Who needs a network vulnerability scanner?
Any network from the smallest office to large enterprises has an attack surface too large and complex for purely manual monitoring. Even if you are only responsible for a few hosts and devices, you need automated assistance to efficiently and thoroughly track the growing list of known vulnerabilities and ensure that your network is not exposed.
Vulnerability scanning software relies on a database of known vulnerabilities and automated tests for them. A limited scanner will only address a single host or set of hosts running a single operating system platform. A comprehensive scanner scans a wide range of devices and hosts on one or more networks, identifying the device type and operating system, and probing for relevant vulnerabilities with lesser or greater intrusiveness.
Every day, security researchers and hackers discover new vulnerabilities, augmenting the tens of thousands of known holes in applications, services, operating systems, and firmware. Vulnerability scanning tools provide automated assistance for tracking known vulnerabilities and detecting your exposure to them.
Vulnerability management
Vulnerability scanning is only one part of the vulnerability management process. Once the scanner discovers a vulnerability, it must be reported, verified, prioritized and classified for risk and impact, remediated, and monitored to prevent it from happening again.
S&E Enterprise Solutions offers a vulnerability management process that includes scheduled scans, prioritization guidance, change management for software versions, and end point computer virus detection.
PCI Compliance
PCI Compliance deals with the Payment Card Industry (PCI). If your entity is a merchant that is involved in processing payment card transactions, then the standards apply to your entity and your entity should be compliant with the PCI Data Security Standard (DSS) in order to protect cardholder data. While the PCI DSS is not required by federal law, several states have made PCI DSS a requirement or other similar protections.
Many organizations and business we speak to simply don’t know where to begin with information security. Some may think simply locking the doors to their business is enough, others may not even see the need to secure their data. The goal is to reduce data breaches and following the 12 requirements provides a strong foundation.
The PCI DSS provides a standard that every business can and should follow. What’s helpful is the standard does have specific rules for different businesses, depending on size, type, methods of storing card data, etc.
There are (4) Four levels of PCI compliance that your business falls into:
Helps you avoid fines and lawsuits
Should you get breached, not only will you deal with the loss of data, but you may deal with fines and lawsuits from customers and other organizations.
A good example is the Wyndham Hotel breach. After they were breached three times, Wyndham Hotel was sued by the Federal Trade Commission because they had falsely said they were secure after each breach. This lawsuit ended in a settlement, but it shows what repercussions you could get in the event of a data breach. Other fines can include customer lawsuits, third-party lawsuits, government fines, card brand fines, and more.
If you’re PCI compliant, you can reduce these fines and reduce the amount of lawsuits and liability your company may incur.
- Merchant processor compromise fine: $5,000 – $50,000
- Card brand compromise fees: $5,000 – $500,000
- Forensic investigation: $12,000 – $100,000
- Onsite QSA assessments following the breach: $20,000 – $100,000
- Free credit monitoring for affected individuals: $10 – 30/card
- Card re-issuance penalties: $3 – $10 per card
- Security updates: $15,000+
- Lawyer fees: $5,000+
- Breach notification costs: $1,000+
- Technology repairs: $2,000+
- Loss of customer confidence: businesses often lose 40% of customers after a breach.
- Forensic investigation cost: $10,000-$100,000
Total cost of a data breach could range between $77,000 and $875,000.
Promote your business as PCI compliant!
The best way to let customers know your business is PCI compliant is to include a statement in the About or Company section of your website. The statement should cover your PCI compliance status and what that means to your customers. Be sure to update this statement annually to reflect your most recent compliance validation.
When your business becomes PCI compliant, you’ve made a commitment to continuously maintain a baseline standard for protecting credit card data. PCI compliance makes your business less likely to experience a payment data breach, and there are obviously many financial benefits in keeping data thieves at bay!
