ICT Today

July/August/September 2020 I 39 distribution and stopping 'denial of service' attacks and damage to computer and electronic communi- cation systems." In the United States, the same concept was devel- oped in California with the California Consumer Pri- vacy Act, enacted in June of 2018. However, the new regulation does not include requirements for physical access control. Federal Information Security Modernization Act (FISMA) General Data Protection Regulation (GDPR) rity framework to guide companies' cybersecurity risk management processes. Access control is an element of the framework's core function (Protect) which recommends: • Access to assets and associated facilities is limited to authorized users, processes, or devices, and to authorized activities and transactions, under which: ▪ Identities and credentials are managed for authorized devices and users. ▪ Physical access to assets is managed and protected. ▪ Remote access and access permissions are managed. ▪ Network integrity is protected, incorporating network segregation where appropriate. The GDPR is part of the European Union's (EU's) data protection reform and is a strict set of regulations that gives data protection and security policies a new level of priority. Although GDPR is an EU regulation, any organization collecting or process- ing data for individuals within the EU should also have a compliance strategy. Payment Card Industry Data Security Standard holder data to service providers. The PCI DSS compliancy affects organizations that handle financial transactional information, including financial institutions, merchants and service providers, software developers of payment systems, and manufac- turers of PIN devices. The PCI DSS access-control-related requirements include: • Use appropriate facility entry controls to limit and monitor physical access to systems in the cardholder data environment. • Develop procedures to easily distinguish between onsite personnel and visitors, such as assigning ID badges. • Use a visitor log to maintain a physical audit trail of visitor information and activity, including visitor name, company, and the onsite personnel authorizing physical access. • Retain the log for at least three months unless otherwise restricted by law. (PCI DSS) The PCI Security Standards Council (PCI SSC) created the PCI DSS to protect cardholder data in the digital age. Vulnerabili- ties appear everywhere in the card-processing sphere, including point-of-sales devices, wireless hotspots, e-commerce, and the transmission of card- Based on a 2013 presidential Executive Order, Improving Critical Infrastructure Cybersecurity, the National Institute of Standards and Technology (NIST) published a cybersecu- Data centers will need to be able to demonstrate examples of "preventing unauthorized access to electronic communications networks and malicious code

• Cover