Payment Card Industry Compliance for Large Computing Systems: Applying PCI Compliance Standards to Mainframe Environments

Attendees at RSA and Share conferences in March may be interested in a new report from atsec targeted at those working with PCI compliance in Large Computer System environments.

"Payment Card Industry Compliance for Large Computing Systems: Applying PCI Compliance Standards to Mainframe Environments."

Abstract:
Payment Card Industry Compliance for Large Computing Systems, by atsec in association with IBM and other leading Large Computing Systems (LCS) experts, is a report aimed at addressing the need for guidance and information by Qualified Security Assessors (QSA), merchants, and service providers whose card holder data environment is largely based on LCS technology. It may also be of interest to acquirers and card brands demanding compliance with the standards.
Achieving and assessing Payment Card Industry (PCI) compliance in a LCS environment is a challenge as the standards are more focused towards a distributed systems paradigm. A full understanding of the security features and advantages of the complex environment can provide assurance of conformance to the standard but is a very broad and detailed topic.

Drawing from an extensive knowledge of mainframe and LCS security coupled with experience as an accredited QSA company, atsec’s consultants have gained a thorough understanding of the security of these systems at every level, including operating systems, virtualization technology, applications, networking and communication, and mainframe environments. This experience has been gained through Common Criteria evaluation for the US and Europe governments, cryptographic testing and analysis, and mainframe penetration testing for large financial customers on the following systems and applications:

• z/OS
• z/VM
• PR/SM
• System SSL
• DB2
• Oracle
• Multiple Tivoli and third party vendor applications

atsec presents an analysis of the PCI standards in the context of a LCS environment and provides focused guidance to QSA and their customers on the PCI assessment of such environments and the resources available to support an assessment. Drawing from an extensive knowledge of mainframe and LCS security, coupled with experience as an accredited QSA company, this report provides the necessary insight into LCS security to QSA and other PCI professionals.