Download PDF
Provectus > Case Studies > Migration to Secure Infrastructure: TripActions' Journey to PCI-DSS Compliance
Provectus Logo

Migration to Secure Infrastructure: TripActions' Journey to PCI-DSS Compliance

Technology Category
  • Networks & Connectivity - Gateways
  • Platform as a Service (PaaS) - Application Development Platforms
Applicable Industries
  • Cement
  • Construction & Infrastructure
Applicable Functions
  • Quality Assurance
Use Cases
  • Construction Management
  • Infrastructure Inspection
Services
  • Cloud Planning, Design & Implementation Services
  • Testing & Certification
The Challenge

TripActions, a corporate travel management organization, faced a significant challenge in enabling secure banking transactions without the need for third-party services. The company aimed to accept customer payments directly, track all banking transactions processed through the platform, and securely collect and store critical and client-sensitive data. To achieve these objectives and spur revenue growth by attracting new enterprise clients, TripActions needed to migrate its platform to a secure PCI-DSS-compliant infrastructure. However, the existing infrastructure had several network, user access, monitoring, alerting, and CI/CD issues that needed to be addressed. The company approached Provectus to upgrade their infrastructure as part of their preparation for PCI-DSS compliance certification.

About The Customer

TripActions is a corporate travel management organization that aims to control the costs of business travel and incentivize employees through easily accessible business travel opportunities. The company sought to enhance its business travel platform by accepting customer payments directly, tracking all banking transactions processed through the platform, and securely collecting and storing critical and client-sensitive data. To achieve these objectives and spur revenue growth by attracting new enterprise clients, TripActions needed to migrate its platform to a secure PCI-DSS-compliant infrastructure.

The Solution

Provectus designed and built a new secure infrastructure in compliance with PCI-DSS standards for TripActions. The process began with an initial workshop to assess TripActions’ AWS infrastructure. Provectus enhanced TripActions’ AWS infrastructure in several stages, implementing access rules, roles, and groups, creating separate VPC for different environments types and services, and adding full logging audit, monitoring, and alerting. To optimize network infrastructure, separate VPC for production, staging, and development environments were created. Public and private subnets were segmented to control inbound/outbound traffic and outbound connections. Amazon Route53, VPN access with two-factor authentication, Elasticsearch and CloudWatch services were implemented. Backups for all services, data storage, and EC2 instances were created, and all instances received anti-virus updates. CI/CD pipelines were redesigned and improved, with a focus on automatic builds and tests on pull requests.

Operational Impact

  • The migration to the new secure infrastructure allowed TripActions to comply with PCI-DSS standards. The company became legally permitted to directly accept customer payments, track banking transactions, and securely collect and store transaction data, such as credit card details and transaction history. This significant upgrade not only improved product quality but also optimized IT operations. The successful migration spurred business growth and had a positive impact on overall business performance. The company managed to enhance its business travel platform, attract new enterprise clients, and spur revenue growth.

Quantitative Benefit

  • 35% reduction in Total Cost of Ownership (TCO)

  • 40% shorter release cycle

  • 3% reduction in customer expenses

Related Case Studies.

Case Study
IoT System for Tunnel Construction
The Zenitaka Corporation ('Zenitaka') has two major business areas: its architectural business focuses on structures such as government buildings, office buildings, and commercial facilities, while its civil engineering business is targeted at structures such as tunnels, bridges and dams. Within these areas, there presented two issues that have always persisted in regard to the construction of mountain tunnels. These issues are 'improving safety" and "reducing energy consumption". Mountain tunnels construction requires a massive amount of electricity. This is because there are many kinds of electrical equipment being used day and night, including construction machinery, construction lighting, and ventilating fan. Despite this, the amount of power consumption is generally not tightly managed. In many cases, the exact amount of power consumption is only ascertained when the bill from the power company becomes available. Sometimes, corporations install demand-monitoring equipment to help curb the maximum power demanded. However, even in these cases, the devices only allow the total volume of power consumption to be ascertained, or they may issue warnings to prevent the contracted volume of power from being exceeded. In order to tackle the issue of reducing power consumption, it was first necessary to obtain an accurate breakdown of how much power was being used in each particular area. In other words, we needed to be able to visualize the amount of power being consumed. Safety, was also not being managed very rigorously. Even now, tunnel construction sites often use a 'name label' system for managing entry into the work site. Specifically, red labels with white reverse sides that bear the workers' names on both sides are displayed at the tunnel work site entrance. The workers themselves then flip the name label to the appropriate side when entering or exiting from the work site to indicate whether or not they are working inside the tunnel at any given time. If a worker forgets to flip his or her name label when entering or exiting from the tunnel, management cannot be performed effectively. In order to tackle the challenges mentioned above, Zenitaka decided to build a system that could improve the safety of tunnel construction as well as reduce the amount of power consumed. In other words, this new system would facilitate a clear picture of which workers were working in each location at the mountain tunnel construction site, as well as which processes were being carried out at those respective locations at any given time. The system would maintain the safety of all workers while also carefully controlling the electrical equipment to reduce unnecessary power consumption. Having decided on the concept, our next concern was whether there existed any kind of robust hardware that would not break down at the construction work site, that could move freely in response to changes in the working environment, and that could accurately detect workers and vehicles using radio frequency identification (RFID). Given that this system would involve many components that were new to Zenitaka, we decided to enlist the cooperation of E.I.Sol Co., Ltd. ('E.I.Sol') as our joint development partner, as they had provided us with a highly practical proposal.
Learn more
© 2015-2024 IoT ONE Limited | Privacy Policy

Contact us

Let's talk!

* Required
* Required
* Required
* Invalid email address
By submitting this form, you agree that IoT ONE may contact you with insights and marketing messaging.
No thanks, I don't want to receive any marketing emails from IoT ONE.
Submit

Thank you for your message!
We will contact you soon.