A systematic approach to pci compliance using rsa archer
3 likes1,146 views
This document summarizes an RSA Archer webcast on PCI compliance management. It discusses the business challenges of PCI compliance, including the proliferation of credit cards and numerous entry points for credit card data theft. It outlines RSA Archer's PCI compliance management process and how its pre-configured solution provides benefits like efficiency, visibility, and scalability. It demonstrates the PCI compliance component layout in RSA Archer and how organizations can define cardholder data environments, capture evidence, and report on compliance. It provides an example of how one organization improved compliance measurement by consolidating work in RSA Archer.
A systematic approach to pci compliance using rsa archer
- 1. 1EMC CONFIDENTIAL—INTERNAL USE ONLY RSA Archer PCI Compliance Management RSA Archer Focused Solutions Webcast Clifford Huntington – RSA Archer Product Management
- 2. 2EMC CONFIDENTIAL—INTERNAL USE ONLY Business Challenges and Issues Proliferation of credit cards has increased the potential for fraudulent transactions Many parties involved in the payment process Numerous entry points for access and misuse of credit card data Failure to comply can result in fines, withdrawal from card programs, greater operational costs and potential reputational damage Costs associated with gaining & maintaining PCI compliance can be substantial Organizations have realized that PCI compliance must be a continuous assessment effort and not a point in time exercise Payment Card Industry (PCI) program has placed significant pressure on businesses to establish enterprise- grade security programs PCI Data is Both a Benefit and Liability for Organizations
- 3. 3EMC CONFIDENTIAL—INTERNAL USE ONLY Storage of Personal Card Data is a Common Practice Recent Survey of Businesses in the U.S. and Europe 81% 73% 71% 57% 16% Store Payment Card Numbers Store Payment Card Expiration Dates Store Payment Card Verification Codes Store Magnetic Data from the Payment Card Magnetic Strip Store Other Personal Data Common Business Practices That Put Cardholder Data at Risk Source: Forrester Research – The State of PCI Compliance (commissioned by RSA/EMC)
- 4. 4EMC CONFIDENTIAL—INTERNAL USE ONLY RSA Archer PCI Compliance Management Process ID Cardholder Data Flows Determine Scope ID & Implement Controls Gather Evidence Review Controls / Complete SAQ Remediate Complete Validation Requirements Submit Validation Requirements
- 5. 5EMC CONFIDENTIAL—INTERNAL USE ONLY PCI Compliance Value Proposition Business Benefits of RSA Archer PCI Solution Pre-Configured Solution Efficiency Visibility Scalability • Jumpstart PCI Compliance Program • Pre-written Policies, Standards, Procedures & Assessments • Streamlines the compliance process • Automates assessments • Reduces test & maintenance costs • Integrates with broader RSA GRC solutions • Easily add additional solutions as business requirements grow • Real-time visibility into the state of organizational PCI compliance • Powerful executive dashboards & reports
- 6. 6EMC CONFIDENTIAL—INTERNAL USE ONLY eGRC Platform Policy Management Enterprise Management Compliance Management PCI Compliance Management Cardholder Data Environments PCI Compliance Projects Reports on Compliance PCI Compliance Component Layout
- 7. 7EMC CONFIDENTIAL—INTERNAL USE ONLY Define your Cardholder Data Environment, Deploy Control Self Assessments, schedule ongoing compliance activities integrate technical compliance tools, manage issues, exceptions and remediation actions. Capture Evidence Schedule Ongoing Compliance Assessments Document Your Control Framework Report on Overall Compliance Manage Issues, Exceptions and Remediations Define your Cardholder Data Environment How We Do It
- 8. 8EMC CONFIDENTIAL—INTERNAL USE ONLY Time to Prepare Compliance Metrics and Reports # PCI Requirements Met Reduced Time to Measure Compliance with New Versions # Closed Findings Cost of Regulatory Audit Fines Measuring Your Success Before we managed work in two or three places. With RSA Archer, we have one place to manage all of our work. People are completing assessments and migrating risk, not focusing on administrative tasks. “ “
- 9. 9EMC CONFIDENTIAL—INTERNAL USE ONLY Product Demonstration
- 10. 10EMC CONFIDENTIAL—INTERNAL USE ONLY Questions & Answers
- 11. 11© Copyright 2011 EMC Corporation. All rights reserved. Upcoming RSA Archer Webcasts • Aug 8 at 11ET: ACI/AIMS/Archer/Security Analytics • Register on the RSA public website or Archer Community http://www.emc.com/campaign/global/rsa/rsa-webcast.htm • Webcast replays are also on public website or Community
- 12. 12© Copyright 2011 EMC Corporation. All rights reserved. THANK YOU