Welcome!

@CloudExpo Authors: Liz McMillan, Mehdi Daoudi, Elizabeth White, Pat Romanski, Yeshim Deniz

Related Topics: @CloudExpo, Microservices Expo, Containers Expo Blog, Cloud Security, @DXWorldExpo, SDN Journal

@CloudExpo: Blog Feed Post

PCI Compliance in the Cloud: What You Need to Know

Cloud Computing – the buzz words of the technology sector this decade

Cloud Computing – the buzz words of the technology sector this decade: if you’re not already doing it, you’re missing out.  Articles have been written.  Experts have been crowned.  Events have been attended.  We all agree – the cloud presents opportunities for cost savings, elasticity, and scalability.

But for companies that are bound by Payment Card Industry Data Security Standard (PCI DSS), securing financial data in “the cloud” presents new issues.

How is the Cloud Different? Securing brick and mortar businesses was one thing, securing data centers and hardware was an added level, but securing the foggy boundaries of the cloud presents a new set of challenges.

The skills and knowledge you acquired in the data center are still very relevant to the cloud world. However, the most obvious change is that physical walls are no longer available to protect your systems and data. Cloud Encryption is the answer – producing “mathematical walls” to replace the physical ones.

…securing the foggy boundaries of the cloud presents a new set of challenges.  Cloud Encryption is the answer – producing “mathematical walls” to replace the physical ones.

Are these challenges manageable?  Yes.

Should you take them on?  Yes.

Should you do it alone? Oh no…

PCI Compliance and Encryption in the Cloud: The Challenges
Six of the twelve requirements of PCI DSS touch on the need for encryption and key management in the cloud, and on proper management of these systems.  The main challenges in complying with PCI and operating in public or hybrid clouds are:

  • Protection methods such as hashing and encryption (part of requirement 3)
  • Encrypting transmission over networks (requirement 4)
  • Securing systems and applications (requirement 6)
  • Restricting access to data (requirement 7)
  • Assigning unique accountability (requirement 8)
  • Tracking and monitoring access (requirement 10)

These are unequivocally big topics.  But you unequivocally do not need to take them on alone.  Solutions, like our Virtual Private Data (VPD), combine state of the art encryption with patented key management to enable organizations to effectively comply with PCI DSS in the cloud.

Protection Methods: The Solution
PCI DSS stresses the importance of protection methods such as hashing and encryption

PCI DSS stresses the importance of protection methods such as hashing and encryption since “If an intruder circumvents other security controls and gains access to encrypted data, without the proper cryptographic keys, the data is unreadable and unusable to that person.”  Our solution was designed with certain elements especially with PCI Compliance in mind, sporting features such as:

  • Strong hashing (SHA-2) and encryption (AES-256) to render PAN unreadable.
  • Key-splitting and homomorphic key encryption to protect the integrity and security of the keys.
  • Only partial keys are stored in any location, and those parts are also encrypted.
  • Exact mathematical descriptions and proofs of strength of protocols, which have been validated by leading cryptographic experts.
  • Supports of AES 256 and RSA public keys from 1024 to 4096 bits, and secure storage of keys of all major crypto systems of any length.

Encrypting Transmission: The Solution
According to the PCI standard, sensitive information must be encrypted during transmission over networks that may be accessed by malicious individuals.  Whichever solution you use, make sure that:

  • All communications within the system are always encrypted.
  • SSL/TLS is always enabled and cannot be switched off.
  • There are mechanisms for issuing certificates for SSL/TLS encryption on a per-customer per-project basis.
  • Your solution supports IPsec communications between cloud servers.

Securing Systems: The Solution

Choose a solution that helps you update the latest software patches quickly and easily.

Requirement six emphasizes the importance of keeping systems up to date with “the most recently released, appropriate software patches” in order to eliminate security vulnerabilities that could be exploited by hackers or inside threats. Choose a solution that helps you update the latest software patches quickly and easily.

Restricting Access: The Solution

Systems and processes must be in place to limit access based on need to know and according to job responsibilities.  This requirement relates both to the data itself and to management and storage of the encryption keys. Encryption is a great way to isolate date in the cloud. It depends of course on keeping the encryption keys safe and ensuring no unauthorized person has access to encryption keys. The solution to this is quite straight-forward: administrators should never be able to see the keys that are used to encrypt cardholder data. Keys should be managed by name, and the value always hidden.  Since Administrators do not know the keys, they are unable to decrypt the data.

Assigning Accountability: The Solution

Assigning a unique identification (ID) to each person with access ensures that each individual is uniquely accountable for his or her actions, so that operations on critical data and systems can be traced.

Tracking and Monitoring: The Solution

Logging mechanisms and the ability to track user activities are critical in preventing, detecting, or minimizing the impact of a data compromise. Your logs must be secure and stored in a way that they cannot be modified.

PCI compliance [...] these provisions protect your customers, which in turn, protect you.

PCI Compliance in the Cloud: Is it Worth the Effort?

Complying with PCI DSS is not just about the legality – it is simply good business. There are many requirements to PCI compliance.  Perhaps life would be easier without them.  But these provisions protect your customers, which in turn, protect you. PCI compliance does not have to be cost-prohibitive.  It does not have to take a lot of time.  But it absolutely does have to be done and it unequivocally is worth the effort.

The post PCI Compliance in the Cloud: What you need to know appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

CloudEXPO Stories
In today's always-on world, customer expectations have changed. Competitive differentiation is delivered through rapid software innovations, the ability to respond to issues quickly and by releasing high-quality code with minimal interruptions. DevOps isn't some far off goal; it's methodologies and practices are a response to this demand. The demand to go faster. The demand for more uptime. The demand to innovate. In this keynote, we will cover the Nutanix Developer Stack. Built from the foundation of software-defined infrastructure, Nutanix has rapidly expanded into full application lifecycle management across any infrastructure or cloud .Join us as we delve into how the Nutanix Developer Stack makes it easy to build hybrid cloud applications by weaving DBaaS, micro segmentation, event driven lifecycle operations, and both financial and cloud governance together into a single unified st...
"Cloud computing is certainly changing how people consume storage, how they use it, and what they use it for. It's also making people rethink how they architect their environment," stated Brad Winett, Senior Technologist for DDN Storage, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
Sold by Nutanix, Nutanix Mine with Veeam can be deployed in minutes and simplifies the full lifecycle of data backup operations, including on-going management, scaling and troubleshooting. The offering combines highly-efficient storage working in concert with Veeam Backup and Replication, helping customers achieve comprehensive data protection for all their workloads — virtual, physical and private cloud —to meet increasing business demands for uptime and productivity.
While the focus and objectives of IoT initiatives are many and diverse, they all share a few common attributes, and one of those is the network. Commonly, that network includes the Internet, over which there isn't any real control for performance and availability. Or is there? The current state of the art for Big Data analytics, as applied to network telemetry, offers new opportunities for improving and assuring operational integrity. In his session at @ThingsExpo, Jim Frey, Vice President of Strategic Alliances at Kentik, discussed tactics and tools to bridge the gap between IoT project teams and the network planning and operations functions that play a significant role in project success.
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm. In their Day 3 Keynote at 20th Cloud Expo, Chris Brown, a Solutions Marketing Manager at Nutanix, and Mark Lavi, a Nutanix DevOps Solution Architect, explored the ways that Nutanix technologies empower teams to react faster than ever before and connect teams in ways that were either too complex or simply impossible with traditional infrastructures.