The right medicine for compliance

Deklab Medical Centre has been dealing with regulatory compliance issues for years. The teaching hospital implemented content monitoring and data loss prevention software from Denver-based Vericept as part of its Health Insurance Portability and Accountability Act (HIPAA) compliance program in 2004 and now is reviewing its systems to ensure compliance with the Payment Card Industry Data Security Standard (PCI DSS).

New regulations and standards designed to lock down systems containing critical information are constantly coming to the forefront. But financial boards aren't necessarily giving IT pros like  information security administrator Sharon Finney a blank check to implement new security technologies.

"When I go to the audit and compliance committee or board of directors … I have to come up with something more than telling them that a regulation or standards say we need to do it," Finney said. "You need a plan and strategy to say here are the items that need to be addressed, here are how they impact us and show what is critical and what is an acceptable level of risk."

Companies that accept credit card transactions, including healthcare institutions are taking a standard approach to PCI DSS. But many are underestimating the costs associated with becoming compliant, according to a recent survey.

Conducted in June by the Boston-based Aberdeen Group, the survey helped highlight the route some companies are taking to become compliant. Aberdeen surveyed 125 organizations and analyzed those that they call best-in-class – firms that had reported PCI compliance, addressed six or more PCI DSS requirements and had no data security breaches in the last year.

The study found that in many cases companies are consistently underestimating the costs associated with compliance, said Derek E. Brink, vice president and research director at Aberdeen . Even the best-in-class organizations are underestimating the costs, he said.

"With respect to PCI compliance, in many cases it cost about 40% more than they estimated," Brink said.

Still, the survey found that the best approach is to start by understanding which systems hold sensitive credit card data and then performing an assessment to discover what data is most at risk.

Brink said that 63% of best-in-class organizations eliminated systems that stored sensitive authentication data, such as magnetic stripe data, PIN numbers and card validation values. Segmenting networks of systems to isolate credit card data was also cost effective for many companies, Brink said.

"If you cut off systems that don't process cardholder data from those that do, then the PCI DSS requirements only apply those that process the data," Brink said. "You cut off a big bunch of systems and reduce your scope. This was a big distinction between best-in-class and the industry average."

The study found that 68% of those best-in-class organizations used PCI DSS as a guide to improve protection of all sensitive business data, including credit card data. PCI projects typically lasted 12-18 months and began with a data flow diagram to determine which systems contained sensitive PCI data. Second, a risk and vulnerability assessment was undertaken on all system components in the cardholder data environment to determine which areas needed to be addressed.

Survey respondents said technology implementations began with encryption of cardholder data transmissions across open networks, with more than 89% year-over-year performance improvement. Encryption of stored cardholder data also was a priority followed by development secure systems and applications that handle cardholder data.

Experts say data encryption is an area where costs could add up. Software vendors are lining up to do business. Joe Sturonas, chief technology officer of PKWARE, which packages and encrypts sensitive data, said his company is seeing an increase in interest in the financial services industry. Banks, which do business with thousands of merchants are looking for a way to enable end users to encrypt transaction logs and other items that may contain sensitive data, Sturonas said.

Sturonas said that while PKWARE's container approach is unique, it uses the full-blown encryption technology required by PCI DSS.

"Even though you have a secure pipe to send data, the idea is that this data should have interoperability and should be protected once it lands through that pipe on the other side," Sturonas said.

Aberdeen is also projecting a rise in the number of qualified security assessors needed over the next 12 months. Companies are also seeking out scanning vendors, log analysis, auditing and reporting tools and application vulnerability scanners as part of their compliance initiatives.

Mike Rothman, president and principal analyst of Security Incite in Atlanta , said companies should stick to the basics when it comes to compliance rather than buying expensive technology. By developing a layered approach to security, compliance costs could be minimal, he said.

"It seems like there's a whole business around complicating all this stuff," Rothman said. "The reality is if you've got a strong security program and you documented your stuff and you are training your users and protecting the data that needs to be protected then you're going to be compliant."

For Finney of Dekalb Medical Center, who has more than 4,000 users on her network, including three cafeterias and restaurants that accept credit and debit cards, risk assessment is going to be essential to the security program

"The same tools we put in place for HIPAA also allow us to put in rules for PCI or other standards," Finney said. "Eventually we can choose to address issues with technology or insure against it or choose to accept it as an acceptable risk."