN, for unauthorized wireless devices. In addition, AirTight also offers protection against all other wireless threats such as mis-associating clients, honeypot APs, ad hoc connections, DoS attacks, MAC spoofing, cracking etc. 11.4b The pre-configured PCI audit report catches any mis-configurations of the PCI related alerts. 11.4c In AirTight Clould Services, the IDS/IPS server is hosted in the AirTight datacenter and managed by the AirTight personnel, and it is kept up to date with the latest version of software and intrusion detection parameters. In case of AirTight WIPS, notifications are sent to the customers whenever newer versions of software/patches are available AirTight Networks, Inc. All rights reserved. 6

7 About AirTight Networks AirTight Networks is a global provider of secure Wi-Fi solutions that combine its patented and industry-leading wireless intrusion prevention system (WIPS) technology with the next generation cloud-managed, controller-less Wi-Fi architecture. This unified approach allows enterprises for the first time to benefit from Wi-Fi access while concurrently protecting their networks 24/7 from wireless threats at no additional cost. AirTight s customers include global enterprises across virtually all industries and range from those who overlay AirTight WIPS on top of other WLAN solutions, to those who leverage the AirTight Cloud Services to manage AirTight Wi-Fi, WIPS, and regulatory compliance (e.g., PCI) across tens of thousands of locations from a single console. AirTight owns 29 granted U.S. and international patents on WIPS and cloud-managed wireless security, with more than 20 additional patents pending. For more information, please visit: AirTight is a registered trade mark of AirTight Networks, Inc. AirTight Networks, AirTight Networks logo, AirTight Cloud Services and AirTight Secure Wi-Fi are trademarks. All other trademarks are the property of their respective owners. The Global Leader in Secure Wi-Fi Solutions AirTight Networks, Inc. 339 N. Bernardo Avenue #200, Mountain View, CA T T F AirTight Networks, Inc. All rights reserved. AirTight Networks and the AirTight Networks logo are trademarks, and AirTight is a registered trademark of AirTight Networks, Inc. All other trademarks mentioned herein are properties of their respective owners. Specifications are subject to change without notice.

Don t Let Wireless Detour Your PCI Compliance

Don t Let Wireless Detour Your PCI Compliance Understanding the PCI DSS Wireless Requirements A Whitepaper by AirTight Networks, Inc. 339 N. Bernardo Avenue, Suite 200, Mountain View, CA 94043 www.airtightnetworks.com 2012 AirTight Networks, Inc.

More information

PCI DSS 3.1 and the Impact on Wi-Fi Security

PCI DSS 3.1 and the Impact on Wi-Fi Security PCI DSS 3.1 and the Impact on Wi-Fi Security 339 N. Bernardo Avenue, Suite 200, Mountain View, CA 94043 www.airtightnetworks.com 2015 AirTight Networks, Inc. All rights reserved. Table of Contents PCI

More information

PCI v2.0 Compliance for Wireless LAN

PCI v2.0 Compliance for Wireless LAN PCI v2.0 Compliance for Wireless LAN November 2011 This white paper describes how to build PCI v2.0 compliant wireless LAN using Meraki. Copyright 2011 Meraki, Inc. All rights reserved. Trademarks Meraki

More information

Overview. Summary of Key Findings. Tech Note PCI Wireless Guideline

Overview. Summary of Key Findings. Tech Note PCI Wireless Guideline Overview The following note covers information published in the PCI-DSS Wireless Guideline in July of 2009 by the PCI Wireless Special Interest Group Implementation Team and addresses version 1.2 of the

More information

Closing Wireless Loopholes for PCI Compliance and Security

Closing Wireless Loopholes for PCI Compliance and Security Closing Wireless Loopholes for PCI Compliance and Security Personal information is under attack by hackers, and credit card information is among the most valuable. While enterprises have had years to develop

More information

PCI DSS Requirements - Security Controls and Processes

PCI DSS Requirements - Security Controls and Processes 1. Build and maintain a secure network 1.1 Establish firewall and router configuration standards that formalize testing whenever configurations change; that identify all connections to cardholder data

More information

Achieving PCI-Compliance through Cyberoam

Achieving PCI-Compliance through Cyberoam White paper Achieving PCI-Compliance through Cyberoam The Payment Card Industry (PCI) Data Security Standard (DSS) aims to assure cardholders that their card details are safe and secure when their debit

More information

The Impact of Wireless LAN Technology on Compliance to the PCI Data Security Standard

The Impact of Wireless LAN Technology on Compliance to the PCI Data Security Standard The Impact of Wireless LAN Technology on to the PCI Data Security Standard 339 N. Bernardo Avenue, Suite 200 Mountain View, CA 94043 www.airtightnetworks.net Wireless LANs and PCI Retailers today use computers

More information

All You Wanted to Know About WiFi Rogue Access Points

All You Wanted to Know About WiFi Rogue Access Points All You Wanted to Know About WiFi Rogue Access Points A quick reference to Rogue AP security threat, Rogue AP detection and mitigation Gopinath K. N. Hemant Chaskar AirTight Networks www.airtightnetworks.com

More information

Protecting the Palace: Cardholder Data Environments, PCI Standards and Wireless Security for Ecommerce Ecosystems

Protecting the Palace: Cardholder Data Environments, PCI Standards and Wireless Security for Ecommerce Ecosystems Page 1 of 5 Protecting the Palace: Cardholder Data Environments, PCI Standards and Wireless Security for Ecommerce Ecosystems In July the Payment Card Industry Security Standards Council (PCI SSC) published

More information

WHITE PAPER. The Need for Wireless Intrusion Prevention in Retail Networks

WHITE PAPER. The Need for Wireless Intrusion Prevention in Retail Networks WHITE PAPER The Need for Wireless Intrusion Prevention in Retail Networks The Need for Wireless Intrusion Prevention in Retail Networks Firewalls and VPNs are well-established perimeter security solutions.

More information

Cisco Unified Wireless Network Solution Positioning for the New PCI DSS Wireless Guideline

Cisco Unified Wireless Network Solution Positioning for the New PCI DSS Wireless Guideline Cisco Unified Wireless Network Solution Positioning for the New PCI DSS Wireless Guideline This document directly addresses the recommendations listed in the Information Supplement: PCI DSS Wireless Guideline.

More information

74% 96 Action Items. Compliance

74% 96 Action Items. Compliance Compliance Report PCI DSS 2.0 Generated by Check Point Compliance Blade, on July 02, 2013 11:12 AM 1 74% Compliance 96 Action Items Upcoming 0 items About PCI DSS 2.0 PCI-DSS is a legal obligation mandated

More information

Understanding WiFi Security Vulnerabilities and Solutions. Dr. Hemant Chaskar Director of Technology AirTight Networks

Understanding WiFi Security Vulnerabilities and Solutions. Dr. Hemant Chaskar Director of Technology AirTight Networks Understanding WiFi Security Vulnerabilities and Solutions Dr. Hemant Chaskar Director of Technology AirTight Networks WiFi Proliferation Global WiFi Radio Chipset Sales 387 307 Millions 120 200 2005 2006

More information

Sarbanes-Oxley Compliance and Wireless LAN Security

Sarbanes-Oxley Compliance and Wireless LAN Security A Whitepaper by AirTight Networks, Inc. 339 N. Bernardo Avenue, Suite 200, Mountain View, CA 94043 www.airtightnetworks.com 2012 AirTight Networks, Inc. All rights reserved. While at first glance, Sarbanes-Oxley

More information

Wireless Security and Healthcare Going Beyond IEEE 802.11i to Truly Ensure HIPAA Compliance

Wireless Security and Healthcare Going Beyond IEEE 802.11i to Truly Ensure HIPAA Compliance Going Beyond IEEE 802.11i to Truly Ensure HIPAA Compliance 339 N. Bernardo Avenue, Suite 200 Mountain View, CA 94043 www.airtightnetworks.net Wireless LANs are prevalent in healthcare institutions. The

More information

PCI Compliance - A Realistic Approach. Harshul Joshi, CISM, CISA, CISSP Director, Information Technology CBIZ MHM hjoshi@cbiz.com

PCI Compliance - A Realistic Approach. Harshul Joshi, CISM, CISA, CISSP Director, Information Technology CBIZ MHM hjoshi@cbiz.com PCI Compliance - A Realistic Approach Harshul Joshi, CISM, CISA, CISSP Director, Information Technology CBIZ MHM hjoshi@cbiz.com What What is PCI A global forum launched in September 2006 for ongoing enhancement

More information

Windows 7 Virtual Wi-Fi: The Easiest Way to Install a Rogue AP on Your Corporate Network

Windows 7 Virtual Wi-Fi: The Easiest Way to Install a Rogue AP on Your Corporate Network A Whitepaper by AirTight Networks, Inc. 339 N. Bernardo Avenue, Suite 200, Mountain View, CA 94043 www.airtightnetworks.com 2010 AirTight Networks, Inc. All rights reserved. Introduction Last few years

More information

Ensuring HIPAA Compliance in Healthcare

Ensuring HIPAA Compliance in Healthcare The Intelligent Wireless Networking Choice WHITE PAPER Ensuring HIPAA Compliance in Healthcare Overview Wireless LANs are prevalent in healthcare institutions. The constant need for mobility among doctors,

More information

Wireless (In)Security Trends in the Enterprise

Wireless (In)Security Trends in the Enterprise A Whitepaper by AirTight Networks, Inc. 339 N. Bernardo Avenue, Suite 200, Mountain View, CA 94043 www.airtightnetworks.com 2012 AirTight Networks, Inc. All rights reserved. WiFi is proliferating fast.

More information

The Comprehensive Guide to PCI Security Standards Compliance

The Comprehensive Guide to PCI Security Standards Compliance The Comprehensive Guide to PCI Security Standards Compliance Achieving PCI DSS compliance is a process. There are many systems and countless moving parts that all need to come together to keep user payment

More information

March 2012 www.tufin.com

March 2012 www.tufin.com SecureTrack Supporting Compliance with PCI DSS 2.0 March 2012 www.tufin.com Table of Contents Introduction... 3 The Importance of Network Security Operations... 3 Supporting PCI DSS with Automated Solutions...

More information

CorreLog Alignment to PCI Security Standards Compliance

CorreLog Alignment to PCI Security Standards Compliance CorreLog Alignment to PCI Security Standards Compliance Achieving PCI DSS compliance is a process. There are many systems and countless moving parts that all need to come together to keep user payment

More information

Beyond the Firewall No. 72 March, 2012 Wireless LAN Edition

Beyond the Firewall No. 72 March, 2012 Wireless LAN Edition Wireless LAN infrastructure is now an increasingly common part of corporate enterprises. With wireless LAN infrastructure, new productivity gains can be realized. With this infrastructure though comes

More information

Wireless LANs and Healthcare: Understanding Security to Ensure Compliance with HIPAA

Wireless LANs and Healthcare: Understanding Security to Ensure Compliance with HIPAA : Understanding Security to Ensure Compliance with HIPAA Healthcare is a natural environment for wireless LAN solutions. With a large mobile population of doctors, nurses, physician s assistants and other

More information

WHITE PAPER. Preventing Wireless Data Breaches in Retail

WHITE PAPER. Preventing Wireless Data Breaches in Retail WHITE PAPER Preventing Wireless Data Breaches in Retail Preventing Wireless Data Breaches in Retail The introduction of wireless technologies in retail has created a new avenue for data breaches, circumventing

More information

PCI PA - DSS. Point BKX Implementation Guide. Version 2.01. Atos Xenta, Atos Xenteo and Atos Yomani using the Point BKX Payment Core

PCI PA - DSS. Point BKX Implementation Guide. Version 2.01. Atos Xenta, Atos Xenteo and Atos Yomani using the Point BKX Payment Core PCI PA - DSS Point BKX Implementation Guide Atos Xenta, Atos Xenteo and Atos Yomani using the Point BKX Payment Core Version 2.01 POINT TRANSACTION SYSTEMS AB Box 92031, 120 06 Stockholm, Tel. +46 8 566

More information

PCI PA - DSS. Point ipos Implementation Guide. Version 1.01. VeriFone Vx820 using the Point ipos Payment Core

PCI PA - DSS. Point ipos Implementation Guide. Version 1.01. VeriFone Vx820 using the Point ipos Payment Core PCI PA - DSS Point ipos Implementation Guide VeriFone Vx820 using the Point ipos Payment Core Version 1.01 POINT TRANSACTION SYSTEMS AB Box 92031, 120 06 Stockholm, Tel. +46 8 566 287 00 www.point.se Page

More information

Do My Security Controls Achieve Wireless PCI DSS?

Do My Security Controls Achieve Wireless PCI DSS? Do My Security Controls Achieve Wireless PCI DSS? PCI compliance in the new world of threats 339 N. Bernardo Avenue, Suite 200, Mountain View, CA 94043 www.airtightnetworks.com 2015 AirTight Networks,

More information

PCI Requirements Coverage Summary Table

PCI Requirements Coverage Summary Table StillSecure PCI Complete Managed PCI Compliance Solution PCI Requirements Coverage Summary Table December 2011 Table of Contents Introduction... 2 Coverage assumptions for PCI Complete deployments... 2

More information

Using Automated, Detailed Configuration and Change Reporting to Achieve and Maintain PCI Compliance Part 4

Using Automated, Detailed Configuration and Change Reporting to Achieve and Maintain PCI Compliance Part 4 WHITEPAPER Using Automated, Detailed Configuration and Change Reporting to Achieve and Maintain PCI Compliance Part 4 An in-depth look at Payment Card Industry Data Security Standard Requirements 10, 11,

More information

Information Supplement: PCI DSS Wireless Guidelines

Information Supplement: PCI DSS Wireless Guidelines Standard: PCI Data Security Standard (PCI DSS) Version: 2.0 Date: August, 2011 Author: Wireless Special Interest Group (SIG) PCI Security Standards Council Information Supplement: PCI DSS Wireless Guidelines

More information

PCI DSS Policies Outline. PCI DSS Policies. All Rights Reserved. ecfirst. 2010. Page 1 of 7 www.ecfirst.com

PCI DSS Policies Outline. PCI DSS Policies. All Rights Reserved. ecfirst. 2010. Page 1 of 7 www.ecfirst.com Policy/Procedure Description PCI DSS Policies Install and Maintain a Firewall Configuration to Protect Cardholder Data Establish Firewall and Router Configuration Standards Build a Firewall Configuration

More information

PCI Requirements Coverage Summary Table

PCI Requirements Coverage Summary Table StillSecure PCI Complete Managed PCI Compliance Solution PCI Requirements Coverage Summary Table January 2013 Table of Contents Introduction... 2 Coverage assumptions for PCI Complete deployments... 2

More information

FairWarning Mapping to PCI DSS 3.0, Requirement 10

FairWarning Mapping to PCI DSS 3.0, Requirement 10 FairWarning Mapping to PCI DSS 3.0, Requirement 10 Requirement 10: Track and monitor all access to network resources and cardholder data Logging mechanisms and the ability to track user activities are

More information

Payment Card Industry Self-Assessment Questionnaire

Payment Card Industry Self-Assessment Questionnaire How to Complete the Questionnaire The questionnaire is divided into six sections. Each section focuses on a specific area of security, based on the requirements included in the PCI Data Security Standard.

More information

PCI PA - DSS. Point XSA Implementation Guide. Atos Worldline Banksys XENTA SA. Version 1.00

PCI PA - DSS. Point XSA Implementation Guide. Atos Worldline Banksys XENTA SA. Version 1.00 PCI PA - DSS Point XSA Implementation Guide Atos Worldline Banksys XENTA SA Version 1.00 POINT TRANSACTION SYSTEMS AB Box 92031, 120 06 Stockholm, Tel. +46 8 566 287 00 www.point.se Page number 2 (16)

More information

Information Supplement: PCI DSS Wireless Guidelines

Information Supplement: PCI DSS Wireless Guidelines Standard: PCI Data Security Standard (PCI DSS) Version: 2.0 Date: August, 2011 Author: Wireless Special Interest Group (SIG) PCI Security Standards Council Information Supplement: PCI DSS Wireless Guidelines

More information

WHITE PAPER. PCI Wireless Compliance Demystified Best Practices for Retail

WHITE PAPER. PCI Wireless Compliance Demystified Best Practices for Retail WHITE PAPER PCI Wireless Compliance Demystified Best Practices for Retail PCI Wireless Compliance Demystified The introduction of wireless technologies in retail has created a new avenue for data breaches,

More information

Using AirWave RAPIDS Rogue Detection to Implement Your Wireless Security and PCI Compliance Strategy

Using AirWave RAPIDS Rogue Detection to Implement Your Wireless Security and PCI Compliance Strategy Using AirWave RAPIDS Rogue Detection to Implement Your Wireless Security and PCI Compliance Strategy Table of Contents Introduction 3 Using AirWave RAPIDS to detect all rogues on your network 4 Rogue device

More information

Implementation Guide

Implementation Guide Implementation Guide PayLINK Implementation Guide Version 2.1.252 Released September 17, 2013 Copyright 2011-2013, BridgePay Network Solutions, Inc. All rights reserved. The information contained herein

More information

Wireless Security Strategies for 802.11ac and the Internet of Things

Wireless Security Strategies for 802.11ac and the Internet of Things 339 N. Bernardo Avenue, Suite 200, Mountain View, CA 94043 www.airtightnetworks.com 2014 AirTight Networks, Inc. All rights reserved. The Internet of Things is a double-edged sword. While it confers many

More information

How NETGEAR ProSecure UTM Helps Small Businesses Meet PCI Requirements

How NETGEAR ProSecure UTM Helps Small Businesses Meet PCI Requirements How NETGEAR ProSecure UTM Helps Small Businesses Meet PCI Requirements I n t r o d u c t i o n The Payment Card Industry Data Security Standard (PCI DSS) was developed in 2004 by the PCI Security Standards

More information

SonicWALL PCI 1.1 Implementation Guide

SonicWALL PCI 1.1 Implementation Guide Compliance SonicWALL PCI 1.1 Implementation Guide A PCI Implementation Guide for SonicWALL SonicOS Standard In conjunction with ControlCase, LLC (PCI Council Approved Auditor) SonicWall SonicOS Standard

More information

The following chart provides the breakdown of exam as to the weight of each section of the exam.

The following chart provides the breakdown of exam as to the weight of each section of the exam. Introduction The CWSP-205 exam, covering the 2015 objectives, will certify that the successful candidate understands the security weaknesses inherent in WLANs, the solutions available to address those

More information

Information Supplement: PCI DSS Wireless Guideline

Information Supplement: PCI DSS Wireless Guideline Standard: Data Security Standard (DSS) Version: 1.2 Date: July 2009 Author: Wireless Special Interest Group Information Supplement: PCI DSS Wireless Guideline Prepared by the PCI SSC Wireless Special Interest

More information

Ensuring HIPAA Compliance in Healthcare

Ensuring HIPAA Compliance in Healthcare White paper Ensuring HIPAA Compliance in Healthcare Overview Wireless LANs are prevalent in healthcare institutions. The constant need for mobility among doctors, nurses, and staff while remaining connected

More information

AirTight C-55 Access Point

AirTight C-55 Access Point AirTight C-55 Access Point Dual radio, dual concurrent 2x2:2 Wi-Fi access or 24/7 wireless intrusion prevention. Designed for High Performance The AirTight C-55 is an enterprise grade dual radio, dual

More information

Becoming PCI Compliant

Becoming PCI Compliant Becoming PCI Compliant Jason Brown - brownj52@michigan.gov Enterprise Security Architect Enterprise Architecture Department of Technology, Management and Budget State of Michigan @jasonbrown17 History

More information

When it Comes to Monitoring and Validation it Takes More Than Just Collecting Logs

When it Comes to Monitoring and Validation it Takes More Than Just Collecting Logs White Paper Meeting PCI Data Security Standards with Juniper Networks SECURE ANALYTICS When it Comes to Monitoring and Validation it Takes More Than Just Collecting Logs Copyright 2013, Juniper Networks,

More information

PCI COMPLIANCE ON AWS: HOW TREND MICRO CAN HELP

PCI COMPLIANCE ON AWS: HOW TREND MICRO CAN HELP solution brief PCI COMPLIANCE ON AWS: HOW TREND MICRO CAN HELP AWS AND PCI DSS COMPLIANCE To ensure an end-to-end secure computing environment, Amazon Web Services (AWS) employs a shared security responsibility

More information

PA-DSS Implementation Guide for. Sage MAS 90 and 200 ERP. Credit Card Processing

PA-DSS Implementation Guide for. Sage MAS 90 and 200 ERP. Credit Card Processing for Sage MAS 90 and 200 ERP Credit Card Processing Version 4.30.0.18 and 4.40.0.1 - January 28, 2010 Sage, the Sage logos and the Sage product and service names mentioned herein are registered trademarks

More information

BAE Systems PCI Essentail. PCI Requirements Coverage Summary Table

BAE Systems PCI Essentail. PCI Requirements Coverage Summary Table BAE Systems PCI Essentail PCI Requirements Coverage Summary Table Introduction BAE Systems PCI Essential solution can help your company significantly reduce the costs and complexity of meeting PCI compliance

More information

Network Segmentation

Network Segmentation Network Segmentation The clues to switch a PCI DSS compliance s nightmare into an easy path Although best security practices should be implemented in all systems of an organization, whether critical or

More information

WHITE PAPER. WEP Cloaking for Legacy Encryption Protection

WHITE PAPER. WEP Cloaking for Legacy Encryption Protection WHITE PAPER WEP Cloaking for Legacy TM Encryption Protection Introduction Wired Equivalent Privacy (WEP) is the encryption protocol defined in the original IEEE 802.11 standard for Wireless Local Area

More information

TOP 10 WAYS TO ADDRESS PCI DSS COMPLIANCE. ebook Series

TOP 10 WAYS TO ADDRESS PCI DSS COMPLIANCE. ebook Series TOP 10 WAYS TO ADDRESS PCI DSS COMPLIANCE ebook Series 2 Headlines have been written, fines have been issued and companies around the world have been challenged to find the resources, time and capital

More information

Global Partner Management Notice

Global Partner Management Notice Global Partner Management Notice Subject: Critical Vulnerabilities Identified to Alert Payment System Participants of Data Compromise Trends Dated: May 4, 2009 Announcement: To support compliance with

More information

Securing Wireless Networks for PCI Compliance Using Fortinet s Secure WLAN Solution to Meet Regulatory Requirements

Securing Wireless Networks for PCI Compliance Using Fortinet s Secure WLAN Solution to Meet Regulatory Requirements Securing Wireless Networks for PCI Compliance Using Fortinet s Secure WLAN Solution to Meet Regulatory Requirements Introduction In the wake of many well-documented data breaches, standards such as the

More information

Air Marshal. White Paper

Air Marshal. White Paper White Paper Air Marshal SEPTEMBER 2013 This document discusses potential security threats in a WiFi environment, and outlines how enterprises can use a best-in-class Wireless Intrusion Prevention System

More information

WLAN Security Why Your Firewall, VPN, and IEEE 802.11i Aren t Enough to Protect Your Network

WLAN Security Why Your Firewall, VPN, and IEEE 802.11i Aren t Enough to Protect Your Network WLAN Security Why Your Firewall, VPN, and IEEE 802.11i Aren t Enough to Protect Your Network 339 N. Bernardo Avenue, Suite 200 Mountain View, CA 94043 www.airtightnetworks.net Executive Summary Wireless

More information

WHITEPAPER. Achieving Network Payment Card Industry Data Security Standard (PCI DSS) Compliance with NetMRI

WHITEPAPER. Achieving Network Payment Card Industry Data Security Standard (PCI DSS) Compliance with NetMRI WHITEPAPER Achieving Network Payment Card Industry Data Security Standard (PCI DSS) Compliance with NetMRI About PCI DSS Compliance The widespread use of debit and credit cards in retail transactions demands

More information

1.3 Prohibit Direct Public Access - Prohibit direct public access between the Internet and any system component in the cardholder data environment.

1.3 Prohibit Direct Public Access - Prohibit direct public access between the Internet and any system component in the cardholder data environment. REQUIREMENT 1 Install and Maintain a Firewall Configuration to Protect Cardholder Data Firewalls are devices that control computer traffic allowed between an entity s networks (internal) and untrusted

More information

SECTION: SUBJECT: PCI-DSS General Guidelines and Procedures

SECTION: SUBJECT: PCI-DSS General Guidelines and Procedures 1. Introduction 1.1. Purpose and Background 1.2. Central Coordinator Contact 1.3. Payment Card Industry Data Security Standards (PCI-DSS) High Level Overview 2. PCI-DSS Guidelines - Division of Responsibilities

More information

Payment Card Industry (PCI) Data Security Standard. Summary of Changes from PCI DSS Version 2.0 to 3.0

Payment Card Industry (PCI) Data Security Standard. Summary of Changes from PCI DSS Version 2.0 to 3.0 Payment Card Industry (PCI) Data Security Standard Summary of s from Version 2.0 to 3.0 November 2013 Introduction This document provides a summary of changes from v2.0 to v3.0. Table 1 provides an overview

More information

Payment Card Industry Data Security Standard

Payment Card Industry Data Security Standard Symantec Managed Security Services support for IT compliance Solution Overview: Symantec Managed Services Overviewview The (PCI DSS) was developed to facilitate the broad adoption of consistent data security

More information

Automating Compliance Reporting for PCI Data Security Standard version 1.1

Automating Compliance Reporting for PCI Data Security Standard version 1.1 PCI Compliance Reporting Solution Brief Automating Regulatory Compliance and IT Best Practices Reporting Automating Compliance Reporting for PCI Data Security Standard version 1.1 The PCI Data Security

More information

Best Practices for PCI DSS V3.0 Network Security Compliance

Best Practices for PCI DSS V3.0 Network Security Compliance Best Practices for PCI DSS V3.0 Network Security Compliance January 2015 www.tufin.com Table of Contents Preparing for PCI DSS V3.0 Audit... 3 Protecting Cardholder Data with PCI DSS... 3 Complying with

More information

AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE

AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE THE CHALLENGE: SECURE THE OPEN AIR Wirelesss communication lets you take your business wherever your customers,

More information

AirTight C-60 Access Point

AirTight C-60 Access Point ight C-60 Access Point Concurrent 3x3:3 Wi-Fi access and 24/7 wireless intrusion prevention in a single 802.11n AP- an industry first. High Performance, Top Security The ight C-60 is an enterprise grade

More information

Wi-Fi Client Device Security and Compliance with PCI DSS

Wi-Fi Client Device Security and Compliance with PCI DSS Wi-Fi Client Device Security and Compliance with PCI DSS A Summit Data Communications White Paper Original Version: June 2008 Update: January 2009 Protecting Payment Card Information It is every retailer

More information

LogRhythm and PCI Compliance

LogRhythm and PCI Compliance LogRhythm and PCI Compliance The Payment Card Industry (PCI) Data Security Standard (DSS) was developed to encourage and enhance cardholder data security and facilitate the broad adoption of consistent

More information

Wireless Security with Cyberoam

Wireless Security with Cyberoam White paper Cyberoam UTM Wireless Security with Cyberoam Robust, Fault-tolerant security is a must for companies sporting wireless networks. Cyberoam UTM strengthens the existing Wireless Security Architecture

More information

PCI DSS Reporting WHITEPAPER

PCI DSS Reporting WHITEPAPER WHITEPAPER PCI DSS Reporting CONTENTS Executive Summary 2 Latest Patches not Installed 3 Vulnerability Dashboard 4 Web Application Protection 5 Users Logging into Sensitive Servers 6 Failed Login Attempts

More information

Meeting PCI Data Security Standards with

Meeting PCI Data Security Standards with WHITE PAPER Meeting PCI Data Security Standards with Juniper Networks STRM Series Security Threat Response Managers When it Comes to Monitoring and Validation it Takes More Than Just Collecting Logs Copyright

More information

GFI White Paper PCI-DSS compliance and GFI Software products

GFI White Paper PCI-DSS compliance and GFI Software products White Paper PCI-DSS compliance and Software products The Payment Card Industry Data Standard () compliance is a set of specific security standards developed by the payment brands* to help promote the adoption

More information

FISMA / NIST 800-53 REVISION 3 COMPLIANCE

FISMA / NIST 800-53 REVISION 3 COMPLIANCE Mandated by the Federal Information Security Management Act (FISMA) of 2002, the National Institute of Standards and Technology (NIST) created special publication 800-53 to provide guidelines on security

More information

TECHNICAL NOTE REFERENCE DOCUMENT. Improving Security for Axis Products. Created: 4 October 2007. Last updated: 11 October 2007. Rev: 1.

TECHNICAL NOTE REFERENCE DOCUMENT. Improving Security for Axis Products. Created: 4 October 2007. Last updated: 11 October 2007. Rev: 1. TECHNICAL NOTE REFERENCE DOCUMENT Improving Security for Axis Products Created: 4 October 2007 Last updated: 11 October 2007 Rev: 1.0 TABLE OF CONTENTS 1 INTRODUCTION 3 2 BEST-PRACTICE SECURITY POLICIES

More information

PCI DSS Best Practices with Snare Enterprise Agents PCI DSS Best Practices with Snare Enterprise Agents

PCI DSS Best Practices with Snare Enterprise Agents PCI DSS Best Practices with Snare Enterprise Agents PCI DSS Best Practices with Snare Enterprise InterSect Alliance International Pty Ltd Page 1 of 9 About this document The PCI/DSS documentation provides guidance on a set of baseline security measures

More information

New PCI Standards Enhance Security of Cardholder Data

New PCI Standards Enhance Security of Cardholder Data December 2013 New PCI Standards Enhance Security of Cardholder Data By Angela K. Hipsher, CISA, QSA, Jeff A. Palgon, CPA, CISSP, QSA, and Craig D. Sullivan, CPA, CISA, QSA Payment cards a favorite target

More information

Developing Network Security Strategies

Developing Network Security Strategies NETE-4635 Computer Network Analysis and Design Developing Network Security Strategies NETE4635 - Computer Network Analysis and Design Slide 1 Network Security Design The 12 Step Program 1. Identify network

More information

Payment Card Industry (PCI) Data Security Standard. Summary of Changes from PCI DSS Version 1.2.1 to 2.0

Payment Card Industry (PCI) Data Security Standard. Summary of Changes from PCI DSS Version 1.2.1 to 2.0 Payment Card Industry (PCI) Data Security Standard Summary of s from PCI DSS Version 1.2.1 to 2.0 October 2010 General General Throughout Removed specific references to the Glossary as references are generally

More information

Security Awareness. Wireless Network Security

Security Awareness. Wireless Network Security Security Awareness Wireless Network Security Attacks on Wireless Networks Three-step process Discovering the wireless network Connecting to the network Launching assaults Security Awareness, 3 rd Edition

More information

whitepaper 4 Best Practices for Building PCI DSS Compliant Networks

whitepaper 4 Best Practices for Building PCI DSS Compliant Networks 4 Best Practices for Building PCI DSS Compliant Networks Cardholder data is a lucrative and tempting target for cyber criminals. Recent highly publicized accounts of hackers breaching trusted retailers

More information

Wireless Security for Mobile Computers

Wireless Security for Mobile Computers A Datalogic Mobile and Summit Data Communications White Paper Original Version: June 2008 Update: March 2009 Protecting Confidential and Sensitive Information It is every retailer s nightmare: An attacker

More information

PCI DSS v3.0 Vulnerability & Penetration Testing

PCI DSS v3.0 Vulnerability & Penetration Testing 6.6 For public-facing web applications, address new threats and vulnerabilities on an ongoing basis and ensure these applications are protected against known attacks by either of the following methods:

More information

Meeting PCI Data Security Standards with Juniper Networks Security Threat Response Manager (STRM)

Meeting PCI Data Security Standards with Juniper Networks Security Threat Response Manager (STRM) White Paper Meeting PCI Data Security Standards with Juniper Networks Security Threat Response Manager (STRM) When It Comes To Monitoring and Validation It Takes More Than Just Collecting Logs Juniper

More information

CREDIT CARD MERCHANT PROCEDURES MANUAL. Effective Date: 5/25/2011

CREDIT CARD MERCHANT PROCEDURES MANUAL. Effective Date: 5/25/2011 CREDIT CARD MERCHANT PROCEDURES MANUAL Effective Date: 5/25/2011 Updated: May 25, 2011 TABLE OF CONTENTS Introduction... 1 Third-Party Vendors... 1 Merchant Account Set-up... 2 Personnel Requirements...

More information

A Rackspace White Paper Spring 2010

A Rackspace White Paper Spring 2010 Achieving PCI DSS Compliance with A White Paper Spring 2010 Summary The Payment Card Industry Data Security Standard (PCI DSS) is a global information security standard defined by the Payment Card Industry

More information

AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE

AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE THE CHALLENGE: SECURE THE OPEN AIR Wirelesss communication lets you take your business wherever your customers,

More information

Deploying secure wireless network services The Avaya Identity Engines portfolio offers flexible, auditable management for secure wireless networks.

Deploying secure wireless network services The Avaya Identity Engines portfolio offers flexible, auditable management for secure wireless networks. Table of Contents Section 1: Executive summary...1 Section 2: The challenge...2 Section 3: WLAN security...3 and the 802.1X standard Section 4: The solution...4 Section 5: Security...4 Section 6: Encrypted

More information

Did you know your security solution can help with PCI compliance too?

Did you know your security solution can help with PCI compliance too? Did you know your security solution can help with PCI compliance too? High-profile data losses have led to increasingly complex and evolving regulations. Any organization or retailer that accepts payment

More information

FORT HAYS STATE UNIVERSITY CREDIT CARD SECURITY POLICY

FORT HAYS STATE UNIVERSITY CREDIT CARD SECURITY POLICY FORT HAYS STATE UNIVERSITY CREDIT CARD SECURITY POLICY Page 1 of 6 Summary The Payment Card Industry Data Security Standard (PCI DSS), a set of comprehensive requirements for enhancing payment account

More information

PCI Security Compliance in KANA Solutions How KANA Applications Helps Companies Comply with PCI Security Standards

PCI Security Compliance in KANA Solutions How KANA Applications Helps Companies Comply with PCI Security Standards PCI Security Compliance in KANA Solutions How KANA Applications Helps Companies Comply with PCI Security Standards Table of Contents PCI Security Compliance in KANA Solutions...1 The Importance of Protecting

More information

Is the PCI Data Security Standard Enough?

Is the PCI Data Security Standard Enough? Is the PCI Data Security Standard Enough? By: Christina M. Freeman ICTN 6870 Advanced Network Security Abstract: This paper will present the researched facts on Payment Card Industry Data Security Standard

More information

Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 6. Wireless Network Security

Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 6. Wireless Network Security Security+ Guide to Network Security Fundamentals, Third Edition Chapter 6 Wireless Network Security Objectives Overview of IEEE 802.11 wireless security Define vulnerabilities of Open System Authentication,

More information

United States Trustee Program s Wireless LAN Security Checklist

United States Trustee Program s Wireless LAN Security Checklist United States Trustee Program s Wireless LAN Security Checklist In support of a standing trustee s proposed implementation of Wireless Access Points (WAP) in ' 341 meeting rooms and courtrooms, the following

More information

Compliance and Security Information Management for PCI DSS Requirement 10 and Beyond

Compliance and Security Information Management for PCI DSS Requirement 10 and Beyond RSA Solution Brief Compliance and Security Information Management for PCI DSS Requirement 10 and Beyond Through Requirement 10, PCI DSS specifically requires that merchants, banks and payment processors

More information

Chapter 3 Safeguarding Your Network

Chapter 3 Safeguarding Your Network Chapter 3 Safeguarding Your Network The RangeMax NEXT Wireless Router WNR834B provides highly effective security features which are covered in detail in this chapter. This chapter includes: Choosing Appropriate

More information

WHITE PAPER. Protecting Credit Card Data: How to Achieve PCI Compliance

WHITE PAPER. Protecting Credit Card Data: How to Achieve PCI Compliance WHITE PAPER Protecting Credit Card Data: How to Achieve PCI Compliance These days, anyone who owns a credit card is familiar with the problem of identity theft, in which technology-savvy thieves extract

More information

PCI Security Scan Procedures. Version 1.0 December 2004

PCI Security Scan Procedures. Version 1.0 December 2004 PCI Security Scan Procedures Version 1.0 December 2004 Disclaimer The Payment Card Industry (PCI) is to be used as a guideline for all entities that store, process, or transmit Visa cardholder data conducting

More information