The First International Cryptographic Module Conference
September 24-26, Gaithersburg, MD
Bringing experts together from around the world to confer on the topic of cryptographic modules.
Conference Website
Payment Card Industry Compliance For Large Computing Systems
Applying Payment Card Industry Compliance Standards to Mainframe Environments
Payment Card Industry Compliance For Large Computing Systems White Paper
Abstract
Payment Card Industry Compliance for Large Computing Systems, by atsec in association with IBM and other leading Large Computing Systems (LCS) experts, is a report aimed at addressing the need for guidance and information by Qualified Security Assessors (QSA), merchants, and service providers whose card holder data environment is largely based on LCS technology. It may also be of interest to acquirers and card brands demanding compliance with the standards specified by the Card Brands.
Achieving and assessing Payment Card Industry (PCI) compliance in a LCS environment can be a challenge as the standards are more focused towards a distributed systems paradigm. A full understanding of the security features and advantages of the complex environment can provide assurance of compliance to the standard but is a very broad and detailed topic.
Drawing from an extensive knowledge of mainframe and LCS security coupled with experience as an accredited QSA company, atsec's consultants have gained a thorough understanding of the security of these systems at every level, including operating systems, virtualization technology, applications, networking and communication, and mainframe environments. This experience has been gained through Common Criteria evaluation for the US and Europe governments, cryptographic testing and analysis, and mainframe penetration testing for large financial customers on the following systems and applications:
- z/OS
- z/VM
- PR/SM
- System SSL
- DB2
- Multiple Tivoli and third party vendor applications
atsec presents an analysis of the PCI standards in the context of a LCS environment and provides focused guidance to QSAs and their customers on the PCI assessment of such environments and the resources available to support an assessment. Drawing from an extensive knowledge of mainframe and LCS security, coupled with experience as an accredited QSA company, this report provides the necessary insight into LCS security to QSA and other PCI professionals.
