nuBLOG

RSA Conference 2010 – No place to sit? No Problem.

If you’ve ever been to a large conference, you know how difficult it can be to find a spot to sit down, talk and conduct business – with the press and analysts, for instance.

nuBridges solved that problem with “nuBridges Press Suite in a Box!”  With a table for four from our customer, Cabela’s, and a little nuBridges branding, we’re never without a place to sit and visit with media, analysts, prospects and customers.  No more wasting precious time looking for a place to sit!

The annual RSA Conference is held at the Moscone Center in San Francisco every year and the Starbuck’s across the street is a favorite meeting place.  But it fills up quickly.  For nuBridges, that’s not a problem. We travel with “nuBridges Press Suite in a Box!”

Simply find a nice spot within the restaurant, especially when it’s raining like it has been this week, and off you go.

If you’re at the RSA Conference this week or attending another conference in the near future where nuBridges is, like InfoSec Europe, stop on by and we’ll find a nice place to sit with “nuBridges Press Suite in a Box!”

Until next time,

Gary

 

Don’t forget about scanned images for PCI DSS compliance

Gary Palgon
Vice President, Product Management
nuBridges

The Payment Card Industry’s Security Standards Council issued a clarification about audio recordings on January 22, 2010 noting that card validation codes and values must not be stored under usual circumstances to be considered PCI DSS compliant.  PANs in the recording, of course, must be encrypted following the current standards as well.

• Much like audio recordings, scanned images that contain the PAN and card validation codes must be addressed as well.
• Requirement 3.3 specifically states that “displays of PAN (for example, on screen, on paper receipts) … are masked when displayed ...”
• Requirement 9.6 notes: “Physically secure all paper and electronic media that contain cardholder data.”
• Like the audio recordings, track data should not be stored based on Requirement 3.2 : “Do not store sensitive authentication data after authorization (even if encrypted).”
• Images containing credit cards will need to be encrypted as required by Requirement 3.4: “Render PAN, at minimum, unreadable anywhere it is stored (including on portable digital media, backup media, in logs).”

Don’t be caught off guard as you make your way though a PCI DSS compliance audit – trace all input sources of credit cards and follow the card “information supply chain” to make sure you’ve addressed all occurrences of this sensitive data.

Are there any other areas of input that you’ve seen frequently missed during audits?

Regards,
Gary

PS... If you have not already registered, I am co-presenter for live webinar being held February 24, 2010 at 2pm EST.  Brian Grafsgaard of QBS and I will discuss "Applying PCI Best Practices to Protect PII"  Click here to register:  https://www1.gotomeeting.com/register/314351497 

HITECH Act Enforcement and Heightened Regulation Begins February 18th

Kyle Parris
Director of Product Management
nuBridges

By extending HIPAA (Health Insurance Portability and Accountability Act) rules for secure transfer of protected health information (PHI), the 2009 HITECH ( Health Information Technology for Economic and Clinical Health) Act mandates that health care providers enforce encryption and audit controls over all business processes involved with data transfers. The provisions with the most significant impact for health care organizations are the mandatory breach notification requirements, combined with a new, punitive enforcement scheme. The risks for penalties, fines, brand damage and loss of business are great. So, what does that mean when it comes to the risk to your health care organization? It means that your organization can be heavily fined for data breaches. And you, your employees and business partners are even subject to criminal penalties. 

What’s your best option for ensuring that you, your employees and business associates are in compliance with the spirit and letter of HITECH? The simple answer is secure all PHI according to HHS (Health and Human Services) guidelines. Make certain that all electronic PHI is encrypted. For PHI that is in transit within or outside your organization that means employing a Managed File Transfer solution that meets best practices for data encryption. 

Are you ready for February 18th?

Until next time,
Kyle

Will Federal Legislation Eliminate Complicated Data Breach Notification Legal Patchwork?

Gary Palgon
Vice President, Product Management
nuBridges

We’ve had a close eye on D.C., as two retooled data breach notification bills have been wending their way through Congress. While we had our eye off the ball recently (guess we were lulled into thinking this newest round of legislation would go the way of the past several bills), on December 9th the House of Representatives passed, for the first time ever, a data breach notification bill. While that’s great news, we’re wondering that if the bill makes it through the Senate and becomes the law of the land, will it replace the patchwork of state laws – 45 as of today – that exist? Right now, breach alert mandates are handled at the state level. Will this legislation rationalize data protection legislation across the US? Doubtful, but more realistically it will provide a consistent baseline from which states, and companies looking to comply with data protection notification laws, can use as a starting point.

The Data Accountability and Trust Act (DATA) will indeed standardize data protection across the US at a Federal level. It requires companies, defined as data brokers, that hold sensitive personal information – everything from Social Security numbers to driver’s license numbers to credit card information -- to secure that data and provide notice to affected consumers that their data has been compromised. What’s more, the bill allows consumers to have access to files about them and request that errors be corrected.

The bill directs the Federal Trade Commission (FTC) to create rules for destroying obsolete non-electronic data in addition to requiring data brokers to submit their security policies to the FTC in conjunction with a security breach notification or on FTC request. If a breach does occur, the FTC is ordered to conduct a security audit of the data broker.

As with many state laws, the DATA has a safe harbor provision. According to the legislation, data encryption establishes a presumption that no reasonable risk of identity theft, fraud or other unlawful conduct exists following a data breach. Here’s the actual language of the legislation relating to data encryption:

“…Encryption – The encryption of data in electronic form shall establish a presumption that no reasonable risk of identity theft, fraud, or other unlawful conduct exists following a breach of security of such data. Any such presumption may be rebutted by facts demonstrating that the encryption has been, or is reasonably likely to be compromised…”

It’s not great news that it takes Federal legislation to push companies along to protect consumer data in the first place, but I’m hopeful that a Federal law will lead to making data protection easier for all of us – what do you think?

Best wishes for a happy holiday,
Gary

PS...nuBridges can help you take advantage of “safe harbors” and minimize the risk of a breach. nuBridges Protect™ is an integrated encryption, tokenization, key management and audit logging solution that is already proven in business-critical production environments – for example, it encrypts billions of credit card numbers every day around the world.
 

Retailers are Gaining Business Value with MFT

Kyle Parris
Director of Product Management
nuBridges

As retailers wait out the holiday shopping numbers, they’re continuing to enjoy lots of business value from their managed file transfer solutions. Retailers are early adopters of MFT for numerous reasons, but the top two are the need to:

• Exchange exploding volumes of information – online catalogs, product images, price quotes, invoices and so forth; and
• Comply (and prove compliance) with the Payment Card Industry Data Security Standard (PCI DSS)

The new generation of MFT solutions meets these challenges and many more. Other benefits that retailers tell us they’re reaping include:

• Streamlined global order and fulfillment
• Improved order-to-cash and days-sales-outstanding
• Enhanced competitive sourcing capabilities
• Improved demand forecasting
• Eliminated order and invoice errors
• Reduced costs and headaches associated with PCI DSS compliance
• Met audit and governance requirements
• Reduced transaction costs
• Improved customer loyalty

Until next week,

Kyle

MFT Vendor Due Diligence is Complete. Software is Installed. What Benefits are You Reaping?

Kyle Parris
Director of Product Management
nuBridges

Last week I talked about things to consider when looking for a Managed File Transfer solution. You have done your due diligence. You’ve chosen your vendor based on your business requirements. And all went swimmingly with implementation.

So, now you have a single solution, and it’s integrated with your internal systems and with all of your trading partners. You can send files of any type via any protocol from one centralized place.

Your data is secure. Whether or not the files you send contain sensitive data, they can be secured using whatever protocols your suppliers, customers or other business partners require. You can also prove they were secure when they were sent using industry and regulatory compliance standards in audit logging. In addition to secure protocols, your data is also secured by other means as it travels around your enterprise using best practices technologies on the back-end.

Though your data is safe, you can still do business quickly and easily; more quickly and with less effort than ever before. You have protected your data, and you have used the centralized console to administer a fine level of detail regarding who can and should access the sensitive data.

You have reduced your administrative costs in several ways, including: reducing the number of point solutions being supported and administered; removing script processes and disparate end point clients; and (perhaps best of all) you’re pushing business partner administration out to the business partner! Your business processes are now poised to react based on whatever turn the market takes.

You can now scale on demand -- hopefully UP!


Until next week,

Kyle
 

Not All MFT Solutions Are Created Equal

Kyle Parris
Director of Product Management
nuBridges

There are, of course, a number of standouts in the new generation of managed file transfer (MFT) solutions. But there are also a number that may not meet the file transfer needs of organizations that require secure, reliable and integrated communication gateways.

Some of the things you should consider when vetting prospective MFT providers about an enterprise-class MFT are:

• The MFT must be pervasive.  Ask providers what platforms they support (Hardware, OS, DB, etc); ask what protocols they support; what encryption algorithms, etc.
• Partner management can be difficult and time consuming.  Understand the vendor’s capabilities around the set-up and maintenance of trading partners, customers, suppliers and other business partners.  If you trade with numerous partners, consider a solution that allows them to manage themselves; taking the administrative burden off of your organization.
• A key component of MFT is centrality.  Integration of a single solution to all of your back-end office systems and with your strategic partners is critical.  Make sure you understand the provider’s integration capabilities.  Are they web interface enabled?  Do they require separate client applications at each end point, or can they integrate to existing applications?
• There are several considerations where sensitive data is being moved . . .
  • In addition to the supported secure protocols and encryption methods, what other security features does the solution offer?  This can be related to user authentication and authorization; as well as to the back-end protocols once the files have made it inside your enterprise.  Consider every angle of security and ask the vendor how they address each concern.
  • Proving compliance is a necessity.  Dig into the provider’s reporting, alerting and notification capabilities.  Make sure the solution meets requirements for compliance audits and risk management.
• Speaking of reporting, make sure you have visibility to vital transaction information as it happens.  This can be delivered via a management console or dashboard.
• Some solutions, such as secure e-mail, have file size limitations.  It is important to understand how these file size limitations can affect your ability to do business. 

To help enterprises analyze the solutions that are currently available, nuBridges offers a white paper that explores the key best practices that define enterprise-class MFT solutions.

Download your free copy of “Best Practices in Enterprise File Transfer.” Once you read the white paper, we’d really like to hear from you! We’ll respond to your comments in our next blog.

Until next week,

Kyle
 

 

Annual Atlanta ISSA Conference Update

First International ISSA Conference to be Held in Atlanta in 2010

Gary Palgon
Vice President, Product Management
nuBridges

The Metro Atlanta ISSA hosted its 5th annual information security conference on Veteran’s Day, November 11th, with the theme of "Magnify Your Security." It was great to see they took time out in the opening session to recognize the dozen or so Veterans among the attendees. Thanks to all of you have served and do serve our country!

It was formally announced that Atlanta will host the first international ISSA conference on September 15-17, 2010. This is great news for the ISSA community as well as for Atlanta, which has historically been the home for many security startups -- Internet Security Systems (now IBM ISS); SPIDynamics (now HP), PureWire (now Barracuda Networks), CipherTrust (now SecureComputing) and many more.

Also of interest at the annual Atlanta ISSA meeting was a presentation by Kevin Campbell of PriceWaterhouseCoopers, covering PWC’s Global State of Information Security Survey.  Lots of great and timely information about spending and security breaches.  Kevin summarized the executives’ views in the coming year as focused on looking at and placing their highest expectations on initiatives that:

• Protect data
• Address the big risks first
• Pull this portfolio of multi-year investments together (strategy)
• Reduce cost and increase efficiency
• Prepare for a wave of new regulations (e.g. State Breach Notification Laws)

To the last point, he noted that because of the effect of the economic downturn, regulations are on the rise – led perhaps by a new wave of privacy laws.

Until next time,
Gary