10/17/08 - Aruba Networks, Inc. (NASDAQ: ARUN) announced the availability of "Security Is In The Air," a new white paper that describes how merchants can comply with the newest Payment Card Industry (PCI) Data Security Standard (DSS) Version 1.2.

The v1.2 standard defines security guidelines for merchants and service providers that store, process and transmit cardholder data. Firewalls, encryption, authentication, and wireless intrusion detection are mandated for use with all wireless LANs, and some safeguards are required even if the wireless LAN does not transmit cardholder data. The white paper describes compliance solutions for both wired and wireless networks.

The PCI DSS V1.2 standard includes twelve major steps for securing payment account information, and testing methodologies designed to ensure that these requirements are met. Wireless LAN security is a core component of these requirements. The security requirements fall into three categories: no wireless LANs are in use; wireless LANs are used for non-cardholder data applications only; and wireless LANs are used for cardholder data transactions. The white paper recommends technical solutions designed to satisfy the distinct compliance requirements of each category.

"Besides enhancing security controls to prevent breaches, establishing and maintaining PCI compliance positively affects a merchant's brand name because it shows the company is actively safeguarding its customers' private information," said Manav Khurana, Aruba's head of industry marketing. "Merchants found to be out-of-compliance with PCI standards not only risk their good name and customer lawsuits, but could also incur monetary penalties imposed by the credit card branding organizations. Since Aruba's recommended compliance solutions can be implemented economically with minimal disruption, merchants have every reason to bring their networks into compliance as quickly as possible."

For example, PCI DSS v1.2 prohibits cardholder data from being transmitted using Wired Equivalent Privacy (WEP), a commonly used security algorithm that has proven to be easily broken. Given the widespread use of WEP for scanners and other devices, wholesale elimination of WEP-based devices could prove expensive to merchants. The white paper outlines a cost-effective PCI DSS v1.2 compliant solution that remediates the WEP security threat, using an Aruba policy-enforcement firewall to isolate WEP devices carrying non-cardholder data. The security controls thereby avoid the need to replace WEP devices.

Aruba offers integrated security and wireless/wired access solutions that meet or exceed the wireless LAN-specific security requirements in PCI DSS v1.2. Merchants using an Aruba solution can cost-effectively implement the security controls required for PCI compliance without compromising the performance of business applications or upgrading legacy networks.

The new white paper, "Security Is In The Air," can be downloaded from Aruba's Web site.

Keywords: aruba networks inc, wireless lan security, wireless intrusion detection, wireless lans, minimal disruption, testing methodologies, compliance solutions, compliance requirements, industry marketing, manav, enhancing security, khurana, Wireless Security