08/21/2024 | Press release | Distributed by Public on 08/21/2024 08:14
Businesses that accept or process credit card information must comply with the Payment Card Industry Data Security Standard (PCI DSS, or PCI for short). PCI is a set of global standards that establishes a technical and operational baseline for protecting account data used in credit card and payment transactions. PCI calls for very explicit actions that are easier to solve for with Gigamon Application Metadata Intelligence (AMI).
PCI, in its simplest form, states that systems that process credit card transactions must be segmented away from systems that don't. This includes physical and electronic separation.
Many systems today rely on MELT (metrics, events logs, traces) and information from EDR (endpoint detection and response), which form two pillars of PCI. Gigamon can offer a third pillar - network metadata.
All of these systems are critical, but network metadata makes solving some aspects of PCI easier, which can in turn lead to better strategic outcomes.
Gigamon AMI has broad applications for PCI requirements R1 through R12. For example, AMI can help:
In addition, PCI has periodic audits of security controls with continuous visibility compliance reports, and Gigamon can make these checks easier to produce.
Here are some tactical examples of benefits Gigamon AMI provides and the corresponding PCI requirements addressed:
A comprehensive list of PCI controls can be found here.
While not directly called out in PCI standards, other considerations that organizations must contend with can have effects on PCI. These include:
Performance
Organizations that accept and process credit card transactions often have an SLO or SLA by which those transactions must be processed. Failure to meet that SLO/SLA could cause them to lose the business or incur a penalty or fine. As a network packet broker, Gigamon is well suited to see the same conversations in various parts of the network. This external observation can detect the source of network slowdowns.
Shadow IT
Although PCI DSS does not directly call out shadow IT, a security architect could consider any unwanted software malicious. Shadow IT apps could expand the vulnerability surface of organizations' networks by introducing unknown and unmeasured risks.
Gigamon AMI can add a third pillar of visibility that complements the two more common pillars of MELT and EDR data. This can assist with many aspects of PCI deployment and verification by better providing information about which systems are communicating, confirming whether they are communicating securely, and aiding in compliance reports with continuous visibility.
Explore how the Gigamon Deep Observability Pipeline is uniquely positioned in data networks to ensure PCI compliance with greater ease and accuracy in the "PCI Data Security Standard with Gigamon and Your SIEM: A Guide to Compliance".
People are talking about this in the Gigamon Community's Security group.
Share your thoughts today