download issue 24 here - Help Net Security

To achieve this, retailers must shift their view
of security and compliance from a checklist
mentality for passing an audit to a state of
continuous IT security.
Permanent and uncompromising process discipline
must be instituted on the data security
domain to achieve consistent, effective protection
for the sensitive and confidential customer
information collected and stored.
While this may sound like a daunting task—especially
for smaller retail merchants—using
an automated IT Governance, Risk and Compliance
(IT GRC) solution provides the type of
information and the security framework
needed for achieving and sustaining a high
level of continuous compliance—and security.
The GRC model
"GRC" refers to a class of automated systems
that help organizations integrate and control
the management of complex regulatory mandates
and operational risk in alignment with
appropriate high level company governance.
GRC is a strategic approach to the universal
concept of compliance. It can help retailers
meet PCI compliance requirements as well as
providing a controls management framework
to protect other types of customer-confidential
information.
PERMANENT AND UNCOMPROMISING PROCESS DISCIPLINE MUST BE
INSTITUTED ON THE DATA SECURITY DOMAIN TO ACHIEVE CONSISTENT,
EFFECTIVE PROTECTION FOR THE SENSITIVE AND CONFIDENTIAL
CUSTOMER INFORMATION COLLECTED AND STORED.
The information security policy
While many retailers approach PCI DSS compliance
as a technology problem, itʼs just as
much a people problem. Simply installing the
best firewall and encryption technologies is
just the first part of the solution. Following IT
security best practices and establishing a written
security policy is the next step, but if employees
arenʼt following those policies the organization
remains vulnerable. According to
Deloitteʼs “The 6th Annual Global Security
Survey,” “people are the problem.”
The report states that, “Human error is overwhelmingly
stated as the greatest weakness
this year (86%), followed by technology (a distant
63%).” The Computing Technology Industry
Association, Inc. (CompTIA) echoes that
assessment in its "Committing to Security: A
CompTIA Analysis of IT Security and the
Workforce," survey stating that, “Human error,
not technology, is the most significant cause of
IT security breaches.”
To reduce security risk cause by human error,
a retailer must have a process for distributing
its IT security policy and ensuring that each
employee has read and understands the pol-
icy and acknowledges their responsibility in
protecting the organizationʼs information and
data. GRC systems have Security Awareness
modules make it easy for retailers to educate
employees on general IT security practices
and internal IT security policies. The Awareness
module also tracks who takes each
course and records test scores.
Business continuity planning
The impact of a data breach can be devastating.
IT GRC systems include a Business Continuity
Planning (BCP) component that provides
retailers with a single source repository
for the guidance, information and plans necessary
to respond to a data breach incident.
Continuous PCI compliance for small merchants
Smaller merchants are an appealing target for
cybercriminals because they often do not have
the expertise to properly secure card holder
data. A GRC tool delivered as “Software as a
Service” (SaaS), hosted at a remote location
and delivered over the Internet, makes it affordable
and adaptable for any size merchant.
www.insecuremag.com 78