Do you know what's in the new version of the PCI DSS released in November 2013?
Editor's note: This article introduces the white paper "PCI and What It Means to IBM i" available free from the MC White Paper Center.
While one may think that PCI is a thing of the past and that it's already been implemented, major breaches (most notably of the Target PoS systems) have brought it back into focus. Some retailers are just now understanding how PCI applies to them, and other organizations have started to accept credit cards when they didn't in the past. To refresh everyone's memory, here's an overview of what PCI means to the IBM i community and what organizations that use an IBM i to store, process, or access cardholder data need to be aware of.
The Payment Card Industry has developed a Data Security Standard (PCI DSS) that is composed of six major sections, with each of those divided into subsections for a total of 12 specific areas addressed. A new version of the PCI DSS was released in November 2013, and while it's not required to be implemented until 2015, the PCI Council is encouraging organizations to start implementing the new requirements as soon as possible. The intent of this update is to move from a focus of compliance to having security be part of the "business as usual" activities. Compliance implies a "point in time." We all know that compliance typically occurs at the time of an audit but also that compliance status usually slides the further away from the audit you get. With the emphasis on business as usual, data and systems have a chance of being secure—or perpetually in compliance. SkyView Partners has long talked about compliance needing to be a "lifestyle," not an event, so we are thrilled with the emphasis of this new version of the PCI DSS. Hopefully, all of our data will be secure when the attacks are mounted!
The intent of each section of PCI DSS is to mitigate risk to cardholder data. Let's take a look at each section in the terminology of the IBM i.
Build and Maintain a Secure Network
Section 1: Install and maintain a firewall configuration to protect cardholder data.
The obvious intent of this section is to ensure that networks are adequately protected by using a firewall. Since the IBM i should not be used as a firewall, this has no direct effect on the IBM i.
Section 2: Do not use vendor-supplied defaults for system passwords or other security parameters.
The easiest way to gain access to a network or server is to try to use the default passwords or exploit wide-open or default settings. This section has several requirements for the IBM i community, including:
- User profiles cannot have a default password—that is, a password that's the same as the user profile name (Section 2.1). This section was clarified in V3.0 to note that this also applies to service accounts. In the IBM i world, this could be vendor-supplied profiles, profiles used by vendors to maintain applications and/or profiles used for FTP, ODBC, or JDBC processes. No profile—including these service profiles—can have a default password.
- TCP/IP services that are not in use should be turned off and the auto-start value set to *NO (Section 2.2.2).
- System values and other settings should be set to prevent misuse. In other words, implement security best practices (Section 2.2.4).
- Products (including libraries and directories no longer in use) should be removed from the system (Section 2.2.5).
- All non-console administrator access must be encrypted. In other words, unless you're accessing the system from a hard-coded console terminal, anyone who has *ALLOBJ special authority must use a connection that is encrypted. This is typically accomplished using an SSL or SSH connection (Section 2.3).
- Security policies and operational procedures must be documented, in use, and known to all affected parties. In typical IBM i shops, this would mean that IBM i administrators, help desk, operators, developers, etc. would need to know the requirements of this section, especially when it comes to ensuring no default passwords and signing on with an encrypted session. This is an addition to version PCI DSS 3.0—not just in this section (Section 2.5) but in most sections of PCI DSS 3.0. It is the enforcement of the "business as usual ' concept.
One requirement that doesn't apply but must often be explained by the IBM i community to the PCI Qualified Security Assessor (QSA) is the requirement in Section 2.2.1 to implement only one function per server. Since the IBM i (and systems such as mainframe computers) were designed to be multi-functional, this does not apply. For example, the use of subsystems on IBM i allow you to separate servers and provide different performance characteristics for different types of jobs (web, batch, interactive). IBM specifically refers to the system as being able to run multiple applications and components.
Want to Know More?
Download the free white paper "PCI and What It Means to IBM i" from the MC White Paper Center.
Carol Woodbury is IBM i Security SME and Senior Advisor to Kisco Systems, a firm focused on providing IBM i security solutions. Carol has over 30 years’ experience with IBM i security, starting her career as Security Team Leader and Chief Engineering Manager for iSeries Security at IBM in Rochester, MN. Since leaving IBM, she has co-founded two companies: SkyView Partners and DXR Security. Her practical experience and her intimate knowledge of the system combine for a unique viewpoint and experience level that cannot be matched.
Carol is known worldwide as an author and award-winning speaker on security technology, specializing in IBM i security topics. She has written seven books on IBM i security, including her two current books, IBM i Security Administration and Compliance, 3rd Edition and Mastering IBM i Security, A Modern, Step-by-Step Approach. Carol has been named an IBM Champion since 2018 and holds her CISSP and CRISC security certifications.
MC Press books written by Carol Woodbury available now on the MC Press Bookstore.
 |
||
 |
|
IBM i Security Administration and Compliance: Third Edition Don't miss the newest edition by the industry’s #1 IBM i security expert. List Price $71.95 Now On Sale
|
 |
|
Mastering IBM i Security Get the must-have guide by the industry’s #1 security authority. List Price $49.95 Now On Sale
|
More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.
TRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now! Request Now.
Forms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.
Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:
Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.
IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn:
LATEST COMMENTS
MC Press Online