Project Overview
Objective: To ensure full compliance with the Payment Card Industry Data Security Standards (PCI DSS) across the company’s digital and physical infrastructure, improving data protection and reducing the risk of financial penalties or security breaches.
Key Contributions
- Technologies Used: Linux (Ubuntu Server, Zentyal SBS), Firewall Implementation, Encryption Protocols, MySQL Database Hardening, Bash Scripting, Nessus and OpenVAS for vulnerability scanning, Audit Logging with syslog, Endpoint Protection Solutions, and VLAN segmentation.
- Challenges Overcome:Migrated the organization from a mixed Microsoft/Linux infrastructure to a fully Linux-based environment to reduce licensing costs while maintaining PCI compliance.
- Conducted a full risk assessment and developed a mitigation strategy to address vulnerabilities found during internal and external scans.
- Created custom Bash scripts to automate log archiving and backup processes to comply with log retention and monitoring standards.
- Deployed file integrity monitoring tools and enforced stricter access controls across all systems handling cardholder data.
Outcome and Impact
Results: The project culminated in the successful passing of a third-party PCI compliance audit with no major findings. The transition to a cost-effective, secure Linux infrastructure not only saved the company money but also improved its security posture. System downtime was reduced by 35% due to improved automation and proactive monitoring.
"Michael’s expertise was pivotal in achieving PCI compliance. He overhauled our IT infrastructure and guided us through the entire process with confidence and clarity."
Mark Gordon
Owner