Achieving PCI compliance with storage security systems.

As organizations look to comply with the PCI standards, the matter of protecting data-at-rest through encryption is a serious--and complex--priority.

While hackers beating against the corporate firewall have captured the headlines, the breaches that are genuinely compromising business stability and consumer confidence are hitting data while in storage, known as data-at-rest. Businesses have made significant strides in protecting their networks from external intrusion, but today's vulnerability is located in data storage. We examine the current security situation, outline the pros and cons of several storage security alternatives, and provide brief highlights of technical and operational best practices in addressing this security issue.

Data breaches make headlines

Reported data breaches involving the loss or theft of tapes and disks skyrocketed in 2005, with more breaches than in all prior years in this decade. Each incident exposed tens of thousands of unsuspecting people to potential identity theft through misuse of personal records containing financial or medical details.

The business impact of these thefts and losses can hardly be overestimated. Liability for the potential use of this data is enormous. Consumer confidence plummets and there is ample statistical evidence of consumers choosing to abandon vendors who suffer these breaches in favour of those who have not. The 2005 EDS US Financial Services Privacy and Customer Relationship Management Survey reported that 40 percent of consumers would either immediately or eventually close bank accounts and move to another establishment if there had been a breach. Fully 32 percent would discontinue online banking, reverting to branch and ATM activity, while 55 percent said they would discontinue banking activity until they felt assured that the crisis had been resolved. For the bank, this translates into either customer attrition or at best an interruption in commerce, both of which had significant impact to the bottom line.

In response to growing concern among credit cardholders regarding identity theft and the potential impact to their credit records, the Payment Card Industry (PCI) developed the PCI Data Security Standard. Developed by Visa and MasterCard with the endorsement of other payment vendors, the PCI Data Security Standard consists of 12 unified requirements for merchants and service providers who store, process or transmit cardholder data. PCI compliance companies must:

  Build and maintain a secure network
  Protect cardholder data
  Maintain a vulnerability management program
  Implement strong access control measures
  Regularly monitor and test networks

Failure to comply with these standards can result in the imposition of fines up to $500,000 and forfeiture of business with Visa and MasterCard, which in this economy virtually shuts down a company. Despite the catastrophic fallout for non-compliance, however, Visa recently reported that 83 percent of 231 large merchants are not yet in compliance with the PCI Standard. Approximately 75 percent have filed initial reports indicating that they were working toward compliance with PCI, but eight percent have filed no report at all.

One side down; one to go

In the last few years, companies have worked diligently to protect their networks from external threats by implementing perimeter security. Firewalls, VPN and SSL software have become highly advanced, and for the most part, effective. Authentication and IDS procedures are protecting the network, while content filters coupled with anti-virus and anti-spam software are protecting the client. The problem currently facing most companies, however, is that their data is still vulnerable while being stored, or at-rest. One side--the network side--is relatively safe, while the other side--the storage side--is not.

Protecting data-at-rest presents unique challenges. Storage systems recently became networked and consolidated, increasing the sheer volume of data that could be accessed by a single breach, and also increasing the possible entry points into the system. Adding to the complexity is the extension of the online enterprise. Now that the workforce is mobile and distributed, many client systems lie outside the protective perimeter which increases the data's vulnerability. Additionally, most companies are relying on physical security of their backup tapes, locking them in a vault off-site. In this scenario, tapes and disks are lost or stolen en-route from the company to its storage vendor. Hard drives and tapes that are made obsolete have been known to show up on auction sites without having been wiped clean of their data.

Recognizing the limitations of physical security, the PCI standard makes it clear that "encryption is the ultimate protection mechanism because even if someone breaks through all other protection mechanisms and gains access to encrypted data, they will not be able to read the data without further breaking the encryption." (Requirement 3 of the Visa Payment Card Industry Data Security Standard.)

Encryption options

There are a number of configuration options for using encryption to improve storage security, each with its own challenges and advantages. Consider application encryption, server agent encryption and storage security appliances.

Application encryption has been available in the marketplace for a number of years. The challenges facing this type of security, however, involve the high impact it has on both security and operations. Encryption keys are not secure because of their application-level distribution. Key management is very cumbersome. Most importantly, application encryption requires very large overhead of the server CPU, which causes significant performance degradation.

Server agent encryption is a step forward in that it provides an appliance for secure storage of encryption keys. However, this solution requires integration with the server agent and introduces significant latency delays in network performance. It also requires patch management, an unwieldy, time-intensive and risky task.

Introducing a storage security appliance, however, provides a number of advantages not found in the other solutions. a security appliance off-loads the encryption from the application and networks to the storage arena which makes the security function invisible to the application. If therefore protects network performance. An appliance-based solution also provides versatility, ensuring disk, tape and Fibre Channel Link security, as well as multi-vendor interoperability so that it can be implemented across a wide variety of arrays, remote sites and servers. Multi-vendor interoperability is essential as a company grows and incorporates other data banks. In fact, a storage security appliance solution can provide maximum security with minimal impact.

Technical considerations for effective encryption

Effective encryption solutions consist of four major elements: effective key management; certified encryption systems; role-based administration; and secure audit logging.

1. Key management is a critical, and potentially laborious, part of securing stored data. According to Jon Oltsik, an analyst with the Enterprise Strategy Group: "Key management will become more important as more devices add cryptographic capabilities and thus more data is encrypted." Encryption keys must be continually generated, organized, tracked and available--potentially for years--to recover data that has been stored. Thankfully, automated solutions offer secure key generation, distribution and archival.

2. An encryption system should have independent security validations, such as FIPS 140-2 Level 3 certification from the National Institute of Standards and Technology. This certification should include the entire system--from the physical and logical integrity of individual hardware components, to the operating system, to system level functionality such as user access control and key management. FIPS operation mode ensures that unencrypted key never leave the appliance and requires M of N (split key) backup and recovery of system keys and configuration data to ensure secure appliance recovery. The encryption algorithm itself should be extremely robust: if stored media falls into the wrong hands, you'll want your data protected with strong encryption. Ideally, it should meet the AES-256 standard, which is the strongest commercially available algorithm.

3. Role-based administration divides up management responsibility to ensure that no single administrator can compromise security of the system. For example, a system administrator can configure the network parameters and add users; a security officer can set security policies and encryption rules. These controls ensure that only select individuals have access to important security elements, such as encryption keys.

4. Finally, audit logging maintains a record of security operations and violations. An audit log must be protected from alteration to ensure a rogue administrator cannot remove entries. It should also record all system changes by administrators to ensure that malicious changes can be tied back to a specific user.

Operational considerations for data-at-rest security

The operational impact should also be considered when implementing a storage security solution. Important areas to evaluate include: initial deployment, performance/availability impact, and data recovery process.

Integration into an existing environment requires detailed planning to minimize the operational impact. Ideally, the solution should require minimal to no changes at all to the server and/or applications. Deploying an encryption solution requires that existing data is encrypted; for disk data this process can be performed transparently without impacting online operations.

Meeting availability and performance service levels are one of the biggest concerns of customers deploying storage security solutions. An effective solution integrates with the existing infrastructure and supports a redundant design to eliminate single points of failure. Performance considerations should be taken into account: primary storage, or disk encryption, requires low latency and wire-speed throughput; secondary storage, or tape encryption, will require compression and wire-speed throughput to meet backup windows.

Data recovery plans are required to provide either local or remote recovery of information, including the access of encrypted data at disaster recovery sites. Best practices should allow automated and secure sharing of media and keys between data centers, one-step disaster recovery of keys, and secure sharing of encrypted media with business partners.

Summary

As banks, credit unions and companies strive to meet PCI standards, they must tackle the complex issue of protecting data-at-rest through encryption, selecting solutions that are designed for the distributed, growing enterprise, provide the most efficient management of encryption keys, and introduce the least amount of operation disruption.

NeoScale Systems, Inc. is an independent storage security company, whose solutions have been certified by leading storage vendors and deployed worldwide within government, financial services, healthcare and other organizations.

www.neoscale.com

by Dore Rosenblum, VP Marketing, NeoScale Systems