nuBLOG

Data security projects can be challenging if not managed appropriately

Abir Thakurta, CISSP
Senior Director, Worldwide Pre-Sales & Professional Services
nuBridges

During one of my recent customer conversations, I was asked what challenges customers typically experience in implementing data security. In our experience we find customers run into two types of challenges: process challenges and technology challenges. Here are some of the more common process challenges.

1. Knowing your sensitive information footprint within the enterprise. Many organizations do not have a data classification program or know where their sensitive information resides. Absence of a holistic picture results in islands of data protection that can be challenging to manage and standardize. It also increases the cost of ongoing compliance and management of these solutions. To mitigate this situation, nuBridges Professional Services teams ensure that a sensitive information footprint is generated so an appropriate data protection strategy can be defined.

2. Defining a data protection strategy. Traditionally, organizations have viewed security as network or perimeter security. With the proliferation of internal breaches, organizations are beginning to understand the need to protect data at the source.

   However, tactical fixes like encrypting data in one database without developing an enterprise data protection strategy can cause issues in the long run. To mitigate this situation, nuBridges Professional Services teams help in developing a data protection strategy that aligns with the business needs before implementations are conducted.

3. Working with surrogate data. Studies have revealed that 60% to 70% of processes do not need to work with sensitive data.  Rather, surrogate data can be used. Introducing changes to existing processes and requesting business owners to work with surrogate data can be challenging. But working with format-preserving tokens generated by a tokenization solution like nuBridges Protect Token Manager can mitigate this situation

What kind of challenges do you encounter?

In my next blog, we’ll look at technology challenges.

Until next time,

Abir

Universal tokenization standards

Gary Palgon
Vice President, Product Management
nuBridges

The debate is over. It’s time to collaborate!

The value of tokenization is indisputable. We’re seeing, for example, that tokenization is helping a global online retailer reduce its PCI DSS audit scope by more than 90%, with like cost and resource savings!  Tokenization isn’t just for the big guys. Even medium-sized retailers are reducing the complexity and costs associated with PCI DSS – thanks to tokenization.

Tokenization is also bringing tremendous value to organizations in other industries as well – particularly hospitality, financial services and health care. Any organization that wants to meet best practice in risk management can greatly benefit from tokenization. Not just tokenization of credit cards, but any personally identifiable information (PII) or protected health information (PHI). And that’s everything from data included in employment records to medical files to insurance claims and so on. Can you think of any organization that doesn’t store or transmit one of these types of information? I can’t.

That’s the good news. The not-so-good news is that as the value of tokenization is recognized, the race is on to develop tokenization wannabes and even home-grown versions. Are these tokenization solutions being tested against any standards? No.

According to John Pescatore, vice president at Gartner, since standards aren’t in place for tokenization (as they are for encryption), there is nothing against which to compare it to ensure it’s done correctly. And Ramon Krikken, also an analyst at Gartner, had a great deal to say on this topic at the recent RSA Conference. For example, he called for a standards group similar to the PCI SSC to lead the effort.

And at the recent Electronic Transactions Association (ETA) Conference, Paul Garcia, chairman, president and CEO of Global Payments, called for the ETA to create a committee to explore tokenization standards.

So it seems we all agree that we need a tokenization standard, but we need to make sure that it is a universal standard that extends across geographic , corporate, industry and data boundaries.  But it already appears that we’re following the pattern of many standards before whereby there are “multiple, competing standards” (yes, the oxymoron) and lots of wasted time and energy working towards a winner.

• The Accredited Standards Committee X9 is has begun working on a standard to define tokenization requirements related to credit card data in the financial services industry. 
• The Hospitality Technology Next Generation Payments Workgroup just issued a tokenization standard for credit card data for use within the hospitality industry.  They use the term DataProxy for a token and require it to be MOD-10 compliant.
• The Payment Industry Security Standards Council’s (PCI SSC) Scoping Special Interest Group (SIG) is working on definitions and the application of tokens as it relates to the PCI Data Security Standard (DSS). 

So we’re off and running in the direction of standards, multiple ones just as history has taught us.  Though we need to join together now to establish them for not only credit card data, but also look towards the future to address other data, globally, such as PII.  That’s why we proposed a Tokenization Standards Organization at last month’s RSA Conference.  We’re calling on all vendors in this space to collaborate (yes, competitors do collaborate!) to develop a set of global specifications on tokenization.

I encourage you to share your thoughts on how best to get a universal tokenization standard accepted around the globe. You can comment below or contact me at gpalgon@nubridges.com.

For a secure, tokenized world,

Gary

Token Manager Product Launch Continues

Gary Palgon
Vice President, Product Management
nuBridges

Global Campaign Makes Stop at ISSA ^UK

The whirlwind global launch of nuBridges Protect™ Token Manager didn’t slow down after InfoSec.  It just moved around the European continent!

More meetings with the three “P”s  -  press, partners and prospects (I would have mentioned analysts, but it didn’t start with a “p”), all wanting to know about how format-preserving tokenization is not only significantly reducing the scope of PCI DSS compliance.  But also protects personally identifiable information such as social security numbers, National Insurance Numbers, and business-critical information such as customer lists, financial statements, payroll data and so on.

A little fun was had over the weekend in Brussels and Bruges and then back to work in Amsterdam for a day, three cities and two countries where I had not traveled.  What a wonderful invention the train was – and so fast now, clocking in at 186 mph on the Nuvi GPS navigator.

As I sit in the airport waiting for my plane to leave (yet again), I’m looking at the pictures from last night’s Information Systems Security Association – United Kingdom (ISSA^UK) annual black tie dinner.  It was held at Armourers’ Hall (Armourers & Brasiers), a building much older than America and containing armor and weapons dating back to the 1500s, again much older than America (I say this twice because I was often reminded of this point:-)).  

There was much discussion from all angles of information technology with the realization (and several speakers noting) that companies and government organizations must take responsibility in caring for sensitive information.  Richard Stanes, the former president of ISSA UK (who lives in Kentucky now) and Sir Edmund Burton, formerly of the British Army and current Chairman of the Information Assurance Advisory Council (IAAC) spoke.

Bobby Conway (right), nuBridges’ EMEA Regional
Sales Manager and I at Armourers’ Hall, London, UK.

Time to board – until next time from the comfort of my office - which I haven’t seen for several weeks …

Cheers,

Gary 

Across many borders and time zones. Greetings from InfoSecurity Europe 2009!

I send you greetings from the UK.  At least I think that’s where I am!  With just 24 hours at home between the RSA Conference in San Francisco and InfoSecurity Europe in London, I’m not sure what time zone I’m in --  PST, EST, GMT!  All kidding aside, yesterday’s InfoSecurity Europe 2009 kickoff was great.  Whilst (that’s how they say it here) the conference is not as big as RSA, there’s a lot more glitz and glamour in the exhibition hall  -  game shows, in-booth bars and any number of costumed people to get folks to stop by their booths.

I presented “How to Reduce the Scope of PCI DSS Audits by Tokenising
Payment Card Data”, with a special focus on trans-border privacy
(that’s privacy with the “i” as in “if”, not “eye”)!

Given there are many more privacy laws in Europe about sending consumer or employee data across country borders, even within the same company, the use of tokens rather than encrypted sensitive data is another great advantage for the use of a tokenization (or tokenisation) solution. Passing tokens instead of production data for testing, also called data masking, would make life easier for many IT and security people.

Do you have examples where tokenization will help you with privacy or data protection mandates?

More to follow in the coming days.

Cheers,
Gary