I've heard of other security professionals using metadata tagging tools to track sensitive data within an organization,...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
basically to ensure they always have protections in place for that data. Do you think a similar strategy could be deployed for compliance purposes, so PCI-relevant data could be tagged as such? Are there any tools you could suggest for such measures?
Absolutely. Metadata tagging is one example of data loss prevention (DLP) technology that may be used to identify and inventory sensitive information in an enterprise, and then monitor for intentional or inadvertent leaks of that information. When DLP systems detect an attempt to move data in violation of policy, the system may intervene and block the communication attempt before the leak occurs.
Metadata tagging requires users and/or security administrators to identify the specific files that contain sensitive information and tag them with a classification that may be read by the DLP system. This approach is effective when well-managed, but it is time-consuming and difficult to accurately identify all of the information that must be tagged.
In the case of PCI compliance, a more common way to leverage DLP is through pattern matching. Payment card account numbers follow a standard formatting process, and also include a check digit calculated using the Luhn algorithm. DLP systems may search data crossing a secure perimeter to detect the presence of numbers that match standard credit card patterns and pass the Luhn check. This is a reliable approach to monitoring the flow of credit card information with a fairly low false positive rate.
Ask the Expert!
Got a vexing problem for Mike Chapple or any of our other experts? Ask your enterprise-specific questions today! (All questions are anonymous.)
To learn more about metadata security, check out this tip in our Data Protection Security School.
Dig Deeper on Enterprise Data Governance
Related Q&A from Mike Chapple
Encrypting data going to the cloud is a security best practice, but does it add extra challenges for regulators that might need to access the data? ...continue reading
Merchants that sell at off-site venues need to take extra care to follow PCI compliance standards. Expert Mike Chapple discusses how organizations ...continue reading
The FTC's order for PCI DSS compliance assessments is odd since PCI isn't a government regulation. Expert Mike Chapple explains the motivation ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.