Protecting cardholder data

Note: For a deeper dive into the HyTrust Appliance capabilities and how they map to PCI-DSS requirements, please download our PCI whitepaper from the HyTrust Resources page.

PCI compliance represents unchartered territory for virtualized environments, and vice versa. Over time, however, as auditors and merchants become more familiar with the terrain (and the PCI Virtualization Special Interest Group releases its findings) more organizations will increasingly virtualize more of their PCI-compliant infrastructure. Given the high return on investment from virtualization, this is inevitable. In the meantime, merchants and auditors should focus attention on the key capabilities provided by virtualization and the implication of data security in the context of those capabilities.

Virtualized servers/network devices/security devices/storage, no longer tied to hardware or physically locked down in a datacenter, can now be reconfigured, relocated, and duplicated by remote administrators with privileged access. Starting, stopping, configuring, relocating, and "snapshotting" virtual machines can be executed via remote access. These capabilities combined with poor access control create a significant risk. Hypervisor logs geared toward software maintenance and troubleshooting are obviously useful, but not in the context of a compliance audit.

HyTrust Appliance provides a key to unlocking the power of virtualization in regulated environments or PCI-compliant infrastructure. HyTrust systematically addresses the three broad areas of IT control objectives (access and user administration, change and configuration, and operations), by providing a network-based virtual infrastructure policy enforcement solution. Through a unified console, HyTrust Appliance provides administrative access control, enforcement of policy across virtual infrastructure, hypervisor hardening, and audit-quality logging.