BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

3 Reasons POS Should Give A DAM

Posted August 1, 2011    Peter McCalister

Just when you thought we exceeded our TLA (three letter acronym) quota for the year, up pops this idea for a blog based on a recent discussion with a national retailer, and I couldn’t resist the play on acronyms and the potential for multiple interpretations. But don’t let the TLAs scare you. This is actually a serious topic that does effect any of you who are responsible for compliance across remote sales locations.
If you haven’t figured out the TLAs for todays’s discussion, then don’t feel lost, as I can think of about five variations on each. For today’s purpose though:
POS stands for Point of Sale and refers to systems that handle local sales transactions and report back to corporate for accounting and audit purposes

DAM stands for Database Activity Monitoring and refers to the security software responsible for monitoring those transactions to ensure compliance as well as assist with security
Most POS projects involve backoffice applications specific to the type of retail organization you are (i.e. grocery vs clothing, vs consumer goods, vs whatever you sell in a physically remote location). These apps typically run on SQL Server or some other database like Oracle or IBM DB2. If you only have one or two stores, then DAM may be overkill but if you have 50+ stores then you will find it is mandatory for compliance purposes.

Any good DAM solution is going to be able to configure audit sources and set up notifications for events. Audit policies and rules define conditions for activity and exceptions. Collection and publishing schedules facilitate processes to monitor activity and status. A strong console administration and various report packs also facilitate easier and faster deployment for immediate discovery and reporting of compliance issues especially with exporting and scheduling report distribution.

So, back to the title of today’s blog; What are the 3 reasons POS should give a DAM?
PCI DSS compliance or for those of you tired of acronyms, Payment Card Industry Data Security Standards compliance. This is the primary regulation all retailers need to be most mindful of as it sets the requirements for transaction data integrity and privacy.

Remediation for any security breach that may inadvertently occur at the database level of your POS. Know exactly who did what, when and where will allow your security teams to handle the situations that present themselves.

Business intelligence on what types of database admin activities are occuring at specific POS sites relative to other locations.

Leave a Reply

Additional articles

expert-russellsmith

Best Practices for Managing Domain Admin Accounts

Posted August 3, 2015    Russell Smith

The risks of using privileged domain accounts on devices that are not secured to the same level as DCs increases the chances that domain administrator credentials could be exposed. Windows caches credentials by default to authenticate users when a domain controller can’t be reached, including those of domain administrator accounts that have previously logged in to a device. As such, a compromised workstation or member server can also lead to stolen domain administrator credentials.

Tags:
, ,
powerbroker-for-mac-diagram-small

PowerBroker for Mac: A Least-Privileged Apple a Day…

Posted July 27, 2015    Jason Silva

BeyondTrust PowerBroker for Mac reduces the risk of privilege misuse by enabling standard users on Mac OS X to perform administrative tasks successfully without entering elevated credentials.

Tags:
, ,
PrivilegedAccountManagement

On Demand Webinar – Now is the time for Privileged Account Management

Posted July 24, 2015    BeyondTrust Software

In this webinar, SANS Instructor and Founder of Voodoo Security, Dave Shackleford, will revisit several hacking and breach scenarios that involved privileged accounts, and use these as examples while discussing tools and tactics to get this problem under control once and for all.

Tags:
, ,