With Qualys' new PCI Connect extension to its PCI Compliance solution, smaller retailers may have a newfound ability to build complete documents proving their compliance with the most recent PCI specification--provided they enlist the right products and services to cull the data.
This month at the RSA show in San Francisco, intrusion prevention
vendor Qualys announced an extension to its PCI Compliance solution
called PCI Connect. The announcement of the extension--which should be
available in the July timeframe--essentially boiled down to an
inter-vendor effort to integrate communications among vulnerability
assessment and remediation products. However, smaller retailers may
soon reap the benefits of the initiative with the newfound ability to
build complete documents proving their compliance with the most recent
PCI specification--provided the retailers enlist the right products and
services to cull the data.
There are numerous products available today that provide data to
help retailers track their PCI compliance, but, typically, these
products look at only part of the PCI puzzle. The latest draft of the
PCI specification (version 1.2), released in October 2008, mandates
that merchants verify their security across multiple platforms and
networks. This means merchants must demonstrate their security wherever
privileged card data may traverse--be it across routers, wireless LANs,
servers or desktops. For those merchants trying to
prove compliance without the aid of an auditor or consultant, it is up
to IT staff or business personnel to compile the requisite data from
each utilized security tool to document the security measures taken as
well as the resultant findings.
For instance, when I reviewed AirTight's SpectraGuard Online wireless
intrusion prevention service, I found that the service could generate
reports tailored for the particulars of various regulations, including
PCI. These reports identified findings in possible conflict with
the letter of the regulation (such as unauthorized client connections
or weak encryption implementations), and administrators could schedule
the reports to be generated periodically and delivered in HTML or XML.
Qualys' QualysGuard PCI Compliance solutions, which were launched a
couple years ago, aimed to let merchants perform external scans of
their own networks, supplementing that data with access to online
self-assessment questionnaires that the specification requires
merchants to complete every 12 months. Qualys determined that
many Tier 2 through Tier 4 merchants used these assessments to answer
questions about parts of the network QualysGuard could not scan.
According to Qualys officials, this scenario doesn't apply to larger,
Tier 1 merchants, which would likely enlist outside auditors to conduct
their compliance assessments.
As a result of these findings, Qualys
created PCI Connect--an API and open XML-based report format to which
other vendors like AirTight can output data. So, for instance, a
merchant could utilize AirTight's SpectraGuard Online to perform the
requisite quarterly wireless scans and the data would be consolidated
with Qualys's own data directly into the yearly self-assessment
In addition to AirTight, Qualys has partnered with several
other security vendor. PCI Connect partners include penetration testing
vendor Core Security Technologies, Web application firewall vendor
Imperva, log management and IT troubleshooting vendor Splunk, security
risk management company Red Seal, and physical and virtual machine
intrusion prevention vendor Third Brigade.
Andrew cut his teeth as a systems administrator at the University of California, learning the ins and outs of server migration, Windows desktop management, Unix and Novell administration. After a tour of duty as a team leader for PC Magazine's Labs, Andrew turned to system integration - providing network, server, and desktop consulting services for small businesses throughout the Bay Area. With eWEEK Labs since 2003, Andrew concentrates on wireless networking technologies while moonlighting with Microsoft Windows, mobile devices and management, and unified communications. He produces product reviews, technology analysis and opinion pieces for eWEEK.com, eWEEK magazine, and the Labs' Release Notes blog. Follow Andrew on Twitter at andrewrgarcia, or reach him by email at firstname.lastname@example.org.