Simplifying PCI Compliance with Privileged Access Management and Vulnerability Management

If your organization collects, processes or stores cardholder data in any form, then you must adhere to the Payment Card Industry Data Security Standard (PCI DSS). As you have likely come to understand (and probably painfully I’m guessing) you will have challenges in meeting your PCI requirements; among them the direct and indirect costs and operational distractions associated with maintaining compliance. Let’s take a quick look at some of these challenges, and then I will explain how BeyondTrust helps you achieve compliance with certain provisions in PCI faster.

Ready to get started? Download our technical brief and learn how BeyondTrust solutions map to PCI guidelines. Download now

Fines and Penalties: Compliance is Mandatory

There are three levels of PCI compliance that an organization may be subject to, depending on the number of transactions that the organization processes, or if they are subject to the “merchant” or the “service provider” compliance definitions. If an organization is at the highest level of compliance (Tier 1), assessments are conducted annually by a Qualified Security Assessor (QSA) who creates a Report on Compliance (ROC). Any other levels of compliance (Tiers 2-3), may self-assess against the controls and may not directly involve a QSA. If an organization has been breached and was not in compliance with PCI, the card issuers can impose significant financial penalties on the merchant.

Complexity, Time and Resource Constraints: PCI Distracts from Core Operations

Merchants and service providers subject to PCI DSS should work to continually improve processes to ensure ongoing compliance and security, rather than treating compliance as a point-in-time project. Naturally, this can create a tremendous resource drain on IT teams.

How Privileged Access Management and Vulnerability Management can Help

Since they can be used as fundamental technologies to achieving compliance with PCI, we’ve written a new technical brief that explains how to map BeyondTrust privileged access management and vulnerability management solutions to PCI requirements to more easily demonstrate and maintain compliance. This guide is primarily intended to be used for those who must comply with merchant processing specifications, but applies to most service providers as well, and is meant to help you get more from your PAM and VM investment.

Mapping BeyondTrust PowerBroker and Retina solutions to PCI requirements

For a quick view of how BeyondTrust solutions map into these requirements, see the table below.

Control Objectives	PCI DSS Requirements	BeyondTrust Platform	Retina Vulnerability Management	PowerBroker for Unix & Linux	PowerBroker for Windows & Mac	PowerBroker Identity Services	PowerBroker Password Safe	PowerBroker Auditing & Security Suite
Build and Maintain a Secure Network and Systems	Requirement 1: Install and maintain a firewall configuration to protect cardholder data
	Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data	Requirement 3: Protect stored cardholder data
	Requirement 4: Encrypt transmission of cardholder data across open, public networks
Maintain a Vulnerability Management Program	Requirement 5: Protect all systems against malware and regularly update anti-virus software or programs
	Requirement 6: Develop and maintain secure systems and applications
Implement Strong Access Control Measures	Requirement 7: Restrict access to cardholder data by business need to know
	Requirement 8: Identify and authenticate access to system components
	Requirement 9: Restrict physical access to cardholder data
Regularly Monitor and Test Networks	Requirement 10: Track and monitor all access to network resources and cardholder data
	Requirement 11: Regularly test security systems and processes
Maintain an Information Security Policy	Requirement 12: Maintain a policy that addresses the information security for all personnel

What to do Next

Download the full PCI guide for a detailed requirement-by-requirement mapping of BeyondTrust PAM and VM solutions into PCI requirements. Remember: There is no magic bullet to achieving PCI compliance and no one vendor that can make you compliant with PCI. Look for solutions that help you simplify it; BeyondTrust can help. Contact us today for a strategy session on your current PCI compliance efforts. Download now