PCI DSS 3.1 Compliance
What is PCI DSS?
- Payment Card Industry Data Security Standard
- Information security standard for organizations that handle data for debit, credit, prepaid, e-purse, ATM, and POS card brands
- Standard to increase controls around cardholder data protection and reduce credit card fraud
|Control Objectives||PCI DSS Requirements|
|Build and Maintain a Secure Network||
|PROTECT CARDHOLDER DATA||
|MAINTAIN A VULNERABILITY MANAGEMENT PROGRAM||
|IMPLEMENT STRONG ACCESS CONTROL MEASURES||
|REGULARLY MONITOR AND TEST NETWORKS||
|MAINTAIN AN INFORMATION SECURITY POLICY||
Who needs to be compliant?
- All entities involved in payment card processing
- There are four compliance levels, based on the number of transactions a merchant processes each year:
- Separate levels for Visa., MasterCard. and service providers
- PCI training and reporting requirements for merchants depends on compliance level
- Annual compliance validation, either through a Self-Assessment Questionnaire (SAQ) or a Qualified
- Security Assessor (QSA), depending on compliance level
What happens if an orginizations doesn't comply?
- Increased risk of payment card data compromise
- Subject to fines
- Loss of credit card acceptance privileges
How do Alert Logic Solutions address PCI DSS?
Alert Logic addresses an important subset of the PCI DSS requirements:
THREAT MANAGER™ WITH ACTIVEWATCH provides IDS and vulnerability scanning for specific compliance requirements, and reporting for customer compliance. ActiveWatch for Threat Manager adds 24×7 monitoring of network traffic by security analysts for rapid detection and response.
LOG MANAGER™ WITH ACTIVEWATCH OR LOGREVIEW collects and normalizes log data from the entire IT infrastructure and presents it in a single view, through a web interface that includes 100+ pre-built reports and powerful analytical tools. LogReview service adds daily reporting by expert security analysts extract meaning
from vast amounts of log data. ActiveWatch service provides 24x7 monitoring to prevent future breaches through automated post compromise detection.
WEB SECURITY MANAGER™ WITH ACTIVEWATCH, a Web Application Firewall (WAF), blocks web application attacks with a combination of signature-based detection and application behavior profiling, stopping unauthorized activity before an attack compromises an application. ActiveWatch for Web Security Manager adds 24x7 monitoring and incident escalation by certified security analysts, along with ongoing WAF tuning and management
Changes in PCI DSS: 3.1 Update - April 2015
The primary change for 3.1 was to specify that older versions of SSL and TLS are not secure. Alert Logic identifies the older protocols as vulnerabilities, and our appliances can only communicate with our backend environment that uses TLS 1.2, a secure version.
MORE SPECIFIC CHANGES INCLUDE:
- 6.6 – Added clarification to response time on automated solutions for web-based attacks
- 10.6 – Redundant language removed for added clarification
- 11.2 – Vulnerability scan can be a combination of automated and manual tools, techniques, or other methods
What were the significant changes in PCI DSS 3.0?
The theme of 3.0 was the evolution of security compliance from a once-a-year event to a day-to-day practice. While this has been the case for some time, the new standard made it more explicit.
NEW REQUIREMENTS INCLUDE:
- 2.4 – Maintain inventory of system components in scope for PCI DSS
- 5.1.2 – For systems not commonly affected by malicious software, perform periodic evaluations to identify and evaluate evolving malware threats
- 9.9 – Protect devices that capture payment card data via direct physical interaction with the card from tampering and substitution
- 11.3 – Implement an industry-accepted methodology for penetration testing
- 12.8.5 – Maintain information about which PCI DSS requirements are met by each service provider, and which are managed by the entity
PCI DSS FREQUENTLY ASKED QUESTIONS
|Is Alert Logic a PCI DSS Approved Scanning Vendor (ASV)?||Yes. Alert Logic maintains ASV status.|
|With which requirements can Alert Logic help me?||
Threat Manager and the associated ActiveWatch service: 6.1, 11.2 (including 11.2.1, 11.2.2, and 11.2.3), and 11.4
Log Manager, LogReview, and the associated ActiveWatch service: 10.2, 10.3, 10.5, 10.6, and 10.7
Web Security Manager and the associated ActiveWatch service: 6.5, 6.6
|What kind of responsibilities do customers have to make Alert Logic products and services address PCI DSS requirements?||
Alert Logic customers must ensure that the products are monitoring the correct sources, and when Alert Logic notifies customers of issues in their environment, the customer must address the issues quickly. Also, customers are responsible for ensuring that the logs and other information sent to Alert Logic does not contain credit card data or any associated personal information. Details of these requirements are communicated in the contracts and during the Alert Logic onboarding and provisioning processes.
|Does Alert Logic store logs long enough for PCI DSS requirements?||
Yes. Alert Logic stores logs for a minimum of one year. Customers have the options of extended that time period, but only by contract, not by settings in the user interface.
|I’ve seen several documents referring to Alert Logic as a PCI DSS Service Provider. What does that term mean?||
The PCI Security Standards official glossary defines “Service Provider” as:
“Business entity that is not a payment brand, directly involved in the processing, storage, or transmission of cardholder data on behalf of another entity. This also includes companies that provide services that control or could impact the security of cardholder data. Examples include managed service providers that provide managed firewalls, IDS, and other services as well as hosting providers and other entities. If an entity provides a service that involves only the provision of public network access—such as a telecommunications company providing just the communication link—the entity would not be considered a service provider for that service (although it may be considered a service provider for other services).”
|If I’m being audited, how can Alert Logic make the process easier?||Alert Logic provides reports that customers can give to their QSA. We can also answer questions about our services and appliances.|
|ALERT LOGIC INFORMATION: https://www.alertlogic.com/solutions/aws-vulnerability-scanning-and-assessment/|
|PCI SECURITY STANDARDS COUNCIL: https://www.pcisecuritystandards.org/|
|VISA CARDHOLDER INFORMATION SECURITY PROGRAM: http://usa.visa.com/merchants/risk_management/cisp_overview.html|
|MASTERCARD SITE DATA PROTECTION PROGRAM: http://www.mastercard.com/us/company/en/whatwedo/site_data_protection.html|
|AMERICAN EXPRESS DATA SECURITY STANDARD:
|DISCOVER INFORMATION SECURITY AND COMPLIANCE: http://www.discovernetwork.com/merchants/data-security/disc.html|