Information security is of paramount importance in this digital era. While businesses strive to adopt industry-accepted system-hardening standards such as benchmarks recommended by the Center for Internet Security (CIS) to combat threats, they are confronted with an additional challenge of ever-evolving regulations that address security concerns. These create additional requirements, which must be incorporated into software systems. In this paper, we present a generic approach towards automating different activities of the Security Compliance Value Chain (SCVC) in organizations. We discuss the approach in the context of the Payment Card Industry Data Security Standard (PCI-DSS) regulations. Specifically, we present automation of (1) interpretation of PCI-DSS regulations to infer system requirements, (2) traceability of the inferred system requirements to CIS security controls (3) implementation of appropriate security controls, and finally, (4) verification and reporting of compliance.

Modern day enterprises have a large IT infrastructure comprising thousands of applications running on servers housed in tens of data centers geographically spread out. These enterprises periodically perform a transformation of their entire IT infrastructure to simplify, decrease operational costs and enable easier management. However, the large number of different kinds of applications and data centers involved and the variety of constraints make the task of data center transformation challenging. The state-of-the-art technique for performing this transformation is simplistic, often unable to account for all but the simplest of constraints. We present eTransform, a system for generating a transformation and consolidation plan for the IT infrastructure of large scale enterprises. We devise a linear programming based approach that simultaneously optimizes all the costs involved in enterprise data centers taking into account the constraints of applications groups. Our algorithm handles the various idiosyncrasies of enterprise data centers like volume discounts in pricing, wide-area network costs, traffic matrices, latency constraints, distribution of users accessing the data etc. We include a disaster recovery (DR) plan, so that eTransform, thus provides an integrated disaster recovery and consolidation plan to transform the enterprise IT infrastructure. We use eTransform to perform case studies based on real data from three different large scale enterprises. In our experiments, eTransform is able to suggest a plan to reduce the operational costs by more than 50% from the "as-is" state of these enterprise to the consolidated enterprise IT environment. Even including the DR capability, eTransform is still able to reduce the operational costs by more than 25% from the simple "as-is" state. In our experiments, eTransform is able to simultaneously optimize multiple parameters and constraints and discover solutions that are 7x cheaper than other solutions.