In The Zone

Retail outlets must ensure they are abiding by regulations

A delicate balance exists in the retail world as businesses try to ensure easy and seamless customer experiences while maintaining high security. This ranges from finalizing a transaction, down to information security controls and processes designed for data integrity. A business must ensure it is abiding by industry and government regulations as well as providing a secure and protected environment for the transfer and storage of personal customer data.

Achieving a reasonable state of security has been, for many, a difficult objective as application uptime often takes a front seat over other initiatives. However, when IT security needs are expressed in terms of meeting compliance requirements, such as the Payment Card Industry’s data security standard, executives and top-level business managers take notice.

Networks are complex entities, with many moving parts. Determining how to align security practices with other efforts to meet an organization’s needs appears to be a monstrous task. Auditing the setting of each knob and dial on every low-level network device may sound sensible, but such an approach is equivalent to assessing patterns in the bark of trees while ignoring the trees themselves and the forest altogether. Knowing what traffic is permitted and what must be blocked is necessary. But this is inherently an end-to-end question, not a device configuration question.

Compliance Objectives
There’s a clear advantage in converging the goals of all the various compliance objectives. It centers on scope. Anyone manually measuring compliance today will tend to reduce the scope of the project as much as possible. However, this point flips around if automation is applied. The more an organization can automate the management of firewall and router configurations, the more the objective shifts from small scope to unified scope. An organization also should test the whole regulated infrastructure regularly, from a single viewpoint of what is and what it not permitted.

The ideal target is a single set of tools and processes for compliance, evaluated against an infrastructure, with a specific set of rules outlining what is compliant. Reaching this ideal isn’t trivial, but in a world where compliance burdens are continuously increasing, it is a critical survival strategy to unify and automate this work as much as possible. The most successful organizations are well along this path, finding commonality across regulation sets, and applying fixed standards in a turn-key fashion. The contrast in efficiency is stark between these teams. For those in reactive mode, struggling to clear each different regulatory milestone is an isolated project.

As a company looks to better align its security practice with its assessment practice, it has to examine firewall rule sets. Some companies attempt a brute-force approach, building a database of every single rule in every firewall, identifying the owner of each line and re-approving every rule on a regular basis. While logical, such a practice is untenable, despite following the regulations.

People can’t reliably review thousands of complex firewall policy statements. Even if they could, it takes too long for the business to see its benefit. Instead, there’s a deeper issue in this device-by-device approach. Even if one could validate every rule in every firewall, the outcome would not lead to a better understanding of a company’s overall network defensive posture. The complexity of many networks is staggering, as they often include remote sites, each with their own firewalls and VPN equipment. The number of interactions required to ensure a network is operational is staggering.

A New Approach
Leading IT security managers are stepping back from the idea of auditing everything. Instead of managing every rule in every firewall within a database, a more reasonable approach involves managing groups or zones of activity. A company may break its network into a variety of groups, including Internet, extranet, customer database, ERP system and wireless areas. A matrix could represent each group and every legal type of traffic between the various areas in a zone-based, rather than rules-based, approach to security management.

It would be unwise to create a large matrix of dozens or hundreds of cells. To address PCI requirement No. 1, for example, the creation of a four-by-four matrix would work well (see diagram).

PCI-DSS requirement 1, allowable traffic by zones

A zone matrix provides a common language with which to communicate issues and exposures. It is critical that zone-to-zone relationships make sense to people within the organization who are not on the security team. Without that comprehension, necessary resources for getting security issues resolved will not be assigned.

The next step, after taming the complexity through zone management, is to automate the compliance assessment process by using a computer to analyze firewall and router configurations across the entire network. Through automation, security teams are finding forgotten severs attached to networks with access connections to other servers creating security holes. They are finding mistakes and omissions within router access or firewall rules that create problems.

The ability to scale and better manage a network to meet compliance requirements, as well as continually improve the company’s security posture within a complex, rapidly changing IT infrastructure is within reach. Through automation, security teams are regaining valuable time and increasing accuracy.

About the Author

Mike Lloyd is the chief scientist at RedSeal Systems Inc.

Featured

  • Maximizing Your Security Budget This Year

    7 Ways You Can Secure a High-Traffic Commercial Security Gate  

    Your commercial security gate is one of your most powerful tools to keep thieves off your property. Without a security gate, your commercial perimeter security plan is all for nothing. Read Now

  • Making Safety and Security Intrinsic to School Design

    Public anxieties about school safety are escalating across the country. According to a 2023 Gallup report, 44% of parents fear for their child’s physical safety at school, a 10 percentage-point increase since 2019. Unfortunately, these fears are likely to increase if the incidence of school tragedies continues to mount. As a result, school leaders are now charged with two non-negotiable responsibilities. The first, as always, is to ensure kids have what they need to learn, grow, and thrive. Sadly, their second responsibility is to keep the children in their care safe from threats and physical danger. Read Now

  • The Power of a Layered Approach to Safety

    In a perfect world, every school would have an unlimited budget to help secure their schools. In reality, schools must prioritize what budget they have while navigating the complexities surrounding school security and lockdown. Read Now

  • How a Security System Can Enhance Arena Safety and the Fan Experience

    Ensuring guests have both a memorable experience and a safe one is no small feat for your physical security team. Stadiums, ballparks, arenas, and other large event venues are increasingly leveraging new technologies to transform the fan experience and maintain a high level of security. The goal is to preserve the integrity and excitement of the event while enhancing security and remaining “behind the scenes.” Read Now

Featured Cybersecurity

Webinars

New Products

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles. 3

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation. 3

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening. 3