PCI Solution for Retail from Cisco Delivers Data Security
Payment Card Industry (PCI) requirements for secure transactions are addressed by Cisco solution architecture.
PCI standards were designed by the PCI Security Standards Council to protect retail customer privacy as well as critical payment card and merchant data. Compliance is not optional with this solution.
PCI Security Challenges and Risks
Meeting PCI security requirements is challenging. It requires retailers to perform a comprehensive audit of their networks, policies, and processes. Many retailers have found the requirements to be challenging to interpret, leaving them to translate and hope that they are creating systems that will help them achieve compliance.
Non-compliance with the PCI standard creates significant business risk. Retailers can be fined, incur increased processing charges, and even lose card processing privileges. Security breaches can damage a company's brand and lead to financial losses.
To address these challenges and risks, Cisco has developed the Cisco PCI Solution for Retail. Built on the Cisco Intelligent Retail Network (IRN), these recommended and audited architectures provide secure transport for point of sale (POS) traffic:
- Credit card data
- Cardholder information
- Transaction logs
- Database records
PCI Compliance: The Right Approach
According to industry experts, the best way to achieve and maintain compliance is through a strategic, holistic approach that encompasses improved operational efficiency through:
- Network infrastructure, policies, and procedures
- Centrally managed systems, network services, and security
- Accelerated delivery of future network-based applications
PCI Security Best Practices
In creating the Cisco PCI Solution for Retail, Cisco used its extensive experience in developing wired and wireless networking technologies. The result is best practices-based architectures that retailers of all sizes can use to deploy architectures that address PCI requirements:
These lab-tested architectures minimize infrastructure complexity and simplify integration with other retail solutions. The Cisco PCI Solution for Retail incorporates the following products and features:
- Secure routers: Cisco IOS® Software-based routers support wireless, voice, firewall, intrusion prevention, and traffic profiling applications as well as VPNs. They help to satisfy PCI requirements 1, 2, 4, 6, 10, 11, and 12.
- Adaptive security appliances: The Cisco ASA 5500 Series offers firewall, antiX, intrusion prevention, and VPN support. Integrated IP Security (IP Sec) and Secure Sockets Layer (SSL) VPN capabilities optimally encrypt data across public networks. They help to address PCI requirements 1, 2, 4, 6, 11, and 12.
- Cisco Security Agent: Cisco Security Agent protects against worm and dayzero attack while offering sophisticated protection against information theft from servers and clients. It helps to respond to PCI requirements 1, 2, 3, 5, 6, 7, 10, 11, and 12.
- Compliance Reporting and Management: The Cisco Secure Access Control Server, Cisco Security Manager, and Cisco Wireless ControlServer deliver centralized management, monitoring, and remediation. They help to address PCI requirements 10, 11, and 12.
- Network Admission Control (NAC): Determines which client devices are granted network access. Network Admission Control addresses PCI requirements 5, 6, 11, and 12.
Benefits that Support Retail Operations Every Day
Because the Cisco PCI Solution for Retail builds on the Cisco IRN foundation, retailers are able to:
- Protect Mobile Applications and Data: Retailers can address the PCI standard by implementing a Cisco Unified Wireless solution - protecting wired networks from wireless intrusion and securing private communications over authorized wireless LANs (WLANs). A Cisco IRN with Unified Wireless capabilities supports:
- Confidential communications
- User segmentation for effective access control
- Client device security strategies
- Create a Solid Foundation for Compliance: A Cisco Intelligent Retail Network (IRN) integrates advanced security capabilities that enable retailers to optimize the security of sensitive information and address the specific requirements of the PCI standard. It also supports a company's efforts to comply with future regulatory initiatives.
- Enhance Security and Risk Management: A Cisco IRN can strengthen a company's overall security posture through:
- Supporting and enforcing security best practices
- Helping protect brand image and assets
- Mitigate the risk of fine, penalties, and lost revenue
- Enable New Business Initiatives: Advanced network capabilities create a platform that enables retailers to respond to new opportunities - without network redesign. The same security capabilities that facilitate PCI compliance also permit new technology intiatives.
- Strengthen Shopping Security: Investing in the Cisco PCI solution for Retail is an investment in security best practices, whether for online or in-store shopping. It is also an investment in programs that enhance merchandising, improve the shopping experience and build brand loyalty.