STARLINK ..INFO

Trusted Security Advisor

C O M P L I A N C E S E C U R I T Y S O L U T I O N S

COMPANY

I N F O

How we can assist you to achieve the PCI Data Security Standard (PCI DSS) Compliance?

The Payment Card Information Data Security Standard (PCI-DSS) was created in 2004 by the leading credit companies in response to the growing problem of cardholder information theft. Despite heavy fines for violations and other costs incurred by retailers, security problems have continued. Recent high-profile data thefts have increased concerns about the problem, and generated a strong interest in solving it.

To help address the problem, several of the leading credit firms— American Express, Discover Financial Services, JCB, MasterCard Worldwide, and Visa International—established the Payment Card Industry Data Security Standard, or PCI DSS. They had three goals:

· To secure customer credit card information

· To build trust among credit card users

· To cut down on high-risk or dishonest merchants

Like all compliance and regulatory requirements, there is no single product or policy/procedure that will assure your compliance. THERE IS NO SILVER BULLET for PCI COMPLIANCE. PCI compliance requires that your enterprise deploy many security technologies, and have specific policies and procedures in place. StarLink can assist you to achieve the PCI requirements, this white paper focuses on the unique issues and solutions associated with both database security and monitoring and privileged password management in meeting PCI compliance requirements.

Guardium Real-time database activity monitoring offers an answer with a rapid, effective strategy for securing enterprise credit card data and passing your audit. Guardium Database monitoring technology uses a network-based appliance to monitor all activity into and out of a database. The appliance is easy to install via a passive network tap and does not require any changes to applications or databases. It simply monitors and collects detailed information about all database activities, establishes baselines of normal behavior, recognizes unusual data access activities, and takes action such as sending real-time alerts, shutting out the intrusion, or even locking down the database.

e-DMZ Security was uniquely designed to solve enterprise security and compliance issues associated with the management and control of shared privileged passwords such as root and administrator. The issue of privileged password management and the unique features of PAR contribute directly and/or indirectly to many specific PCI requirements as outlined in below attachment A. Fundamentally, the compliance audit concerns in the area of shared privileged password management center on ACCOUNTABILITY and AUDIT. Given the level of access and shared nature of accounts like root and administrator, internal and external PCI audits are taking a close look at existing enterprise controls. In most cases, the existing manual based policy/procedure solutions (e.g. Safe – envelope) or internally developed technical solutions are not standing up to PCI compliance audits. Under audit scrutiny existing in-house solutions are failing to deliver assured accountability and adequate audit.

PCI DSS Requirements	Product	How it work
2.1 Default passwords	e-DMZ Security (PAR)	By requiring that all default accounts are managed by PAR, you can ensure that the passwords are changed based on time and usage.
2.3 Encrypt all non-console administrative access.	e-DMZ Security (eGuardPoste)	GuardPost creates a secure proxied SSL connection for non-console based administrative access.
3. Protect stored cardholder data	Guardium	• Establishes granular access controls around cardholder and sensitive authentication data • Protects Web-facing applications from external attacks (such as SQL injection) via anomaly detection • Identifies movement of CVV/PIN data • Automatically locates & classifies sensitive data
3.5 Protect encryption keys	e-DMZ Security (PAR)	PAR provides secure file storage with granular access control.
3.6.6 dual control for keys	e-DMZ Security (PAR)	The PAR file storage capability allows for dual (or more) control on the release process.
6. Develop and maintain secure systems and applications	Guardium	• Monitors and alerts on all changes to databases including changes to internal structures, data values, and external DBMS configuration files • Automates reconciliation of database changes to authorized work orders (Remedy, Peregrine, etc.)
7. Restrict access to cardholder data by business need-to-know	Guardium	Restricts access by user, application, subnet, etc., including privileged users
7.1 Limit access to computing resources and cardholder information	e-DMZ Security (eGuardPost)	eGuardPost provides granular control to dictate which systems can be accessed and proxies the access.
8. Assign a unique ID to each person with computer access	Guardium	• Identifies use of shared database IDs • Identifies creation of new IDs • Restricts use of privileged vendor IDs • Alerts on failed logins & restricts repeated attempts
8.4 Encrypt all passwords during transmission and storage	e-DMZ Security (PAR)	PAR securely stores all managed passwords using AES 256 encryption. Passwords are transmitted via secure SSL.
8.5.4 Immediately revoke access for any terminated users	e-DMZ Security (PAR)	PAR can disable any terminated user removing access to PAR and any managed passwords. With PAR automated change controls, no user has any password knowledge unless in an active/authorized release window so terminated users have no account password knowledge.
8.5.6 Vendor accounts are monitored.	e-DMZ Security (PAR and eGuardPost)	With PAR, you can require vendor password requests for dual authorization, so passwords will only be provided when approved. Approvals could only be given during allowable access hours. With eGuardPost (add-on to PAR or stand alone) you can have a full session capture of all traffic. Whether connecting to Windows, Unix, routers, etc, all traffic is captured for review with VCR like playback.
8.5.8 Shared admin account	e-DMZ Security (PAR)	PAR was specifically designed to address this issue. PAR provides individual accountability to determine who accessed a shared account.
8.5.10, 8.5.11 Password Rules	e-DMZ Security (PAR)	PAR supports per system and per account based password rules including defining require length, numeric & alpha-numeric characters and more.
8.5.13 Limit Repeated Access	e-DMZ Security (PAR)	User’s logging into PAR can be disabled after configurable number of attempts. Being disabled will not allow access to any of the stored passwords on PAR the user is authorized to request/obtain.
8.5.14 Set Lockout duration	e-DMZ Security (PAR)	Disabled users are locked out until enabled by PAR administrator.
10. Track and monitor all access to network resources and cardholder data	Guardium	• Creates secure, verifiable audit trail with granular information about who, what, when, where, how of all database activities • Identifies end-user IDs in connection pooling environments where database only sees generic ID (Oracle EBS, PeopleSoft, SAP, Siebel and custom applications) • Automates report distribution and documents oversight to guarantee timely response • Provides 100+ preconfigured audit templates and reports for PCI, SOX, and data privacy laws
10.1 Individual accountability	e-DMZ Security (PAR and eGuardPost)	PAR will provide accountability of who used a particular account, while eGuardPost can provide a full session capture of the activity.
10.2.2 Logging all action to root or admin.	e-DMZ Security (PAR and eGuardPost)	eGuardPost captures the entire RDP or SSH session, providing full replay capability of the activities.
11. Regularly test security systems and processes	Guardium	• Assesses vulnerability and configuration risks. • Monitors integrity of all database files including configuration files, OS files, shell scripts, etc. • Delivers the metrics and real-time visual tools required for continuous assessment and proactive improvement of database security.
12. Maintain a policy that addresses information security for employees and contractors	Guardium	• Provides practical, appliance-based technology to monitor and enforce corporate policies—without impacting performance or business processes.
12.5.5 monitor and control access to data	e-DMZ Security (PAR and eGuardPost)	By forcing all access though eGuardPost, you have a full audit trail of any access to data.