Trend Micro Solutions for PCI DSS Compliance

1 Trend Micro Solutions for PCI DSS Compliance A Trend Micro White Paper Addressing PCI DSS. Requirements with Trend Micro Enterprise Security July 2010. Trend Micro Solutions FOR PCI DSS Compliance . I. PCI DSS AND Trend Micro ENTERPRISE SECURITY. Targeted threats, distributed environments, and evolving technology make it especially challenging to achieve and maintain Compliance with the Payment Card Industry Data Security Standard (PCI DSS). Yet Compliance alone is not enough to minimize the true risk to your enterprise. Trend Micro goes beyond addressing fundamental PCI requirements and offers practical Solutions to truly safeguard your business infrastructure against the compromise of cardholder data. Trend Micro Enterprise Security is a tightly integrated offering of content security products, services and Solutions powered by the Trend Micro Smart Protection Network.

2 Together they deliver immediate protection from emerging threats while greatly reducing the cost and complexity of security management. Trend Micro Enterprise Security Solutions offer direct mappings or compensating controls in the following PCI requirement areas: Trend Micro Enterprise Solutions PCI Requirement Area Vulnerability Endpoint Web Messaging and Threat Security Security Security Management 1. Install and maintain a firewall Build & configuration z z z Maintain a to protect cardholder data Secure 2. Do not use vendor supplied Network defaults (shared hosting z z z providers). Protect 3. Protect stored cardholder data z z Cardholder Data 4. Encrypt transmission of cardholder data across open, public networks z z 5. Use and regularly update antivirus Maintain a software or programs z z z z Vulnerability Protection 6. Develop and maintain secure Program systems and applications z z z Implement 7.

3 Restrict access to data Strong 8. Assign unique IDs Access Measures 9. Restrict physical data access and monitor all access to Regularly network resources and cardholder z z Monitor and data Test test security systems Networks and processes z z z Maintain an a policy that addresses Information Security information security for employees z z z z and contractors Policy PCI Requirements: Direct Mappings or Compensating Controls 1 White Paper | Solutions for PCI DSS Compliance Trend Micro Solutions FOR PCI DSS Compliance . II. TODAY'S TOP PCI CONCERNS. Achieving and maintaining PCI Compliance and true security requires constant evaluation of the potential impact of evolving threats, employee behavior, and new business and technology initiatives. Trend Micro offers you unique and cost-effective Solutions to address today's top PCI challenges. Business or Technology PCI Challenge Trend Micro Solution Driver Virtualization Virtualization allows for cost efficient Trend Micro Deep Security provides advanced and flexible datacenters and paves a software-based security that protects physical, path toward integrated cloud virtual and cloud-based servers with integrated IPS, computing.

4 But the complexity and firewall, configuration validation and more. Trend fluidity of virtual environments pose Micro Core Protection for Virtual Machines is special challenges, rendering designed specifically to meet the unique needs of traditional network security the virtual environment with automated protection implementations for IPS, firewalls, against malware. Trend Micro OfficeScan provides and antivirus ineffective in preventing virtual desktop protection designed to maximize attacks on virtual servers or desktops performance and capacity. that process or host cardholder data. Effective Data Traditional data loss prevention and Trend Micro Data Protection Solutions protect and Protection data encryption Solutions are encrypt PAN data wherever it resides and enable complex and cumbersome to secure collaboration without end-user actions or manage and use.

5 Usability limitations. Worker Mobile laptops and PDAs are at risk Trend Micro OfficeScan endpoint protection and web Mobility for inbound attacks and cardholder reputation technology keep your employee devices data loss, but network security protected from malware both on and off the Solutions are ineffective in these corporate network. cases. IT Risk Reliably automating the discovery Trend Micro Vulnerability and Threat Management Management and rapid mitigation of vulnerabilities Solutions give you total risk visibility and remediation and evasive threats is critical to control over active evasive threats, software and Compliance and your risk posture. systems vulnerabilities, web content, and IT policy Even the best vulnerability and Compliance . security defenses can be penetrated Trend Micro Deep Security and OfficeScan deliver by zero-day and targeted threats.

6 Protection from zero-day threats and enable virtual patching to establish immediate protection for un-patched' or un-patchable' systems. Controlling According to Information Week, Trend Micro Enterprise Security and Smart Cost and management complexity is the Protection Network change the game by greatly Complexity number one issue in security. With simplifying security management and reducing distributed environments, multiple resource requirements. We offer the breadth of point products and constant security Solutions including Software As A Service (SaaS). signature updates, the cost and and virtualized appliances that will allow you to complexity of PCI Compliance and reduce vendors, consolidate security and systems secure operations is skyrocketing. management, and cost effectively secure corporate and branch/POS (Point of Sale) environments. Setting Your Achieving full PCI Compliance is Trend Micro OfficeScan, Deep Security, and Budget difficult and costly.

7 The PCI Council Messaging Security products each address many of Priorities has issued a 6-step prioritized the top-tier priorities cited by the PCI Council. approach whitepaper which offers guidance on a risk-based prioritized Compliance roadmap. 2 White Paper | Solutions for PCI DSS Compliance Trend Micro Solutions FOR PCI DSS Compliance . PCI Challenge III. ADDRESSING PCI Compliance WITH Trend Micro . PCI Compliance is not a guarantee of ENTERPRISE SECURITY. security. How can I best insure that Trend Micro Enterprise Security is a tightly integrated offering of content our customer data is secure from security products, services and Solutions powered by the Trend Micro Smart outside attack? Protection Network. Trend Micro enables you to go beyond addressing Trend Micro Solution fundamental PCI requirements with practical Solutions that truly safeguard Malware is now an essential component your business infrastructure against the compromise of cardholder data.

8 Of nearly all large-scale data breach These products protect distributed physical/, virtual, and cloud-based scenarios. Trend Micro offers you a environments; support a wide array of platforms and operating systems; and layered content security approach that: offer a full range of deployment options including hosted, software, and Protects your employees from importing virtual appliance. threats; protects your resources from zero-day threats and sophisticated direct attacks; and directly protects your Trend Micro Enterprise Security cardholder data from compromise Endpoint Security Web Security PC, Server, Mobile Device Security Web Gateway Security Data Loss Prevention & Encryption Website Security Unified Security & Systems Management PCI Compliance Messaging Security for Small & Medium Businesses Email Gateway Security Operating Environments Mail & Collaboration Trend Micro all-in-one Worry-Free.

9 Physical/Virtual/Cloud Computing Server Security Broad Platform/OS Support Encryption & Archiving Business Suite Vulnerability Flexible Deployment Options Management Services offer an endpoint, web and messaging security Solutions & Services Security Management Data Protection solution that helps small and medium Centralized Security Dynamic Data Center Management Regulatory Compliance business comply with many of the Unified Endpoint Security & Threat Management Services Systems Management Premium Support Service & more PCI requirements. Protecting Enterprise Data and Resources IV. PCI Compliance WITH Trend Micro SMART PROTECTION NETWORK. Trend Micro Enterprise Security products and services are powered by Trend Micro Smart Protection Network a next-generation cloud-client infrastructure that combines sophisticated reputation-based technology, feedback loops, and the expertise of Trend Labs researchers to deliver real-time protection from emerging threats.

10 The Smart Protection Network threat intelligence serves as a compensating control to address the following PCI DSS Requirements: Req. ( address all known security vulnerabilities as related to system configurations), with current and comprehensive vulnerability and threat research 3 White Paper | Solutions for PCI DSS Compliance Trend Micro Solutions FOR PCI DSS Compliance . Req. (Ensure that all antivirus mechanisms are current), with PCI Challenge current and accurate intelligence on malware including viruses, A new malware threat is created spyware, and data-stealing malware every 2 seconds. Signature-based Req. (Establish a process to identify newly discovered security security leaves a window of new threat vulnerabilities ), with automated tools to identify new vulnerabilities and free, public alerts on emerging threats via TrendWatch Threat vulnerability that can vary from hours Resource Center to days depending on when systems Req.