Qualys Extension to Its PCI Compliance Set to Help SMBs

By Andrew Garcia  |  Posted 2009-04-27 Print this article Print

With Qualys' new PCI Connect extension to its PCI Compliance solution, smaller retailers may have a newfound ability to build complete documents proving their compliance with the most recent PCI specification--provided they enlist the right products and services to cull the data.

This month at the RSA show in San Francisco, intrusion prevention vendor Qualys announced an extension to its PCI Compliance solution called PCI Connect. The announcement of the extension--which should be available in the July timeframe--essentially boiled down to an inter-vendor effort to integrate communications among vulnerability assessment and remediation products. However, smaller retailers may soon reap the benefits of the initiative with the newfound ability to build complete documents proving their compliance with the most recent PCI specification--provided the retailers enlist the right products and services to cull the data. 

There are numerous products available today that provide data to help retailers track their PCI compliance, but, typically, these products look at only part of the PCI puzzle. The latest draft of the PCI specification (version 1.2), released in October 2008, mandates that merchants verify their security across multiple platforms and networks. This means merchants must demonstrate their security wherever privileged card data may traverse--be it across routers, wireless LANs, servers or desktops. For those merchants trying to prove compliance without the aid of an auditor or consultant, it is up to IT staff or business personnel to compile the requisite data from each utilized security tool to document the security measures taken as well as the resultant findings.

For instance, when I reviewed AirTight's SpectraGuard Online wireless intrusion prevention service, I found that the service could generate reports tailored for the particulars of various regulations, including PCI. These reports identified findings in possible conflict with the letter of the regulation (such as unauthorized client connections or weak encryption implementations), and administrators could schedule the reports to be generated periodically and delivered in HTML or XML.

Qualys' QualysGuard PCI Compliance solutions, which were launched a couple years ago, aimed to let merchants perform external scans of their own networks, supplementing that data with access to online self-assessment questionnaires that the specification requires merchants to complete every 12 months. Qualys determined that many Tier 2 through Tier 4 merchants used these assessments to answer questions about parts of the network QualysGuard could not scan. According to Qualys officials, this scenario doesn't apply to larger, Tier 1 merchants, which would likely enlist outside auditors to conduct their compliance assessments.

As a result of these findings, Qualys created PCI Connect--an API and open XML-based report format to which other vendors like AirTight can output data. So, for instance, a merchant could utilize AirTight's SpectraGuard Online to perform the requisite quarterly wireless scans and the data would be consolidated with Qualys's own data directly into the yearly self-assessment questionnaire.

 In addition to AirTight, Qualys has partnered with several other security vendor. PCI Connect partners include penetration testing vendor Core Security Technologies, Web application firewall vendor Imperva, log management and IT troubleshooting vendor Splunk, security risk management company Red Seal, and physical and virtual machine intrusion prevention vendor Third Brigade.


Andrew cut his teeth as a systems administrator at the University of California, learning the ins and outs of server migration, Windows desktop management, Unix and Novell administration. After a tour of duty as a team leader for PC Magazine's Labs, Andrew turned to system integration - providing network, server, and desktop consulting services for small businesses throughout the Bay Area. With eWEEK Labs since 2003, Andrew concentrates on wireless networking technologies while moonlighting with Microsoft Windows, mobile devices and management, and unified communications. He produces product reviews, technology analysis and opinion pieces for eWEEK.com, eWEEK magazine, and the Labs' Release Notes blog. Follow Andrew on Twitter at andrewrgarcia, or reach him by email at agarcia@eweek.com.

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel