Leading Subscription Services Company

Security and Compliance Services

Overview

In 2011, Strata helped a subscription billing services cloud company build their security program and achieve PCI and SSAE16 (now SOC 1) compliance. The company highly values security and compliance because they handled sensitive PII and PCI data in order to integrate with payment gateway and service providers, as well as work with customers and partners to provide their subscription billing service. Strata was able to work together with the existing small staff of DevOps and IT resources and managers to help overcome their security and compliance challenges.

The Challenge

The near-term challenge was to achieve PCI compliance in three months, while the mid-term was to complete SSAE16 (now SOC 1) within nine months. Although not yet clearly defined at inception, the long-term challenge was to build a security program organization-wide that managed to strike a balance between cost, resource availability, and risk management.  This was not easy for a company that did not have full-time security resources and moved at startup speed.  This subscription billing cloud provider needed a partner they could rely on to help them meet near-, mid- and long-term security and compliance challenges.  Strata consultants stepped up to the challenge.  

The Solution

Strata consultants focused on meeting the near-term objectives to become PCI compliant. Within two weeks, Strata completed a PCI gap assessment  and provided a remediation plan to reach their objective of PCI compliance. Strata worked with PCI QSAs to prepare evidence and staff for the audit. Within three months, Strata helped the company achieve PCI compliance. Following that, Strata consultants took a similar approach to preparing and completing a SOC 1 Type II assessment and compliance. Since that time, Strata has provided additional resources to help build their security program to its current state, including recommendation of hiring a full-time CSO and five security staff. Even with the hiring of additional resources, this subscription services company sees the value in retaining Strata consultants to be part of their security team in 2017 and beyond.

The Benefit

Strata helped the company achieve short- and mid-term objectives in 2011 to become PCI and SOC 1 compliant. From there, Strata led efforts to help the company achieve SOC 2 and HIPAA compliance for all services provided. Strata continues to play a critical role in managing security and compliance initiatives and help work with the growing security team to build the company’s security program to a world-class level.

Leading Electric Car Manufacturer

Security Infrastructure Implementation

Overview

In 2012, Strata Consulting engineers implemented an enterprise PKI (public-key infrastructure) and VPN solution for a cutting-edge electric car manufacturer within three months. The PKI solution served as the foundation for provisioning secure authentication certificates to the onboard computer on the electric vehicle computers and wireless key fobs. These certificates are used to authenticate car communication over the wireless network and used by key fobs to securely open car doors.

The Challenge

Three months before the company’s electric car rollout, the manufacturer required a PKI solution to issue certificates to cars so that network communication for every electric vehicle is authenticated and encrypted. The solution required authentication certificates be provisioned from a PKI software that supports integration with secure FIPS 140-2 Level 3 HSM and has an open API for integration and automation of provisioning with manufacturing processes.  

The Solution

Based on the goal and objective to have a scalable and reliable PKI solution for their vehicle rollout, Strata defined detailed requirements and complete review of all available solutions for PKI. The key requirement of the PKI and VPN solution is that it is capable of supporting 4 nines (99.99%) availability.  To deliver the solution, Strata defined and managed the following phases of the project:

• Discovery and Requirements
• Design and Architecture
• Proof-of-Concept Pilot
• Staging and Manufacturing Demo
• Production Build
• Production Rollout

After a short discovery period, Strata Consulting engineers moved forward with an effective and comprehensive evaluation of both open-source and vendor-supplied solutions. Strata Consulting engineers selected EJBCA from PrimeKey and an HSM solution from Utimaco to design the network and systems architecture.  After presenting to the manufacturing, security, and technology teams, the architecture was approved. Strata Consulting engineers worked seamlessly with the staff of the electric car company to build, test, and integrate the PKI and VPN solution on the electric vehicle computers and wireless key fobs.

The Benefit

Strata Consulting engineers led the way for this electric vehicle manufacturer to deploy a PKI and VPN solution that is secure, highly available, and highly scalable. The solution is in operation to this day enabling secure communication between the vehicles and the company network and a suite of entertainment and car services to drivers as well as monitoring services for the car manufacturer.