[Day 2] 1. PCI DSS (Payment Card Industry Data Security Standard)

Overview

• PCI DSS is a security standard created to ensure safe handling of credit and debit card data.
• Developed jointly by major card brands such as MasterCard, Visa, American Express, and JCB International.
• Aimed at protecting cardholder data, reducing fraud, and ensuring secure transactions.
• Vendors (merchants and service providers) are categorised based on their annual transaction volume, with stricter standards applied as the volume increases.
• The latest version (4.0.1) introduces enhanced guidelines for flexibility and risk management.

---

Key PCI DSS Requirements

1. Install and Maintain Network Security Controls:
   • Implement firewalls and other controls to secure networks.
2. Apply Secure Configurations to All System Components:
   • Ensure systems are configured securely to reduce vulnerabilities.
3. Protect Stored Account Data:
   • Use encryption, masking, and tokenization to secure sensitive cardholder data at rest.
4. Protect Cardholder Data in Transit:
   • Use strong cryptography (e.g., TLS) for data transmitted over public networks.
5. Protect All Systems and Networks from Malicious Software:
   • Install and update antivirus/malware protection.
6. Develop and Maintain Secure Systems and Software:
   • Regularly update systems and patch vulnerabilities.
   • Change Management: a structured process that ensures all modifications to systems or components within the cardholder data environment (CDE) are carefully controlled, documented, tested, and approved before implementation, minimising the risk of security breaches related to system changes; essentially, it's a method to manage updates and alterations to systems that store, process, or transmit cardholder data in a secure and compliant manner.
7. Restrict Access to System Components and Cardholder Data:
   • Enforce role-based access controls (RBAC) and the principle of least privilege.
8. Identify and Authenticate Access to System Components:
   • Use multi-factor authentication and strong passwords for all users accessing sensitive systems.
9. Monitor and Test Networks Regularly:
   • Conduct periodic vulnerability scans, penetration tests, and log monitoring.
10. Maintain an Information Security Policy:
    • Document security policies, train employees, and ensure compliance.

---

Roles Separation: OS, Device, Firewall, and Database Administrators

• Why separate roles?
  1. Mitigate risks: If one admin makes an error, it doesn't cascade to other domains.
  2. Job continuity: Ensures continuity if an admin leaves.
  3. Specialisation: Domain-specific expertise reduces mistakes.
  4. Insider threat prevention: Limits the scope of malicious actions by disgruntled employees.

---

Encryption

• Hard Disk Encryption:
  • Effective only until the OS boots. After booting, the disk becomes accessible.
  • Recommended: Encrypt data stored within the disk along with full disk encryption.

---

Restricting Command Access to Sudo Users

• Use
  Copy

  sudo

  configuration files (
  Copy

  /etc/sudoers

  ) to define and limit access:
  • Example: Restrict specific commands to certain users:

    Copy
    user1 ALL=(ALL) NOPASSWD: /usr/bin/command1
    

---

Checklist for Audit

Web Server

1. Firewall:
   • Is a firewall installed and properly configured?
   • What ports are allowed? Are unused ports blocked?
   • Is there a backup of the firewall configuration?
   • Is there a documented change management procedure for firewall updates?
   • Is the person responsible for firewall changes clearly identified?
   • Are firewall rules reviewed regularly to ensure compliance?
   • Is the firewall software updated regularly?
2. Antivirus:
   • Is antivirus installed and auto-update enabled?
   • Is there a written procedure to verify updates?
   • Are you in contact with antivirus vendor support?
   • Is the antivirus standalone or server-based?
3. System Components:
   • Is the OS regularly updated?
   • Are administrator accounts limited and monitored?
   • What other user accounts exist, and what are their purposes?
   • Are password policies (strong passwords, history, and expiration) enforced?
4. Log Monitoring:
   • Is there a written procedure for monitoring logs?
   • How frequently are logs reviewed?
5. Attack History:
   • Are previous attacks documented?

Database Server

1. Admins:
   • Are OS and database administrators separate roles?
   • How often is the database admin password changed?
   • Is two-factor authentication enabled for admins?
   • Are there sufficient admins for round-the-clock coverage?
2. Backups:
   • Are backups performed regularly with written procedures?
   • Is backup data encrypted and securely stored?
   • Is there a testing procedure for backup integrity (e.g., avoiding corruption due to humidity)?
3. Firewall:
   • Are change management procedures in place for firewall modifications?
   • How are change requests documented and approved?
4. Attack History:
   • Is there a documented history of server attacks?

---