This week at the Gartner Data Center Conference in Las Vegas, Cisco Services is unveiling Cisco Domain Ten(SM) – Cisco’s Framework for Simplifying Data Center and Cloud Transformation.
Cisco Domain Ten can be applied to a diverse range of data center projects -- from cloud and desktop virtualization to application migration and is equally applicable whether your data center is in enterprise businesses, public sector organizations or service providers. The video here describes how we apply the Cisco Domain Ten to the private cloud use case, as one example. We’ll discuss additional use cases in future blogs and associated collateral that I’ll point you to.
Born from our extensive experience over the past years in helping customers transform their data centers, based upon the many cloud deployments -- private and public, enterprise, public sector and service provider -- that we’ve enabled over the past few years, we’ve formulated this comprehensive framework to help you transform your data center and guide new initiatives including cloud, virtual desktop, application migration, and data center consolidation. The Cisco Domain Ten framework covers ten key areas -- domains -- that -- based upon our experience -- are critical to consider, plan for and address as part of your data center and cloud transformational journey, and is illustrated in the diagram below. Relating this framework to other key components of Cisco’s data center strategy, you can think of the Cisco Unified Data Center as the what of the data center, whereas Cisco Domain Ten complements this by guiding you on the how (to transform).
Cisco Domain Ten - Simplifying Data Center Transformation
Payment Card Industry (PCI) compliance can often be overwhelming for all enterprises, let alone small and medium businesses (SMBs). Given limited budgets and IT resources, SMBs face an even greater challenge than large enterprises.
The PCI Data Security Standard (DSS) 2.0 is complex on several levels:
It requires expertise on a range of network systems and security technologies.
It requires continual monitoring and management of access to cardholder data.
There is no “silver bullet” technology that can address a growing list of detailed standards and requirements. Technologies such as encryption, tokenization, as well as Europay, MasterCard, and Visa (EMV) smartcards address portions of your infrastructure, but none provide a single compliance solution.
It’s dynamic and requires ongoing diligence. Being compliant at the time of your audit is a snapshot in time that requires simplified maintenance.
These requirements take time, effort and funding, which are all in short supply in SMBs.
Help is at hand. Cisco and many of its partners offer cost-effective PCI compliance services--including assistance for SMBs as they complete their self-assessment questionnaire or assess PCI readiness. In a recent article authored by Cisco and partners Verizon Business and Presidio, we examine ways to simplify compliance for small and medium businesses. Learn the 5 key strategies to securing your customer information while incorporating security best practices from Aaron Renolds, QSA and Principal Consultant at Verizon Enterprise Solutions and Sean Wallis, Senior Security Consultant at Presidio Networked Solutions.
Advice to Managers: Five Ways to Simplify Your PCI 2.0 Compliance:
Staffing Cisco’s Compliance Solution demonstration a few weeks ago at Cisco Live 2012, I was beckoning passersby to test their knowledge of the Payment Card Industry (PCI) Data Security Standard (DSS) 2.0. Some attendees shook their head and walked (ran) the other way. Of the brave souls who ventured over to demonstrate their PCI knowledge, most spoke of the difficulties and challenges of dealing with not only PCI, but other mandates as well, such as HIPAA, FISMA and SOX. Attendees came from different industries such as Retail, Healthcare, Financial Services and Education, many of whom shared the same challenges with approach, best practices and the cost of compliance. Surprisingly, some were just beginning their journey, starting at ground zero, and were seeking guidance on how to meet the CIO’s “get compliant” edict with a balancing act between IT and Finance. Other customers were seeking guidance on specific product features that could address areas of management and reporting.
At a Table Topics session during the same event, other challenges around scoping, segmentation and wireless networks were discussed. Today, one of the challenges that merchants still face is with auditor inconsistency. This is an area that the PCI council is working hard to address by implementing training and best practices programs for QSA’s. To add fuel to the fire, in a recent QSA Insights Report, the cost of annual audits averages $225,000 per year for the largest merchants. Excluding technology, operating, and staff costs, the world’s largest acceptors of credit cards (also known as Tier 1 merchants) are spending an average of $225,000 on auditor expenses. 10 percent of these businesses are spending $500,000 or more annually on PCI auditors. The full PCI DSS is available for download at:
On June 6-7, the National Institute of Standards and Technology (NIST) co-hosted a conference focused on HIPAA, the foundational U.S. health care information law. I attended the conference and came away with the sense that a) health care entities have begun to see clarity in the things they must do from an IT perspective to abide by the law’s requirement to protect patient information and b) they are motivated to do so through Federal moves to enforce the law.
The links between vague laws and concrete technical requirements to support them are usually ambiguous because the laws are written by non-technical lawyers and they often turn over implementation details to government departments.
Share your knowledge by taking the 5-minute Cisco Regulatory and Industry Compliance Survey
Greetings from Cisco’s Compliance Solutions team!
Over the past several years, we have developed an architectural approach to achieving and maintaining regulatory and industry compliance. Our latest work provides – in great detail – both a framework for achieving PCI DSS compliance and recommendations about how to make your Cisco-based network PCI compliant.
To address the topic with authority, we integrated Cisco and technology partner products together into a comprehensive solution based on foundational Cisco architectures, had a QSA auditor – Verizon Business – assess it for PCI DSS 2.0 compliance, and documented the results in a publicly-available Design and Implementation Guide which can be found here: www.cisco.com/go/pci
Our team’s broader vision is to enable Cisco customers to manage risk by achieving and maintaining compliance with a broad range of regulatory and industry mandates. We believe that
Your challenges around compliance are growing and that you are looking for sound guidance as you work to achieve and maintain compliance with multiple mandates;
The value we deliver starts with a thoughtfully-developed architectural framework but also includes a broad array of Cisco and partner technology that has been tested and assessed by third party auditors;
Integrated and proven compliance solutions will give you confidence in Cisco’s ability to act as the foundation for achieving and maintaining compliance.
Looking forward, we plan to engage in conversations with our readers. You will hear from the team regularly on a variety of topics and we’ll ask about your views as they relate to compliance. Your thoughtful responses will help guide our future work.