Ground Labs | Audit payment card storage for PCI Compliance

Find sensitive data before someone else does.

Enterprise Recon

A centralised Payment Card Industry (PCI) management platform for identifying non-compliant storage of sensitive Card Holder Data (CHD)

Card Recon Enterprise Edition (CREE) is an advanced auditing framework to centrally identify systems which are storing sensitive Card Holder Data in a manner that is not compliant with PCI standards. CREE delivers organizations the benefit of lower compliance costs by reducing the effort required to maintain PCI compliance.

With an ability to centrally initiate payment card storage audits and produce accurate compliance reports, Card Recon Enterprise Edition is the most advanced solution available for auditing of stored payment card information.

Product Highlights

Unrivaled payment card detection capabilities – Card Recon is an advanced scanning engine that implements intelligent pattern matching algorithms to interpret and verify findings within a wide variety of data types including documents, emails and other data storage files. Card Recon offers the highest data match rate available whilst eliminating more than 99% of false positives.

Enterprise compatibility and scale – Whilst offering support for all modern versions of Windows and Linux, CREE nodes includes specialist node support for enterprise platforms including HP-UX (IA64/PA-RISC), Solaris (x86/SPARC) and AIX (pSeries).

Low network impact client-server design - CREE has been designed to include support for remote site deployments that are connected using low-bandwidth networks. CREE is not dependent on network file shares or over-the-wire scanning techniques.

Highly efficient to ensure end-users remain productive – CREE node deployments require low system resources to conduct a scan. Throughout a scan users can continue to work without experiencing noticeable disruption or delay due to the Card Recon scanning engine efficiently allocating CPU, memory, and disk resources.

Developed in partnership with qualified PCI DSS QSAs – The underlying technology has been developed specifically for facilitating compliance of Card Holder Data storage and practices. Ground Labs utilized an extensive industry consultation program as part of the development process, involving practicing PCI DSS and information security professionals to ensure comprehensive and relevant functionality.

Features and Benefits

Lower the cost of maintaining PCI compliance

No longer are IT resources expended on performing time consuming manual audits for PCI non-compliant storage on a system by system basis. Card Recon Enterprise Edition provides a centralized management console to initiate scans for stored payment card data combined with consolidated reporting in a single view. Other features that further reduce reliance on personnel based resources include:

Rapid Deployment - All hosts across an organization can be enabled for auditing manual installation practices being used. Card Recon Enterprise Edition Nodes support the use of standard remote software deployment techniques such as group policy and SCCM.
Centralized Control - Once nodes are deployed and connected with the Card Recon Master Server, an Administrative user has complete control to initiate host scans on an individual or on a grouped basis.
Consolidated Reporting - Offers the ability to generate a master compliance report quickly and effectively once all non-compliant findings have been resolved. This enables organizations to report on storage compliance in a simple and consolidated way.

These result in less time required to prepare for and maintain PCI compliance, whilst streamlining the PCI on-site review process.

Automated monitoring of non-compliant storage

All organizations that store, transmit or process payment card data are required to continually maintain PCI compliance. To assist organizations achieve this requirement, Card Recon Enterprise Edition provides scheduled scanning capabilities to ensure systems within the organization are continually monitored for non-compliant card storage. CREE includes the following features to achieve this:

Host Scheduling - Where individual hosts are suspected of non-compliant card storage, Card Recon Enterprise Edition provides Administrative users the ability to initiate one-off or recurring scans of any single host to ensure ongoing compliance.
Group Scheduling - Offers the ability to initiate scans across groups of hosts both large and small at any time interval.
Automated generation of reports - Upon completion of a scan, reports are automatically generated and stored for later review by internal staff responsible for compliance of systems. Additionally these reports may be supplied to PCI QSAs for validation of compliance as part of an on-site review, reducing the time and complexity of the audit.

Faster verification of PCI compliance across all card data storage within your organization

Card Recon Enterprise Edition provides a centralized approach to identifying and reporting on any instances of PCI non-compliant storage. This enables an organization to maintain continuous visibility of storage compliance across any system that form part of PCI compliance scope.

Unlike traditional Data Loss Prevention (DLP) solutions, CREE is simple to implement and requires no significant changes to existing network infrastructure. A lightweight background application is installed on the server, workstation, and desktop hosts to be monitored, and a master report server provisioned using existing or dedicated resources as appropriate.

The Card Recon Enterprise management console can be installed on all popular desktop platforms and enables administrators to initiate host scans and identify instances of non-compliant Card Holder Data storage using different views including:

Master View – Displays a master level summary of all compliant and non-compliant hosts across an organization
Node View – Provides a detailed view of an individual host to identify specific areas of noncompliance and remediate as appropriate

Prevent non-compliant storage from re-occurring

Whilst policies and practices exist to help prevent noncompliant storage from occurring, users continue to represent a dynamic and unpredictable threat to an organizations ongoing PCI compliance.

Card Recon Enterprise Edition mitigates this risk by providing the following features:

Real-time view of compliance – When using the recurring schedule features of Card Recon Enterprise Edition, organizations are provided with an up-to-date view of their compliance posture in relation to storage of sensitive payment card information.
Full audit history of past scans available – as further support for organizations complying with PCI DSS, Card Recon Enterprise Edition maintains a history of audits performed for all systems. The information can be utilized as part of ongoing staff training or where required, as evidence to support any disciplinary action taken. These reports can be also be used as evidence to confirm regular audits are taking place within an organization. This feature can also reduce the efforts required of a PCI QSA to verify compliant storage practices are being maintained.

Product Specifications

Supported Environments

General

There are no framework prerequisites (i.e. Java, .NET)

Card Recon Enterprise Edition – Master Server

Windows 2000
Windows XP
Windows Vista
Windows Server 2008
Windows 7
Linux x86 (all distributions)

Card Recon Enterprise Edition Console

Windows 2000
Windows XP
Windows Vista
Windows Server 2008
Windows 7

Card Recon Enterprise Edition Nodes

Windows 2000
Windows XP
Windows Vista
Windows Server 2008
Windows 7
Linux x86 (all distributions)
HPUX 11 IA64
HPUX 11 PA-RISC
Solaris Opteron (x86)
Solaris SPARC
AIX pSeries
FreeBSD

Payment Card formats identified

All major schemes - American Express, Diners Club, Discover, JCB, Mastercard, Visa, and others.
All scheme issued types - Consumer, Premium, Corporate, Prepaid, Postpaid, Debit, Credit
All known structures - 14,15,16,17-19 digit card lengths
Specialist flags for prohibited data - Track1 / Track2
ASCII/Clear Text
Over 120 known PAN storage structures recognized