Connect with us

Business

How does Identity Access & Privileged Access Management help in PCI DSS Compliance?

Published

on

Narendra Sahoo is a director of VISTA InfoSec.

Introduction

The Payment Card Industry Data Security Standard also commonly referred to as PCI DSS is a payment security standard that outlines requirements to protect cardholder data.  The standard mandates the need for organizations to protect the cardholder data environment by taking necessary security measures to secure card data. One way to achieve this is by implementing strong Administrative Access controls to the Cardholder Data Environment and ensuring the access is well controlled, secured, and regularly monitored. This provides greater visibility around the user access to the Cardholder Data Environment.

In fact, the PCI DSS 4.0 Version also comprises revisions to the authentication requirements with the need to implement stronger access controls and regular monitoring and reviewing of Access Privileges. Identity and Access Management (IAM) and Privileged Access Management (PAM) play a crucial role in safeguarding cardholder data, and the new version of the standard recognizes its significance. The requirement reflects the latest industry best practices for ensuring strong measures for securing card data. Covering more on this, we have shared how IAM and PAM can play an important role in securing card data and meeting the PCI DSS requirements.

How does PAM and IAM address the PCI DSS Requirement 4.0?

The payment industry has gradually moved to the cloud and so the need to focus on strong access controls and authentication standards is the need of the hour. Recognizing these needs, the PCI Council in its latest version of PCI DSS 4.0 has placed great emphasis on Identity, Access Management, and Authentication. On that note let us see how IAM and PAM facilitate PCI DSS Requirements

  • Requirement 1: Install and Maintain Network Security Controls

PCI DSS 4.0 requirement requires organizations to install and maintain network security controls by installing firewalls antivirus and security software. Further, implementing security and access controls such as IAM and PAM shall also help meet the requirement of maintaining and restricting access to the network to and from the cardholder data environment (Requirement 1.1.3). Implementing IAM and PAM ensures only authorized access to the environment, thereby preventing any scope of unauthorized access to the network and CDE.

  • Requirement 2: Apply Secure Configurations to All Systems-

When it comes to implementing measures for secure configurations to all systems, adopting Privileged Access Management (PAM) solution is one way of addressing the security issues and concerns. The PAM solution includes the implementation of security parameters that requires the change of default passwords as a part of the security process. It requires implementing password management controls that shall comprise rules for creating strong passwords, the mandate for changing default passwords, and forced rotation of passwords and keys. This is a crucial security implementation for securing and preventing unauthorized access to systems and data.

Requirement 3: Protect Stored Account Data

PCI DSS requires implementing effective methods for protecting stored data. It requires the organization to apply access controls according to their defined roles. This is one way to limit access to viewing full PAN to only those individuals with a defined business need. While Masking is the way organizations will ensure the PAN data is protected. But even with the Privilege Access Management (PAM) solution in place, it will address the issue of ensuring that access to the sensitive PAN data isn’t in the hands of an unauthorized person.

  • Requirement7: Restrict Access to System Components and Cardholder Data by Business Need to Know.

Organizations are expected to implement strong access controls on systems, components, and networks for maximum security of data. So, implementing PAM will ensure that the cardholder data is only accessible to users with the appropriate privileges. This way, having in place a strong PAM solution will not just ensure meeting the PCI DSS 4.0 requirements, but it will also make sure that only authorized users are granted appropriate privileges and that the access granted is only based on work requirements and their access attempt meets defined rules.

  • Requirement 8: Identify Users and Authenticate Access to System Components

Organizations are expected to have in place appropriate mechanisms to identify users and authenticate access to only privileged users. These two fundamental principles of PCI DSS requirement of identifying and authenticating users for access can be achieved through the IAM solution. The IAM solution comprises the implementation of security measures such as Multi-factor Authentication (MFA) to secure access to CDE and authorize only verified users’ access to the system and data. This further prevents unauthorized access, misuse of data, data alteration, and deletion of data. Finally, implementing PAM and IAM solutions helps manage access controls and access keys to systems and networks.

  • Requirement 9: Restrict Physical Access to Cardholder Data

PCI DSS Requirement requires organizations to implement measures to restrict physical access to cardholder data.  PAM and IAM solutions manage and monitor access controls. They help restrict physical access to cardholder data-based roles, responsibilities, performing activities, authorization, and authentication of privilege access granted to individuals. With such secure implementation system components and card data in the CDE cannot be physically accessed unless authorized.

  • Requirement 10: Log and Monitor All Access to System Components and Cardholder Data

PAM and IAM solutions in general have an exceptional feature of not just restricting access to critical systems, networks, and data but also track monitor and recording all access logs and user activities around the systems and data. This way PAM and IAM solutions help meet the PCI DSS requirement of maintaining logs and monitoring access to cardholder data. They also have the capability of automatically terminating sessions that have either expired or attempts have been made for unauthorized access or misuse of privileged access.

  • Requirement 11: Test Security of Systems and Networks Regularly

The primary objective of this requirement is to test and verify all wireless access points including identifying vulnerabilities and the scope of any unauthorized access points that can impact the security of systems and data. So, there must be measures in place that secures remote access to systems, network, and data. With PAM and IAM solutions in place, it can manage and control privileged access by users, based on defined roles, and work requirement while ensuring the implementation meets the PCI DSS security requirements.  Further, such access management also facilitates tracking and monitoring of user access even from the remote locations (or IP addresses)

Conclusion

PCI DSS covers a wide range of payment card security requirements and measures for implementation. So, while the PCI Council has in its latest updates made the standard more flexible in terms of approach to meet the requirement, PAM and IAM solutions can be seen as an effective solutions to address most of the security issues. Such solutions go a long way in meeting the security requirements of PCI DSS. It further aids the organization in their compliance journey and also in their cyber security initiatives. The solution also facilitates better protection of sensitive payment cardholder data.

Business

Unlocking the Power of Data: Revolutionising Business Success in the Financial Services Sector

Published

on

By

Suki Dhuphar, Head of EMEA, Tamr

 

The financial services (FS) sector operates within an immensely data-abundant landscape. But it’s well-known that many organisations in the sector struggle to make data-driven decisions because they lack access to the right data to make decisions at the right time.

As the sector strives for a data-driven approach, companies focus on democratising data, granting non-technical users the ability to work with and leverage data for informed decision-making. However, dirty data, riddled with errors and inconsistencies, can lead to flawed analytics and decision-making. Siloed data across departments like Marketing, Sales, Operations, or R&D exacerbates this issue. Breaking down these barriers is essential for effective data democratisation and achieving accurate insights for decision-making.

An antidote to dirty, disconnected data

Overcoming the challenges presented by dirty, disconnected data is not a new problem. But, there are new solutions – such as shifting strategies to focus on data products – which are proven to deliver great results. But, what is a data product?

Data products are high-quality, accessible datasets that organisations use to solve business challenges. Data products are comprehensive, clean, and continuously updated. They make data tangible to serve specific purposes defined by consumers and provide value because they are easy to find and use. For example, an investment firm can benefit from data products to gain insights into market trends and attract more capital. These offer a scalable solution for connecting alternative data sources, providing accurate and continuously updated views of portfolio companies. Using machine learning (ML) based technology enables the data product to adapt to new data sources, giving a firm’s partners confidence in their investment decisions.

Suki Dhuphar

But, before companies can reap the benefits of data products, the development of a robust data product strategy is a must.

Where to begin?

Prior to embarking on a data product strategy, it is imperative to establish clear-cut objectives that align with your organisation’s overarching business goals. Taking an incremental approach enables you to make a real impact against a specific objective – such as streamlining operations to enhance cost efficiency or reshaping business portfolios to drive growth – by starting with a more manageable goal and then building upon it as the use case is proved. For companies that find themselves uncertain about where to begin their move to data products, tackling your customer data is a good place to start for some quick wins to increase the success of the customer experience programmes.

Getting a good grasp on data

Once an objective is in place, it’s time for an organisation to assess its capabilities for executing the data product strategy. To do this, you need to dig into the nitty-gritty details like where the data is, how accurate and complete it is, how often it gets updated, and how well it’s integrated across different departments. This will give a solid grasp of the actual quality of the data and help allocate resources more efficiently. At this stage, you should also think about which stakeholders from across the business from leadership to IT will need to be involved in the process and how.

Once that’s covered, you can start putting together a skilled team and assigning responsibilities to kick-off the creation and management of a comprehensive data platform that spans all relevant departments. This process also helps spot any gaps early on, so you can focus on targeted initiatives.

Identifying the problem you will solve

Now let’s move on to the next step in our data product strategy. Here we need to identify a specific problem or challenge that is commonly faced in your organisation. It’s likely that leaders in different departments, like R&D or procurement, encounter obstacles that hinder their objectives that could be overcome with better insight and information. By defining a clear use case, you will build a real solution to a challenge they are facing rather than a data product for the sake of having data. This will be an impactful case study for your entire organisation to understand the potential benefits of data products and increase appetite for future projects.

Getting buy-in from the business

Once you have identified the problem you want to solve, you need to secure the funding, support, and resources to move the project ahead. To do that, you must present a practical roadmap that shows how you will quickly deliver value. You should also showcase how to improve it over time once the initial use case is proven.

The plan should map how you will measure success effectively with specific indicators (such as KPIs) that are closely tied to business goals. These indicators will give you a benchmark of what success looks like so you can clearly show when you’ve delivered it.

Getting the most out of your data product

Once you’ve got the green light – and the funds – it’s time to put your plan into action by creating a basic version of your data product, also known as a minimum viable data product (MVDP). By starting small and gradually enhancing with each new release you are putting yourself in the best stead to encourage adoption and also (coming back to our iterative approach) help you secure more resources and funding down the line.

To make the most of your data product, it’s essential to tap into the knowledge and experience of business partners as they know how to make the most of the data product and integrate it into existing workflows. Additionally, collecting feedback and using it to improve future releases will bring even more value to end users in the business and, in turn, your customers.

Unlocking the power of data (products)

It’s crucial for companies in FS to make the most of the huge amount of data they have at their disposal. It simply doesn’t make sense to leave this data tapped and not use it to solve real challenges for end users in the business and, in turn, improve the customer experience! By adopting effective strategies for data products, FS organisations can start to maximise the incredible value of their data.

Continue Reading

Business

Making the Maths Work: Addressing Inflation Challenges through Measuring and Managing Risk

Published

on

By

Matt Clementson, Head of Enterprise UK&I

Persistent inflation is highly troublesome for every business – with or without a recession. In addition to causing unexpected expenses, it complicates decision-making around stabilising wages, setting product prices, and investing in new areas for growth. Meanwhile, stock and bond prices plummet when alarming inflation data arrives and interest rates increase. It’s time to run leaner, making the reassessment of the strategic objectives highly urgent.

With a seat in the boardroom, CFOs can guide thoughtful discussions covering everything from procurement, resource allocation, and manufacturing to the alignment of business purpose with operational tactics and goals. CFOs must also rethink how their business measure and mitigate risk. Understanding the business’ vulnerability, they can add considerable value to their business by identifying risks early and making organisations accountable for mitigating them.

When the economy becomes uncomfortable, the mathematics behind business operations no longer work seamlessly. During more comfortable times businesses have the luxury to accept some degree of inefficiency and low productivity – but in times like these that’s no longer the case.

So now it’s more important that ever for CFOs to use the right tools and technology to manage and mitigate risk and build business resilience.

Enhancing visibility to measure and manage risk:

To navigate through periods of high inflation, CFOs need technologies that provide comprehensive visibility, and enable informed decision-making, in order to optimising cash flow, minimise     costs and manage risk in a transparent and efficient way.

1. Simplify confusing processes to gain moments of clarity

Effective risk management starts with integrating data from various sources within the organisation. By consolidating data from finance, operations, procurement, and sales, CFOs can gain a holistic view of the business landscape. This integration enables them to identify potential risks associated with inflation, such as rising costs, supply chain disruptions, or changes in customer demand patterns. With access to comprehensive and real-time data, CFOs can make informed decisions that mitigate the impact of inflation on the organisation.

A good first step is to unify travel, expense, and invoice solutions, so that finance teams can integrate and streamline operations and scale spend processes without adding additional resources.

2. Make spending decisions with data-driven accuracy

Once data is integrated, CFOs can leverage advanced analytics techniques to identify patterns, trends, and potential risks. Predictive analytics can help identify inflationary pressures, allowing businesses to proactively adjust pricing strategies or negotiate favourable terms with suppliers. Additionally, scenario modelling can simulate the impact of different inflation rates on the organisation’s financials, enabling CFOs to devise appropriate strategies for managing risk. By harnessing the power of analytics, CFOs can navigate inflation challenges with greater confidence and precision.

3.Driving business agility through automation

Facing a myriad of disruptors, companies in every industry are making strategic decisions aimed at remaining competitive in the market and with their people. Digitisation, standardisation, and automation will be critical as businesses focus on solving problems for their customers in innovative, lasting ways

AI technologies, such as machine learning algorithms, can analyse vast amounts of data to uncover hidden insights and patterns. And with automated, customisable controls, CFOs can keep their firm agile – re-adjusting spend controls to match the corporate travel and expense (T&E) policy whenever their business needs to adapt or pivot. Only then will spending insights allow them to review how policies impact business performance and continue to optimise cash management.

Making the maths work

In a business environment plagued by persistent inflation, CFOs play a crucial role in addressing the associated challenges. By rethinking how their organisations measure and manage risk, CFOs can enhance their decision-making capabilities and add significant value. The integration of data, advanced analytics, and AI technologies enables CFOs to build resilience, standardise processes, ensure compliance, and deliver insights to the entire enterprise. By making the maths work in the face of inflation, businesses can navigate uncertain economic times with confidence and stay on the path of sustainable growth.

Continue Reading

Magazine

Trending

Finance53 mins ago

Taxing times for online marketplaces? Operators must act now to avoid losing sellers

By Niall Kiernan, Senior Director of Product Marketing, Vertex   In today’s digital landscape, online marketplaces are an enabler for...

Top 1017 hours ago

Five Ways to Save Money in Your 20s

Depending on your background, entering your 20s can be a bit of a precarious time. Among the things you’ll need...

Business17 hours ago

Unlocking the Power of Data: Revolutionising Business Success in the Financial Services Sector

Suki Dhuphar, Head of EMEA, Tamr   The financial services (FS) sector operates within an immensely data-abundant landscape. But it’s...

Top 101 day ago

Hidden sources of FX risk: could your business be exposed?

Running a business can come with great rewards, but it’s not without risk – something businesses in the UK have...

Finance1 day ago

Preventing fraud and detecting money laundering in real-time

Mathew Hobbis – Chief Architect FSI, Solace   The number of payment channels has grown exponentially. The time it takes...

Top 101 day ago

Money where your mouth is: on the need to modernize insurance tech stacks

Tim Hood, VP, EMEA and APAC, Hyland   Once upon a time, starting an insurance company was a predominantly physical...

Business1 day ago

Making the Maths Work: Addressing Inflation Challenges through Measuring and Managing Risk

Matt Clementson, Head of Enterprise UK&I Persistent inflation is highly troublesome for every business – with or without a recession....

News1 day ago

BioCatch Strengthens Collaboration with Microsoft Cloud for Financial Services

Collaboration Delivers End-to-End Intelligent Banking Cloud Platform with Online Fraud Detection Powered by Next-Generation Behavioural Biometrics BioCatch, a global leader...

Business3 days ago

HOW SMALL BUSINESSES CAN FIGHT BACK AGAINST POOR PAYMENT PRACTICES

SMEs across the UK are facing a challenging economic environment and late payments pose a severe challenge to maintaining cash...

Business3 days ago

Less than a year until EMIR Refit: how can firms prepare? 

Leo Labeis, CEO at REGnosys, discusses everything that financial institutions need to know about EMIR Refit and how they can...

Business7 days ago

Enhancing cybersecurity in investment firms as new regulations come into force

Christian Scott, COO/CISO at Gotham Security, an Abacus Group Company   The alternative investment industry is a prime target for...

Technology7 days ago

How to think like an attacker & why it might be critical to your security strategy

Kam Karaji, Global Head of Information Security for Bibby Financial Services, argues at DTX Manchester that the most successful way...

Business7 days ago

Building a sustainable future – what’s on your agenda for 2023?

The most successful and progressive leaders are embracing ESG or Environmental, Social and Governance principles throughout their businesses, but how...

Banking7 days ago

Digital Acceleration – the next buzzword in banking tech? Or a new era for the industry?

Ove Kreison, CTO at Tuum McKinsey’s latest report on banking found that traditional banks are spending a whopping 85% of their...

Business7 days ago

One year until EMIR Refit: how can firms prepare? 

Leo Labeis, CEO at REGnosys, discusses everything that financial institutions need to know about EMIR Refit and how they can...

Business1 week ago

In the Name of the Family! Firms with CEOs under clan culture influence are much more likely to be internationally focused

In an increasingly globalised world, it is incredibly rare that a firm can expect to grow in the long-term unless...

Finance1 week ago

Regulations, RegTech and CBDCs – Fintech’s Next Chapter 

Teresa Cameron, Finance Director at Clear Junction    Over the last decade, the UK has embraced the fintech revolution with...

Business1 week ago

Gearing up for growth amid economic pressure: 10 top tips for maintaining control of IT costs

  By Dirk Martin, CEO and Founder of Serviceware   Three years on from the pandemic and economic pressure is...

News1 week ago

Find Your Tribe With Content Marketing

Ian is the CMO at Spotler Group   Seth Godin, a writer, speaker, marketing expert, and influencer, describes audiences as tribes,...

Finance1 week ago

The formula for success: delivering total experience in financial services

  Monica Hovsepian, Global Industry Strategist, OpenText   The tumult of the last few years has thrown many challenges at...

Trending