I've heard of other security professionals using metadata tagging tools to track sensitive data within an organization,...
basically to ensure they always have protections in place for that data. Do you think a similar strategy could be deployed for compliance purposes, so PCI-relevant data could be tagged as such? Are there any tools you could suggest for such measures?
Absolutely. Metadata tagging is one example of data loss prevention (DLP) technology that may be used to identify and inventory sensitive information in an enterprise, and then monitor for intentional or inadvertent leaks of that information. When DLP systems detect an attempt to move data in violation of policy, the system may intervene and block the communication attempt before the leak occurs.
Metadata tagging requires users and/or security administrators to identify the specific files that contain sensitive information and tag them with a classification that may be read by the DLP system. This approach is effective when well-managed, but it is time-consuming and difficult to accurately identify all of the information that must be tagged.
In the case of PCI compliance, a more common way to leverage DLP is through pattern matching. Payment card account numbers follow a standard formatting process, and also include a check digit calculated using the Luhn algorithm. DLP systems may search data crossing a secure perimeter to detect the presence of numbers that match standard credit card patterns and pass the Luhn check. This is a reliable approach to monitoring the flow of credit card information with a fairly low false positive rate.
Ask the Expert!
Got a vexing problem for Mike Chapple or any of our other experts? Ask your enterprise-specific questions today! (All questions are anonymous.)
To learn more about metadata security, check out this tip in our Data Protection Security School.
Related Q&A from Mike Chapple
The updated HITRUST Common Security Framework allows organizations to manage privacy, security and compliance with one framework. Here's how it works...continue reading
A HIPAA audit covers privacy compliance, and organizations need to be prepared. Expert Mike Chapple discusses privacy in the audits.continue reading
A data breach warranty may seem like a tempting way to survive a costly attack, but it may not be all it's hyped up to be. Expert Mike Chapple ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.