Prime Factors Newsletters

Alex Lee’s IT staff needed to encrypt a large amount of historical cardholder data, and attempted to do it with hardware devices. The Host Security Modules (HSMs) couldn’t encrypt data fast enough. Alex Lee’s mainframes are only available for three hours each day to send cardholder data to the HSMs for encryption.

“It was going to take us several weeks just to encrypt historical cardholder data,” said Janice Sakkal, Programmer/Analyst. Alex Lee also is required to encrypt cardholder data on a daily basis.

The short, three-hour window for encrypting cardholder data, and a deadline to get it done by December 31, 2007, forced Alex Lee to look for an alternative data security solution. Alex Lee contacted another grocery store chain, which recommended the STK Toolkit, a high-performance, low-cost software encryption solution from Prime Factors.

Read the full Press Release.

Evan Schuman’s blog – Storefront Backtalk – has more news about PCI than any source we’ve come across. Read his blog to stay on top of PCI news and trends. Go to his blog and search on “PCI” to learn everything you need to know retailers’ past struggles to become PCI compliant.

Schuman is a veteran reporter who covers technology and retail. Here’s a sample of his latest posting about the Hannaford data breach:

Hannaford CIO Bill Homa, overseeing a data breach probe that exposed some 4.2 million payment cards, said this week that his grocery chain needs to go well beyond PCI to try and be secure, an effort he predicted would cost his department millions of dollars “but not tens of millions.”

Homa called a news conference to detail some of those planned security improvements, including Triple DES PIN encryption (“customer card information is now encrypted from the PINpad at the store register and remains encrypted while it’s in our own internal network”), host and network intrusion prevention systems (“to proactively prevent malware from being installed in our systems”) and better payment segmentation. Read more about the Hannaford story.

Many products come with the basic cryptography functions as defined by standards committees, but with little thought on how you will manage your cryptographic needs. For example, when you suddenly realize you’ve been hacked and you need to know when this started and what accounts are affected, what do you do if your product doesn’t have an audit log?

With the proliferation of attacks on corporate data and the cost in detection, cleanup, public relations and patchwork solutions, you need to consider your cryptographic software purchases carefully.

Here are some things to look for in a good product.

• Key management. Does the product automatically keep a history of key values? And if so, can you easily use current and previous keys? It can be important to easily be able to use previous keys for stored data that you have encrypted. Since you should change keys periodically, you don’t want to be forced to re-encrypt all your data every time you change a key value.


• Audit Log. If you have to determine what account numbers have been compromised, and when it started happening, you better have an audit log that allows you to track this information. Of course the audit log itself must be secure so a perpetrator can’t easily cover their tracks.


• Data Authorities. Does the product allow you to limit who can access and update your encrypted data? Typical computer authorities only extend to the file, but users vary in the amount of authority you want them to have for each field of data. For example, you may want to allow only certain people to see account numbers, and the rest to just see the last four digits of the account number.


• Requirement Changes. After your applications have been written and are in production, how easy is it to change when you suddenly find out that you must protect additional information? Most security products rely on all the security decisions to be made within your applications. For example, what to encrypt, what algorithms and/or keys to use, who can encrypt and decrypt data. If these decisions are not hard coded in your application software, then you can be much more responsive to future changes.

With the new release of version 4.50 of Psypher, the destructive key operations, such as REPLACE, REVOKE, and DELETE, have been enhanced to clearly display their consequences as well as which keys will be affected. Support has also been added to allow expired PKI keys to be able to verify signatures or decrypt data signed or encrypted before the keys expired.

Certificate Authority handling has been improved to allow for more efficient management of CA-signed keys. When a CA key is replaced or generated, you can quickly update all your existing CA-signed keys to be signed by the new CA key. This can be a real time saver if your key list is large.

The PsypherOPS module added robust PGP keyserver support, allowing remote retrieval of PGP keys from public keyservers. System administrators can also optionally specify a corporate decryption key if their security policies require them to be able to decrypt all data secured by their organization.

Lastly, zOS administrators can now opt to use RACF user authentication for all Psypher Security Suite modules instead of user names and passwords on mainframes.

Read about the Psypher Security Suite products.

Do you have a concern about the security you are currently using in your business practices? Do you need to add encryption to an existing project? Do you need PCI DSS compliance? Do you want to issue contactless credit cards? Have you added international EDI partners? Do you want to issue gift cards for a retail store? If you are searching for a solution, read our Headlines to identify the Prime Factors product that fills your need.

Do you wonder if your security vendor is staying abreast of your industry’s security requirements? If your vendor is Prime Factors, then you can read about development strategies and future plans to enhance the excellent protection we are already providing you on our web site. Follow the Headlines link from our home page to read featured articles of specific interest to you. The Headlines change so stop by our web site regularly to read what is new.

Read the Headlines.