Q

Using metadata tagging tools for PCI DSS compliance

Metadata tagging is not just for security. Expert Mike Chapple explains how tagging tools can be used to achieve PCI DSS compliance.

I've heard of other security professionals using metadata tagging tools to track sensitive data within an organization, basically to ensure they always have protections in place for that data. Do you think a similar strategy could be deployed for compliance purposes, so PCI-relevant data could be tagged as such? Are there any tools you could suggest for such measures?

Absolutely. Metadata tagging is one example of data loss prevention (DLP) technology that may be used to identify and inventory sensitive information in an enterprise, and then monitor for intentional or inadvertent leaks of that information. When DLP systems detect an attempt to move data in violation of policy, the system may intervene and block the communication attempt before the leak occurs.

Metadata tagging requires users and/or security administrators to identify the specific files that contain sensitive information and tag them with a classification that may be read by the DLP system. This approach is effective when well-managed, but it is time-consuming and difficult to accurately identify all of the information that must be tagged.

In the case of PCI compliance, a more common way to leverage DLP is through pattern matching. Payment card account numbers follow a standard formatting process, and also include a check digit calculated using the Luhn algorithm. DLP systems may search data crossing a secure perimeter to detect the presence of numbers that match standard credit card patterns and pass the Luhn check. This is a reliable approach to monitoring the flow of credit card information with a fairly low false positive rate.

Ask the Expert!
Got a vexing problem for Mike Chapple or any of our other experts? Ask your enterprise-specific questions today! (All questions are anonymous.)

Next Steps

To learn more about metadata security, check out this tip in our Data Protection Security School.

This was first published in August 2014

Dig deeper on Enterprise Data Governance

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close