Finally, a sensible security scheme | Tech News on ZDNet

Finally, a sensible security scheme | Tech News on ZDNet, and one that any enterprise could follow with a few simple changes. The basis for the article is the Visa Cardholder Information Security Program, which is designed to protected credit card information and transactions while being processed by merchants and card processing service providers. The Visa program has a number of tools, including a program description, a compliance audit procedure, training and list of certified consultants available to assist in meeting compliance requirements.

The most important tool for those that want to improve security in their own networks is the Security Audit Procedures and Reporting document (in pdf). At the high level the Visa program has 12 steps (taken directly from the web site):

1. Install and maintain a working firewall to protect data.
   
2. Keep security patches up-to-date.
3. Protect stored data.
4. Encrypt data sent across public networks.
5. Use and regularly update anti-virus software.
6. Restrict access according to "need to know" basis.
7. Assign unique ID to each person with computer access.
8. Don't use vendor-supplied defaults for passwords and security parameters.
9. Track all access to data by unique ID.
10. Regularly test security systems and processes.
11. Implement and maintain an information security policy.
12. Restrict physical access to data.

These are explained in detail in the Audit Procedure document, which sets out what should be implemented and how to verify compliance in a very easy and straight forward manner. The only change any enterprise needs to make is to replace the words "cardholder information" with whatever data is critical to their business. Visa developed this so that external partners had a security roadmap to follow. Note that it may be necessary to consult with Visa about using this, or a very similar program, as Visa holds the copyright. But at least the principle of giving external partners useful security guidance is of value.

Moreover, most enterprises would improve internal security if they followed these, or similar, guidelines themselves. Access to all business critical data is tracked by user, and all business critical data is encrypted while stored (at rest), and while in transit outside local area networks.

The reader should study the Audit Procedure document and work out what the elements of the security architecture are that are necessary to meet the requirements. There are obvious hardware and software elements. What resources are required to support the added complexities that face the knowledge worker, or the system administrator in this environment? Visa says that these are the requirements to do business with them, and there are significant financial penalties for failure to meet these requirements, even if the failure to meet these requirements does not result in a security incident and loss of information or money.

As much as I like these guidelines, I still feel there are critical elements that have not been addressed. Can you spot some of the weaknesses that would exist in an implementation of these guidelines? Next time I will revisit this with some suggestions for improvement.