TDM Solution using IBM Optim Sensitivity Internal Restricted

TDM Solution using IBM Optim Sensitivity: Internal & Restricted

Customer • Customer: A US based payments processing company • Industry: BFSI • Products and Services: Provides payment and technology services to merchants and financial institutions • Geography : US/Europe • Processes more than 20. 1 billion payment transactions and approximately $726 billion in volume annually • As of 2018, the company, supported approximately 400, 000 merchant locations and more than 17, 000 automated teller machines (ATMs) in 46 states and eight countries Sensitivity: Internal & Restricted © confidential 2

Project Background Wipro was primarily engaged to obfuscate the Sensitive fields in test environment while copying data from production to test or by implementing an in-place masking. Following entities were identified as sensitive and were incorporated in masking algorithms: • Personal account number/credit or debit card number: PAN is a PCI field and as per PCI guidelines the PAN number was obfuscated from all test environments. • Card holder name: Card holder name is PII field as per PCI guideline and hence obfuscated from all test environments • Social Security Number: This is a contractual field and needed to be obfuscated to allow offshore QA activities • Driver’s License/Passport or any other form of state/Federal or local ID • Personal e mail address • Date of Birth Sensitivity: Internal & Restricted © confidential 3

Strategic Business Objective To meet with compliance laws and de risk from data breach, it is mandatory for companies to obfuscate all PII information that leaves production systems Sensitivity: Internal & Restricted © confidential 4

Wipro’s Solution (1/3) Core Solution Components included: • IBM Infosphere Analyzer • IBM Optim • Mainframe load/unload utilities As part of solution, Project was divided into two phases; the first phase was for the obfuscation and implementation of PCI fields i. e. , PAN and Card Holder Name and the second phase for the obfuscation of contractual fields i. e. SSN, E mail and DL number. Each of the above phases was further broken down to Discovery and Masking/Obfuscation. Sensitivity: Internal & Restricted © confidential 5

Wipro’s Solution (2/3) Discovery: • In Discovery phase, the team utilized IBM Information Analyzer to scan the in-scope data sources to discover the location of the PCI fields. • This was followed by meetings with the application managers to confirm the results of Discovery. • The Discovery results act as inputs to next phase where actual obfuscation is done. Sensitivity: Internal & Restricted © confidential 6

Wipro’s Solution (3/3) Obfuscation: • The discovery phase was followed by obfuscation phase. • In this phase Optim’s Data Privacy feature was used to obfuscate PAN and Card Holder Name. • Optim offers in built algorithm to obfuscate PAN and Card Holder name, but due to customer’s business requirement for preserving the BIN, the PAN algorithm was customized to obfuscate only the last 4 digits of the card number. • The Algorithm was written in COBOL for obfuscating cards numbers for DB 2 and Mainframe Legacy Files. Sensitivity: Internal & Restricted © confidential 7

Supporting the BAU Activities-Using IBM Optim Data Sub-setting: Data sub setting was done from DB 2 transaction tables while extracting the data from BLU region. The sub setting logic was based on Chain, Merchant, and date range. The jobs for extracting the transactional data were executed once a month. Data Loading: Once the jobs to extract and obfuscate DB 2 data were executed successfully, the final output of the job was a Loader file. This file can be loaded into the target test DB 2 table using IBM DB 2 load utilities. Sensitivity: Internal & Restricted © confidential 8

Wipro’s Strategic Differentiators / Win Theme Our deep understanding on data privacy, expertise in implementing IBM Optim data privacy solutions across other financial customers coupled with our strong relationship with IBM were our strategic differentiators. Sensitivity: Internal & Restricted © confidential 9

Benefits Wipro’s engagement in this program has ensured customer data was secured in the lower environments. The irreversible masking process and masking of data maintaining referential integrity allowed coverage of all corner test cases. Sensitivity: Internal & Restricted © confidential 10

Thank You Sensitivity: Internal & Restricted