This month at the RSA show in San Francisco, intrusion prevention vendor Qualys announced an extension to its PCI Compliance solution called PCI Connect. The announcement of the extension–which should be available in the July timeframe–essentially boiled down to an inter-vendor effort to integrate communications among vulnerability assessment and remediation products. However, smaller retailers may soon reap the benefits of the initiative with the newfound ability to build complete documents proving their compliance with the most recent PCI specification–provided the retailers enlist the right products and services to cull the data.
There are numerous products available today that provide data to help retailers track their PCI compliance, but, typically, these products look at only part of the PCI puzzle. The latest draft of the PCI specification (version 1.2), released in October 2008, mandates that merchants verify their security across multiple platforms and networks. This means merchants must demonstrate their security wherever privileged card data may traverse–be it across routers, wireless LANs, servers or desktops. For those merchants trying to prove compliance without the aid of an auditor or consultant, it is up to IT staff or business personnel to compile the requisite data from each utilized security tool to document the security measures taken as well as the resultant findings.
For instance, when I reviewed AirTight’s SpectraGuard Online wireless intrusion prevention service, I found that the service could generate reports tailored for the particulars of various regulations, including PCI. These reports identified findings in possible conflict with the letter of the regulation (such as unauthorized client connections or weak encryption implementations), and administrators could schedule the reports to be generated periodically and delivered in HTML or XML.
Qualys’ QualysGuard PCI Compliance solutions, which were launched a couple years ago, aimed to let merchants perform external scans of their own networks, supplementing that data with access to online self-assessment questionnaires that the specification requires merchants to complete every 12 months. Qualys determined that many Tier 2 through Tier 4 merchants used these assessments to answer questions about parts of the network QualysGuard could not scan. According to Qualys officials, this scenario doesn’t apply to larger, Tier 1 merchants, which would likely enlist outside auditors to conduct their compliance assessments.
As a result of these findings, Qualys created PCI Connect–an API and open XML-based report format to which other vendors like AirTight can output data. So, for instance, a merchant could utilize AirTight’s SpectraGuard Online to perform the requisite quarterly wireless scans and the data would be consolidated with Qualys’s own data directly into the yearly self-assessment questionnaire.
In addition to AirTight, Qualys has partnered with several other security vendor. PCI Connect partners include penetration testing vendor Core Security Technologies, Web application firewall vendor Imperva, log management and IT troubleshooting vendor Splunk, security risk management company Red Seal, and physical and virtual machine intrusion prevention vendor Third Brigade.