Having attended the annual North American PCI Community Meeting for many years and being involved with PCI compliance since 2008, I’ve heard firsthand the challenges merchants face in their quest for PCI compliance (see Blog: Compliance Headaches Continue). However, thinking back to the PCI Community Meeting last week in Orlando, I was intrigued by how this year’s keynote speaker fit into the program. How could an extreme adventurer, such as Jamie Clarke, rather than a hacker or data breach expert provide the necessary perspective on compliance? As I attended sessions and networked with over a thousand of my peers from 17 countries, it dawned on me: The collective PCI state of mind is reflective of the maturity of the journey and a fresh optimism emerges as we near the top of the mountain after a very long and arduous journey.
Here are some of the highlights from this year’s meeting.
PCI SSC General Manager Bob Russo presented the annual PCI State of the Industry. The PCI standards continue to mature and merchants are increasing the focus to protect cardholder data. The overall tone was more about ‘tweak’ than change.
The opportunity for training from the PCI Council continues to increase with several new programs including a Qualified Integrators and Resellers (QIR) program and a Payment Card Industry Professional (PCIP) certification.
The Special Interest Groups (SIGs) are going strong, which again speaks to the maturity of the standard. We are seeing ongoing clarity, rather than new initiatives. The SIGs leverage valuable business and technical experiences from PCI Participating Organizations (POs). Over 460 POs were in attendance. Our key candidates for the 2013 SIGs are Cardholder Data Discovery and Guidance on Logging. However, there are 7 candidates up for voting.
The security community at Cisco is very diverse. It extends beyond the typical researcher or analyst roles to include customer-facing engineers and marketing, public relations, and legal teams. The community is comprised of individuals with greatly varied backgrounds, skill sets, and charters and contains a wealth of knowledge on just about any topic. This diversity allows Cisco Security Intelligence Operations to understand and react appropriately to today’s threats as well as those that we may face in the future.
If we think about security intelligence—which I define as raw information enhanced through correlation, processing or perspective—having an established variety of inputs is key. Our people are certainly one of those inputs.
The trick, however, is utilizing that diversity in such a way that you can create consistent and predictable outputs that can be easily absorbed and acted on.
More and more, we ask technology to play critical roles in our businesses, and our lives. Pondering that for a moment, that dependance (versus use), requires careful thought on how much we trust that the technology is working as we want it, only as we want it, and nothing more. For many businesses or governments, testing via FIPS or Common Criteria increases that confidence level, combined with detailed operational plans to ensure running the services after they are installed is going correctly. For many technology vendors, innovation and commitment, can help here.
Our commitment at Cisco, and our innovation, for trustworthiness have never been stronger than they are today. Nearly 5 years ago, we started down a road which ultimately led to Cisco’s Secure Development Lifecycle (CSDL), and in our most recent FY12 SEC 10-K, acknowledged that work, our secure supply chain work, and our innovation efforts for Secure Boot and Anti-Tamper. For reference, that 10K, or 2012 Annual Report, is posted here: http://investor.cisco.com/
We foresaw the need for trustworthiness by listening to our customers, and we started early. Early results are in, and we’ve both reduced externally found security flaws, as well as increased the resiliency for multiple products anti-tamper. Have we done it on every product? Not yet, although rest assured, that’s exactly where we are going. I’ll keep you posted.
Following up on our Data Center launch on Sept. 12, there have been significant enhancements to Cisco AnyConnect Secure Mobility Solution, the industry recognized SSL/VPN solution. With a track record of leading the traditional VPN market, Cisco hit market milestones in the past with built-in features to the AnyConnect Secure Mobility Client, such as network access manager that offers administrators the ability to control which network end points are able to connect to and other built-in modules that enable web security either through the on-premises Cisco Web Security Appliance (WSA) or the cloud-based Cisco Cloud Web Security offering.
Now, with AnyConnect Secure Mobility Client 3.1, Cisco continues to help enterprise customers with their business transformation needs (ie-BYOD) securely. As long as ‘consumerization of IT’ continues to gain inroads into the corporate network, IT professionals will seek investments in tools that will help support their attitude change from mandate to choice. Having a mobile DNA has been a significant attribute for Cisco as AnyConnect continues to support one of the broadest OS (desktop and mobile) and browser portfolios in the market today.
We chatted with Waheed Choudhry, President and COO, and Mike Zozaya, Practice Manager of Security, Mobility, and Infrastructure at Nexus to get some insights on what their customers are trying to achieve in the data center and how Cisco Security is helping them get there.