atsec Publishes "Payment Card Industry Compliance For Large Computing Systems" White Paper, Examining the Application of Payment Card Industry Compliance Standards in Mainframe Environments
2010-03-08Austin, TX - atsec information security is proud to announce the publication the "Payment Card Industry Compliance For Large Computing Systems” white paper. The paper was created by mainframe and PCI experts from atsec and IBM and is now available as a PDF document on atsec’s website at:
http://www.atsec.com/us/pci-lcs.html
atsec is accredited as a Qualified Security Assessor (QSA) by the Payment Card Industry (PCI) Security Standards Council and has a deep understanding of Large Computing Systems (LCS) through many years of evaluating and testing z Series systems against standards such as Common Criteria and FIPS 140-2. This type of evaluation and test requires a thorough, in-depth analysis of the involved security functionality. In addition, atsec performs penetration testing of LCS for customers in the financial industry.
Abstract:
“Payment Card Industry Compliance for Large Computing Systems,” written by atsec in association with IBM and other leading Large Computing Systems (LCS) experts, is aimed at addressing the need for guidance and information by QSAs, merchants, and service providers whose cardholder data environment is largely based on LCS technology. It may also be of interest to acquirers and card brands that are demanding compliance with specific standards.
Achieving and assessing PCI compliance in a LCS environment can be challenging because the standards are focused towards a distributed systems paradigm. A full understanding of the security features and advantages of this complex environment can provide assurance of compliance to the standard, but it is a very broad and detailed topic.
Drawing from their extensive knowledge of mainframe and LCS security, as well as their experience working for an accredited QSA, atsec’s consultants have a thorough understanding of the security functionality of these systems at every level, including operating systems, virtualization technology, applications, networking and communication, and mainframe environments. This understanding has been gained through experience performing Common Criteria evaluation for the US and Europe governments, cryptographic testing and analysis, and mainframe penetration testing for large financial customers on the following systems and applications:
- z/OS
- z/VM
- PR/SM
- System SSL
- DB2
- Multiple Tivoli and third party vendor applications
In “Payment Card Industry Compliance for Large Computing Systems,” atsec presents an analysis of the PCI standards in the context of a LCS environment and provides focused guidance to QSAs and their customers on the PCI assessment of such environments and the resources available to support an assessment. The authors have an extensive knowledge of mainframe and LCS security, coupled with experience as an accredited QSA, and in this whitepaper, provide the necessary insight into LCS security for QSAs and other PCI professionals.
Please contact us at info@atsec.com if you have questions or comments.
About atsec information security
atsec information security is an independent, standards-based information technology security services company that combines a business-oriented approach to information security with in-depth technical knowledge and global experience. atsec was founded in Munich (Germany) in 2000 and has extensive international operations with offices in the U.S., Germany, Sweden and China.
atsec offers evaluation and testing services leading to formal certification for IT security including evaluation under Common Criteria schemes in the U.S., Germany, and Sweden; cryptographic module and algorithm testing under the Cryptographic Module Validation Program of the National Institute of Standards and Technology (NIST) in the U.S. and Communications Security Establishment Canada (CSEC) in Canada; and compliance validation to the Payment Card Industry (PCI) Data Security Standard.
atsec also offers secure code review, ISO/IEC 27001 ISMS consulting, and penetration testing and scanning services.
atsec works with leading global companies such as IBM, Apple, Microsoft, Hewlett-Packard, Oracle, Cray, BMW, SGI, Vodafone, RWE, and Wincor-Nixdorf.