Minimize the Impact of PCI Section 3 on SAP Applications - Paymetric

A New Approach to Encryption Management for
Heterogeneous SAP Environments
Today, <strong>the</strong>re’s a new approach to encryption management that <strong>of</strong>fers an array <strong>of</strong> benefits, both
in terms <strong>of</strong> security and ease <strong>of</strong> administration. This approach focuses on using an encryption
management server to control and manage not only encryption keys, but <strong>the</strong> underlying data.
This approach is based on two key facets that deliver value throughout an enterprise:
Centralization. All credit card numbers stored in
SAP and o<strong>the</strong>r business applications and databases
are removed from those systems and placed
in a highly secure, centralized encryption management
server that can be protected and monitored
utilizing robust encryption technology.
BEFORE
Tokenization. Each credit card number that previously
resided in SAP or o<strong>the</strong>r applications is replaced
with a token that references <strong>the</strong> credit card number.
A token can be thought <strong>of</strong> as a claim check that an
authorized user or system can use to obtain <strong>the</strong> associated
credit card number. In <strong>the</strong> event <strong>of</strong> a breach
<strong>of</strong> one <strong>of</strong> <strong>the</strong> business applications or databases, only
<strong>the</strong> tokens could be accessed, which would be <strong>of</strong> no
value to a would-be attacker.
Before Centralization and Tokenization
SAP
1 2 3 4
Encryption and key management
technology must be implemented
on each system in which credit card
numbers are stored.
Web Store
1 2 3 4
Encryption
# # # # # # # # # # # #
####
# # # # Encryption
####
#### ####
Payment App
1 2 3 4
# # # #
Encryption
# # # #
####
© 2008 Paymetric, Inc. All rights reserved.
.