Is your network in compliance with industry security standards such as the PCI Data Security Standard? These standards exist to safeguard sensitive information from vulnerabilities.
The PCI Data Security Standard exists to ensure that organizations handling credit cards keep information secure in the following ways:
- Ensure Secure Networks and Systems
- Secure/Protect Cardholder Data
- Manage Vulnerability
- Ensure Access Control Measures
- Monitor & Test Networks
- Ensure Information Security Policies are Upheld
Major credit card issuers require companies that process their credit card holders’ information uphold this standard. Without enforcing standards like this, their credit card holders could be vulnerable to any number of possible security lapses every time they make a purchase.
With the PCI compliance, or with any industry standard, how can you keep compliant if you don’t know how your network is connected? You can’t secure the network unless you know exactly what you have in your network, where it all is, and how what you have is connected.
With network diagrams and documentation, whether you use network documentation software or manual network documentation.
At a minimum, you need to document:
- Where your network’s entrance and exit points are.
- Software updates
By mapping the network’s points of entry and exit, you get a handle on where security vulnerabilities could arise in the future. By documenting the most recent software updates, you can ensure your physical assets are updated with current security patches. For PCI compliance, your network diagram should include all the connections linking devices that process credit card holder data (and other networks). Pay close attention to any wireless networks you have.
When you can visualize what you have, and where you have it, you can secure the network and stay in compliance with industry standards. When you don’t have documentation in place, you can’t accurately respond to questions about the network. If, for example, you were grilled about your organization’s network, where would you turn? Outdated Visio documentation? Outdated Excel spreadsheets? Or maybe Jim….who’s been here for 50 years and knows everything but is about to retire (have fun on your boat, Jim).
The key to successful network documentation, manual or automatic, is to keep doing it. If you have a network diagram that’s a few years old, chances are: it’s out of date. Network documentation is as network documentation does: without keeping it current, you may as well go to an art museum and look at some pretty pictures rather than look at ancient network diagrams. The best way to keep the network secure? Implement an institution-wide policy that requires your network diagrams are kept current, year-round.