Trellix and Keysight Help Payment Co.

Payment Processing Company Combines Visibility and Decryption to Streamline Security and Compliance   

Encrypting data like credit card numbers adds an invaluable layer of protection against data theft since, even if hackers get their hands on encrypted traffic, they typically can’t read or do anything with it. For this reason, most data privacy mandates and would-be customers’ security policies require sensitive information like financial data to traverse networks encrypted.

But at the same time, decrypting traffic once it gets where it’s going adds extra steps and places substantial strain on monitoring and detection tools. CISOs at financial services providers must find ways to efficiently encrypt, decrypt, and re-encrypt data as it flows across multiple inspections tools within one or more data centers.

Cortelco, a long-time Keysight channel partner, devised an innovative plan to help a prominent Latin American payment processing company streamline encryption while upgrading three regional data centers. The plan called for combining a Keysight network visibility platform with intrusion prevention systems (IPS) from Trellix to optimize security, compliance, and operational efficiency at the same time.

Compliance Calls for Full Visibility

Finance companies ethically, and often legally, must be able both to see and protect sensitive data. So, while ninety percent (90%) of all the traffic flowing across modern networks gets encrypted, that statistic may be even higher for financial services providers.

This particular Puerto Rico-based provider had the added goal of decrypting data inline to support the exchange of ephemeral keys used in the Diffie Hellman method of cryptography.

Cortelco Designs a Solution Based on Keysight and Trellix

The payment processor hoped to avoid the operational overhead and added risk that comes with using third-party agents to monitor performance and detect threats.

Since McAffee works closely with Trellix, a trusted IPS solution provider partner, Cortelco was able to migrate the old monitoring technology to modern Trellix IPS solutions that prevent the company from missing dangerous threats, failing audits, and incurring fines for non-compliance.  

Prevention Starts with Complete Visibility

Since the Trellix devices also relied on agents to perform decryption, Cortelco further recommended offloading the function to a Keysight visibility platform. The plan called for installing Keysight Vision 400 network packet brokers (NPBs) with inline decryption capabilities to make encrypted traffic visible to Trellix. Instead of deploying agents, the Vision 400 handles decryption directly onboard the packet broker before load-balancing traffic to monitoring tools for analysis.

This agentless approach meets compliance requirements for data security and improves monitoring infrastructure performance by removing duplicates, headers, and other extraneous data. Two Keysight Vision Edge 40 devices would also be installed at each center to aggregate and send data from multiple network links to the Vision 400s.

Visibility Adds Resilience to “Bypass” Downtime

The payment services provider also deployed Keysight intelligent bypass switches to solidify its network resilience. iBypass from Keysight regulates the flow of traffic between the Vision 400s and Trellix IPS devices while monitoring for network, device, and power failures. When an outage occurs, Keysight re-routes traffic to other available links and tools to avoid downtime until issues get resolved.

Bottom-line visibility benefits

The addition of decryption and bypass capabilities to its visibility and monitoring infrastructure equips the payment processing company to:

• Inspect all network traffic for malware and other hidden threats
• Support Diffie Hellman cryptography 
• Optimize investments in monitoring and data center infrastructures 
• Avoid downtime during network upgrades and even outages

Learn more about joint solutions from Trellix and Keysight.

Related

Resources