nuBLOG

MFT. Lessons Learned from the Tortoise and the Hare.

Kyle Parris
Director of Product Management
nuBridges

Despite my best efforts to remain a casual jogger, I find myself getting up earlier and earlier, running further and further.  I have now become … dare I say it … “a runner.”  And I’m a regular on the “race circuit.”

I’ve learned an invaluable lesson on the circuit, one that even businesses can apply. I quickly learned that my early childhood teachers weren’t being entirely forthcoming when they shared Aesop’s fable of The Tortoise and the Hare.

We all know the fable, right?  During the race, the Hare becomes complacent; stops off for a nap and some nourishment, maybe another nap; then is beaten by the “slow  and steady Tortoise.”  Well, there must be more to the story…

Have you ever tried to win a race running slowly and steadily?  It doesn’t work.  You have to imagine that during the next race, the Hare learned his lesson and wasn’t complacent again.  In the next race, he went faster the WHOLE time and he beat the Tortoise.  Now imagine that Hare is a big hulking beast of a rabbit.  He can run fast -- even with a load on his back.  But what if there are spectators along the course who are not fans of the Hare and attack him the whole time?  Well now the Hare can pick up the Tortoise (shell & all) and carry him on his back.

Fast… strong… secure… THAT is how you win the race every time.

Is your MFT solution fast, strong and secure enough to beat your competition? 

Now you know THE REST of the story.

Kyle

Data harvesting has a whole new meaning. And it’s not pretty!

Kyle Parris
Director of Product Management
nuBridges

When I was taking Marketing 101 in college, we learned all about the strategic value of data harvesting. By harvesting data – demographics, buying patterns, and the like – we would be able to learn about prospects; customer likes and dislikes; and what messages would best resonate with our targeted audiences. And all of this data was gleaned from public sources, one-on-one interviews, surveys or focus groups and so on. Consumer privacy was not breached under this definition of data harvesting.

The times, they are a changin’.

Today cybercriminals are seeing tremendous value in harvesting data, but we’re not talking about the same old type of data to which my professor was referring. We’re talking about payment card data, financial information, health care records, Social Security numbers and any other personally identifiable information that can be easily snatched in transit and sold on a thriving black market. 

A recent report from SpiderLabs – Global Security Report 2010 – found that cyber attackers “. . . have devised methods to obtain data  . . .  often harvesting data in transit.” How do we neutralize these threats? Yet keep the critical data that drives the world’s businesses flowing? 

Best practice calls for data encryption of all sensitive, regulated and business-critical information – whether it’s at rest in a database or application or in transit.  For data in transit, there’s a new generation of managed file transfer solutions that just may bring back that old definition of data harvesting! For the good of the consumer.

I’d like to hear what your business is doing to protect sensitive data while it’s in transit within and outside your organization.

Until next time,

Kyle

Universal tokenization standards

Gary Palgon
Vice President, Product Management
nuBridges

The debate is over. It’s time to collaborate!

The value of tokenization is indisputable. We’re seeing, for example, that tokenization is helping a global online retailer reduce its PCI DSS audit scope by more than 90%, with like cost and resource savings!  Tokenization isn’t just for the big guys. Even medium-sized retailers are reducing the complexity and costs associated with PCI DSS – thanks to tokenization.

Tokenization is also bringing tremendous value to organizations in other industries as well – particularly hospitality, financial services and health care. Any organization that wants to meet best practice in risk management can greatly benefit from tokenization. Not just tokenization of credit cards, but any personally identifiable information (PII) or protected health information (PHI). And that’s everything from data included in employment records to medical files to insurance claims and so on. Can you think of any organization that doesn’t store or transmit one of these types of information? I can’t.

That’s the good news. The not-so-good news is that as the value of tokenization is recognized, the race is on to develop tokenization wannabes and even home-grown versions. Are these tokenization solutions being tested against any standards? No.

According to John Pescatore, vice president at Gartner, since standards aren’t in place for tokenization (as they are for encryption), there is nothing against which to compare it to ensure it’s done correctly. And Ramon Krikken, also an analyst at Gartner, had a great deal to say on this topic at the recent RSA Conference. For example, he called for a standards group similar to the PCI SSC to lead the effort.

And at the recent Electronic Transactions Association (ETA) Conference, Paul Garcia, chairman, president and CEO of Global Payments, called for the ETA to create a committee to explore tokenization standards.

So it seems we all agree that we need a tokenization standard, but we need to make sure that it is a universal standard that extends across geographic , corporate, industry and data boundaries.  But it already appears that we’re following the pattern of many standards before whereby there are “multiple, competing standards” (yes, the oxymoron) and lots of wasted time and energy working towards a winner.

• The Accredited Standards Committee X9 is has begun working on a standard to define tokenization requirements related to credit card data in the financial services industry. 
• The Hospitality Technology Next Generation Payments Workgroup just issued a tokenization standard for credit card data for use within the hospitality industry.  They use the term DataProxy for a token and require it to be MOD-10 compliant.
• The Payment Industry Security Standards Council’s (PCI SSC) Scoping Special Interest Group (SIG) is working on definitions and the application of tokens as it relates to the PCI Data Security Standard (DSS). 

So we’re off and running in the direction of standards, multiple ones just as history has taught us.  Though we need to join together now to establish them for not only credit card data, but also look towards the future to address other data, globally, such as PII.  That’s why we proposed a Tokenization Standards Organization at last month’s RSA Conference.  We’re calling on all vendors in this space to collaborate (yes, competitors do collaborate!) to develop a set of global specifications on tokenization.

I encourage you to share your thoughts on how best to get a universal tokenization standard accepted around the globe. You can comment below or contact me at gpalgon@nubridges.com.

For a secure, tokenized world,

Gary

Hotels Achieve Unwanted Status as #1 Cybercrime Target

Gary Palgon
Vice President, Product Management
nuBridges

We in the data protection industry are almost becoming immune to data breach alerts involving retailers and financial institutions. The alerts are not only frequent but expected. But when a recent alert from The Wall Street Journal flashed across my desktop “. . . Hotels are #1 Sector for Credit Card Data Breaches”, I must admit I was caught a bit off guard. I knew data breach incidents were growing in the overall hospitality industry, but #1?

The WSJ article relied on findings from a SpiderLabs report, which found that 38% of its data breach investigations in 2009 occurred at hotels, followed by 19% in the financial services industry. Perhaps a more astounding finding was that it took an average of 156 days for hotels to realize that a breach had occurred!

Upon reflection, there’s little doubt that hotels are particularly vulnerable to today’s savvy cybercriminal. Consider the number of payment channels used by hotels – mail order, telephone, card-present, web. And consider the number of reasons a merchant needs to store cardholder data for guests’ convenience -- recurring payments, loyalty programs and charge-backs – to name just a few examples. If the cardholder data is not protected via encryption within all applications and databases, data breaches will continue to occur at an alarming rate.

Were you also caught off guard by this news? I’d like to know your thoughts.

Look forward to hearing from you,

Gary

Enterprises Reaping Strategic Value from Managed File Transfer (MFT)

Kyle Parris
Director of Product Management
nuBridges

What we’re hearing from enterprise IT managers is that robust MFT solutions are significantly improving their supply chain operations. Here are some of the benefits they’re achieving:

• improved communications and collaboration among internal departments and business partners, translating into increased productivity and enhanced partner relationships;
• integration of applications and business processes, streamlining file transfer operations;
• centralized file transfer, reducing costs;
• improved compliance with industry and regulatory mandates, helping meet governance risk-management initiatives;
• reduced charge-backs, faster product-to-market cycles, and improved order-to-fulfillment and invoice-to-cash, generating revenue faster.

Specific features that are helping enterprises realize strategic value from MFT include:

Scalability – ability to scale across extended heterogeneous environments and to scale as business grows
Real-time communications and collaboration – MFT accelerates information sharing across internal departments and among business partners, improving speed and accuracy of decision making
Reliability – assured file delivery and built-in back-up features, eliminating lost files and disruptions in operations
Manageability – centralized control, reducing the number of systems that need to be maintained

We would like to hear from you. Is your enterprise reaping strategic value from MFT?
Until next time,

Kyle
 

RSA Conference 2010 – No place to sit? No Problem.

If you’ve ever been to a large conference, you know how difficult it can be to find a spot to sit down, talk and conduct business – with the press and analysts, for instance.

nuBridges solved that problem with “nuBridges Press Suite in a Box!”  With a table for four from our customer, Cabela’s, and a little nuBridges branding, we’re never without a place to sit and visit with media, analysts, prospects and customers.  No more wasting precious time looking for a place to sit!

The annual RSA Conference is held at the Moscone Center in San Francisco every year and the Starbuck’s across the street is a favorite meeting place.  But it fills up quickly.  For nuBridges, that’s not a problem. We travel with “nuBridges Press Suite in a Box!”

Simply find a nice spot within the restaurant, especially when it’s raining like it has been this week, and off you go.

If you’re at the RSA Conference this week or attending another conference in the near future where nuBridges is, like InfoSec Europe, stop on by and we’ll find a nice place to sit with “nuBridges Press Suite in a Box!”

Until next time,

Gary

 

Don’t forget about scanned images for PCI DSS compliance

Gary Palgon
Vice President, Product Management
nuBridges

The Payment Card Industry’s Security Standards Council issued a clarification about audio recordings on January 22, 2010 noting that card validation codes and values must not be stored under usual circumstances to be considered PCI DSS compliant.  PANs in the recording, of course, must be encrypted following the current standards as well.

• Much like audio recordings, scanned images that contain the PAN and card validation codes must be addressed as well.
• Requirement 3.3 specifically states that “displays of PAN (for example, on screen, on paper receipts) … are masked when displayed ...”
• Requirement 9.6 notes: “Physically secure all paper and electronic media that contain cardholder data.”
• Like the audio recordings, track data should not be stored based on Requirement 3.2 : “Do not store sensitive authentication data after authorization (even if encrypted).”
• Images containing credit cards will need to be encrypted as required by Requirement 3.4: “Render PAN, at minimum, unreadable anywhere it is stored (including on portable digital media, backup media, in logs).”

Don’t be caught off guard as you make your way though a PCI DSS compliance audit – trace all input sources of credit cards and follow the card “information supply chain” to make sure you’ve addressed all occurrences of this sensitive data.

Are there any other areas of input that you’ve seen frequently missed during audits?

Regards,
Gary

PS... If you have not already registered, I am co-presenter for live webinar being held February 24, 2010 at 2pm EST.  Brian Grafsgaard of QBS and I will discuss "Applying PCI Best Practices to Protect PII"  Click here to register:  https://www1.gotomeeting.com/register/314351497 

HITECH Act Enforcement and Heightened Regulation Begins February 18th

Kyle Parris
Director of Product Management
nuBridges

By extending HIPAA (Health Insurance Portability and Accountability Act) rules for secure transfer of protected health information (PHI), the 2009 HITECH ( Health Information Technology for Economic and Clinical Health) Act mandates that health care providers enforce encryption and audit controls over all business processes involved with data transfers. The provisions with the most significant impact for health care organizations are the mandatory breach notification requirements, combined with a new, punitive enforcement scheme. The risks for penalties, fines, brand damage and loss of business are great. So, what does that mean when it comes to the risk to your health care organization? It means that your organization can be heavily fined for data breaches. And you, your employees and business partners are even subject to criminal penalties. 

What’s your best option for ensuring that you, your employees and business associates are in compliance with the spirit and letter of HITECH? The simple answer is secure all PHI according to HHS (Health and Human Services) guidelines. Make certain that all electronic PHI is encrypted. For PHI that is in transit within or outside your organization that means employing a Managed File Transfer solution that meets best practices for data encryption. 

Are you ready for February 18th?

Until next time,
Kyle