WIM= Windmill Networks Integration Manager
PCI DSS=Payment Card Industry Data Security Standard
The PCI Security Standards Council has produced some interesting documents. The intent of the organization is to produce security guidelines for companies that handle information from credit cards and things that function like credit cards.
The guidelines they have produced are very reasonable for both the intended target and businesses in general.
- Requirement 1: Configure routers and firewalls to protect cardholder data and verify these regularly.
- Requirement 2: Do not use vendor supplied passwords and manage passwords intelligently.
- Requirement 3: Protect stored cardholder data.
- Requirement 4: Encrypt cardholder data when transmitting across public networks.
- Requirement 5: Use and regularly update anti-virus software.
- Requirement 6: Develop and maintain secure systems and applications.
- Requirement 7: Restrict access to data to those with a need to know.
- Requirement 8: Assign a unique ID to each user.
- Requirement 9: Restrict physical access to cardholder data.
- Requirement 10: Track access to network resources and cardholder data.
- Requirement 11: Regularly test security systems and processes.
- Requirement 12: Maintain a policy that addresses security for employees and contractors.
I have been unknowingly giving these same requirements to business I have been helping over the last 20 years.
Many businesses are currently working through the certification process to meet these requirements and we can help. WIM provides automation support for requirements 1, 2, 11, and 12. Our regular collection and cross verification of network device information as it is stored in the various management tools are significant steps for requirements 1 and 11. The rules our customers create provide validation for parts of 2 and 12. We are adding support for automated password checking to detect default and insecure passwords stored in the IT support applications.
The hidden meaning of the PCI DSS requirements is to look at your infrastructure as an interconnected system. Each element effects the security and stability of the systems as a whole. The only sustainable way to ensure each element is configured and functioning correctly is to process and review the elements together as a system. These guidelines are good guidelines for any business and we hope we can help people meet them.