compliance

PCI-DSS

Payment Card Industry Data Security Standard (PCI-DSS) is a high priority activity and has been widely adopted for enterprise IT organizations for compliance. Considerable amount of money and resources have been invested on these compliance projects.  However, low efficiency of investment, particularly on access and audit areas, becomes the new pain on the journey.

Listed below are the PCI-DSS Requirement 10.2:

10.2 Implement automated audit trails for all system components to reconstruct the following events:
10.2.1 All individual accesses to cardholder data
10.2.2 All actions taken by any individual with root or administrative privileges
10.2.3 Access to all audit trails
10.2.4 Invalid logical access attempts
10.2 5 Use of identification and authentication mechanisms
10.2.6 Initialization of the audit logs
10.2.7 Creation and deletion of system-level objects

Because of the distributed characteristic of cardholder data and audit trails, it is difficult to ensure that all access have been recorded and can be reconstructed and replayed when needed. Session Auditor is an ideal solution to enable record and replay of the above mentioned activities to meet the PCS-DSS requirements.

Sarbanes Oxley Act

USA SEC public listed companies must meet the compliance requirements from Sarbanes Oxley Act, which mandate that these companies must have a complete and integrated internal control system.

Session Auditor enables this by recording and replaying the operations and network behavior pertaining to confidential and sensitive financial data. These recorded data are critical first hand evidences for auditors during their investigation in the event of fraud.

ISO27001/ISO17799

In ISO27001, A15.1.3, it is a requirement to protect and record the organization’s operating records. In A15.2.1, it is a requirement that IT managers must ensure that all security procedures and policies are implemented correctly and that it comply to the requirements as set by security policies and standards.

Session Auditor can be deployed at critical network segments to record the network operations to database and protected applications.