Cheat Sheet:

PCI DSS 3.1 Compliance

What is PCI DSS?
  • Payment Card Industry Data Security Standard
  • Information security standard for organizations that handle data for debit, credit, prepaid, e-purse, ATM, and POS card brands
  • Standard to increase controls around cardholder data protection and reduce credit card fraud
12 Requirements
Control Objectives PCI DSS Requirements
Build and Maintain a Secure Network
  1. Install and maintain a firewall configuration to protect cardholder data
  2. Do not use vendor-supplied defaults for system passwords and other security parameters
PROTECT CARDHOLDER DATA
  1. Protect stored cardholder data
  2. Encrypt transmission of cardholder data across open, public networks
MAINTAIN A VULNERABILITY MANAGEMENT PROGRAM
  1. Use and regularly update antivirus software on all systems commonly affected by malware
  2. Develop and maintain secure systems and applications
IMPLEMENT STRONG ACCESS CONTROL MEASURES
  1. Restrict access to cardholder data by business need-to-know
  2. Assign a unique ID to each person with computer access
  3. Restrict physical access to cardholder data
REGULARLY MONITOR AND TEST NETWORKS
  1. Track and monitor all access to network resources and cardholder data
  2. Regularly test security systems and processes
MAINTAIN AN INFORMATION SECURITY POLICY
  1. Maintain a policy that addresses information security
Who needs to be compliant?
  • All entities involved in payment card processing
  • There are four compliance levels, based on the number of transactions a merchant processes each year:
    • Separate levels for Visa., MasterCard. and service providers
    • PCI training and reporting requirements for merchants depends on compliance level
    • Annual compliance validation, either through a Self-Assessment Questionnaire (SAQ) or a Qualified
    • Security Assessor (QSA), depending on compliance level
What happens if an orginizations doesn't comply?
  • Increased risk of payment card data compromise
  • Subject to fines
  • Loss of credit card acceptance privileges
How do Alert Logic Solutions address PCI DSS?

Alert Logic addresses an important subset of the PCI DSS requirements:

THREAT MANAGER™ WITH ACTIVEWATCH provides IDS and vulnerability scanning for specific compliance requirements, and reporting for customer compliance. ActiveWatch for Threat Manager adds 24×7 monitoring of network traffic by security analysts for rapid detection and response.

LOG MANAGER™ WITH ACTIVEWATCH OR LOGREVIEW collects and normalizes log data from the entire IT infrastructure and presents it in a single view, through a web interface that includes 100+ pre-built reports and powerful analytical tools. LogReview service adds daily reporting by expert security analysts extract meaning
from vast amounts of log data. ActiveWatch service provides 24x7 monitoring to prevent future breaches through automated post compromise detection.

WEB SECURITY MANAGER™ WITH ACTIVEWATCH, a Web Application Firewall (WAF), blocks web application attacks with a combination of signature-based detection and application behavior profiling, stopping unauthorized activity before an attack compromises an application. ActiveWatch for Web Security Manager adds 24x7 monitoring and incident escalation by certified security analysts, along with ongoing WAF tuning and management

Changes in PCI DSS: 3.1 Update - April 2015

The primary change for 3.1 was to specify that older versions of SSL and TLS are not secure. Alert Logic identifies the older protocols as vulnerabilities, and our appliances can only communicate with our backend environment that uses TLS 1.2, a secure version.

MORE SPECIFIC CHANGES INCLUDE:

  •  6.6 – Added clarification to response time on automated solutions for web-based attacks
  • 10.6 – Redundant language removed for added clarification
  • 11.2 – Vulnerability scan can be a combination of automated and manual tools, techniques, or other methods
What were the significant changes in PCI DSS 3.0?

The theme of 3.0 was the evolution of security compliance from a once-a-year event to a day-to-day practice. While this has been the case for some time, the new standard made it more explicit.

NEW REQUIREMENTS INCLUDE:

  • 2.4 – Maintain inventory of system components in scope for PCI DSS
  • 5.1.2 – For systems not commonly affected by malicious software, perform periodic evaluations to identify and evaluate evolving malware threats
  • 9.9 – Protect devices that capture payment card data via direct physical interaction with the card from tampering and substitution
  • 11.3 – Implement an industry-accepted methodology for penetration testing
  • 12.8.5 – Maintain information about which PCI DSS requirements are met by each service provider, and which are managed by the entity
PCI DSS FREQUENTLY ASKED QUESTIONS
QUESTIONANSWER
Is Alert Logic a PCI DSS Approved Scanning Vendor (ASV)? Yes. Alert Logic maintains ASV status.
With which requirements can Alert Logic help me?

Threat Manager and the associated ActiveWatch service: 6.1, 11.2 (including 11.2.1, 11.2.2, and 11.2.3), and 11.4

Log Manager, LogReview, and the associated ActiveWatch service: 10.2, 10.3, 10.5, 10.6, and 10.7

Web Security Manager and the associated ActiveWatch service: 6.5, 6.6

What kind of responsibilities do customers have to make Alert Logic products and services address PCI DSS requirements?

Alert Logic customers must ensure that the products are monitoring the correct sources, and when Alert Logic notifies customers of issues in their environment, the customer must address the issues quickly. Also, customers are responsible for ensuring that the logs and other information sent to Alert Logic does not contain credit card data or any associated personal information. Details of these requirements are communicated in the contracts and during the Alert Logic onboarding and provisioning processes.

Does Alert Logic store logs long enough for PCI DSS requirements?

Yes. Alert Logic stores logs for a minimum of one year. Customers have the options of extended that time period, but only by contract, not by settings in the user interface.

I’ve seen several documents referring to Alert Logic as a PCI DSS Service Provider. What does that term mean?

The PCI Security Standards official glossary defines “Service Provider” as:

“Business entity that is not a payment brand, directly involved in the processing, storage, or transmission of cardholder data on behalf of another entity. This also includes companies that provide services that control or could impact the security of cardholder data. Examples include managed service providers that provide managed firewalls, IDS, and other services as well as hosting providers and other entities. If an entity provides a service that involves only the provision of public network access—such as a telecommunications company providing just the communication link—the entity would not be considered a service provider for that service (although it may be considered a service provider for other services).”

If I’m being audited, how can Alert Logic make the process easier? Alert Logic provides reports that customers can give to their QSA. We can also answer questions about our services and appliances.
Download PDF