PCI Requirement 9: Restrict Physical Access to Cardholder Data

PCI Requirement 9 evaluates all aspects of physical security controls to cardholder data – updated devices, visitor badges, security cameras, etc. The PCI DSS states, “Any physical access to data or systems that house cardholder data provides the opportunity for individuals to access devices or data and to remove systems or hardcopies, and should be appropriately restricted.”

There are ten sub-requirements of Requirement 9, all with their own sub-parts. This webinar dives into discussion on all ten sub-requirements, which include:

Requirement 9.1 – Verify the existence of physical security controls for each computer room, data center, and other physical areas with systems in the CDE. We need to have a way to monitor who goes in and out of the environment, either a video camera or some type of access control mechanism.

Requirement 9.2 – Develop procedures to easily distinguish between onsite personnel and visitors, which includes identifying onsite personnel and visitors, changes to access requirements, revoking or terminating onsite personnel and expired visitor identification.

Requirement 9.3 – Control physical access for onsite personnel to sensitive areas. Access must be authorized and based on individual job function. Access must be revoked immediately upon termination and all physical access mechanisms are returned or disabled when revoked or terminated.

Requirement 9.4 – Implement procedures to identify and authorize visitors – badges, security, etc.

Requirement 9.5 – Store media backups in a secure location, preferably an off-site facility, such as an alternate or backup site, or a commercial storage facility. The location’s security needs to be reviewed at least annually.

Requirement 9.6 –  Maintain strict control over the internal or external distribution of any kind of media; this includes classifying media so that sensitivity can be determined, the way you send media, etc.

Requirement 9.7 – Properly maintain inventory logs of all media and conduct media inventories at least annually.

Requirement 9.8 – Destroy media when it is no longer needed for business or legal reasons; destroy media so that cardholder data cannot be reconstructed.

Requirement 9.9 – Protect devices that capture payment card data via direct physical interaction from tampering and substitution. Updated devices and updated lists of devices are key.

Requirement 9.10 – Ensure that security policies and operational procedures for restricting physical access to cardholder data are documented, in use, and known to all affected parties.

To learn more about PCI compliance, check out our PCI Demystified video resources or contact us today.

Building a Comprehensive Penetration Testing Methodology

We often see clients struggling with the new requirements for penetration testing with regard to PCI compliance. The intent behind the new penetration testing methodology is to define the means and the methods by which a penetration test will be executed in your organization’s environment. Your organization’s penetration testing methodology should define the things that a penetration tester needs to do in order for your organization to have a comprehensive PCI assessment.

This webinar will discuss the following PCI requirements:

11.3 – Develop a formal penetration testing methodology; a comprehensive methodology is vital to meeting compliance standards. If you don’t have a penetration testing methodology, start creating one now.

11.3.1 – Execute a formal statement of work that is mapped to your penetration testing methodology. Everything comes back to your methodology, that’s why it’s so important.

11.3.2 – Penetration testing must be executed against statement of work which is developed based on your penetration testing methodology.

11.3.3 – After a penetration test is completed, you must correct items that were exploited. Items that are not exploited must be fed into your Vulnerability Identification and Management Program. In regards to PCI compliance, penetration testing is not considered a pass or fail.

11.3.4 – If you are using segmentation in order to minimize the scope of your PCI compliance obligations, then the penetration tester must test the boundaries of segmentation to validate that the segmentation is effective.

When building your organization’s penetration testing methodology, there are several things to consider. This webinar’s panelist, Jeff Wilder, gives listeners ten  topics to include when putting a penetration testing methodology together, which include:

• Coverage for the entire CDE
• Coverage of perimeter of the network
• Coverage of any critical systems
• Testing from inside the corporate WAN in an attempt to access cardholder data in an unauthorized way
• Testing from the Internet in an attempt to access internal systems and systems that reside within the DMZ in an unauthorized way
• Testing to validate any segmentation in place
• Testing of any controls that establish scope reduction
• Tests must be performed against the application layer and include those items in the OWASP and CWE top 25 known vulnerabilities
• Tests against all network-layer devices and assets
• Include a review and consideration of threats and vulnerabilities experienced in the last 12 months

There’s a lot to learn about penetration testing, but we’re here to help. To learn more, contact us today or check out additional penetration testing resources:

Penetration Testing for Beginners

3 Reasons You Should be Undergoing Regular Penetration Testing

5 Benefits of Regular Penetration Testing 

5 Tips for a Successful Penetration Test

This session in our PCI Readiness Series dives into PCI Requirement 8, specifically about identifying and authenticating access to system components. In this webinar, we will cover strong, secure passwords in transmission and storage, disabling accounts for terminated employees and unused accounts, changing default passwords, and disabling generic accounts with shared usernames and passwords.

PCI Requirement 8 establishes non-refutability and authentication security, covers all systems and applications, and has about 21 sub-requirements that will be assessed. There’s an incredible amount of work when establishing your authentication program. PCI Requirement 8 applies to all users and to any place where a password is required.

This webinar also discusses topics such as:

• Program Management: Policies and procedures regarding authentication must be documented, in use, and effectively communicated to all relevant individuals.
• Assessment – Documents: In addition to policies and procedures, assessors will look at documents such as: system password configuration standards, a list of terminated employees within the last 6 months, a list of new hires, a list of administrators, and a list of all user accounts from all systems.
• Assessment – Asset Observation: Assessors will conduct a review of all password settings and a review of how passwords are encrypted during transmission.
• Best Practices: We believe some basic best practices for complying with Requirement 8 are:
  • No sharing of usernames and passwords (no generic accounts)
  • Passwords must be strong
  • Passwords must be secure in transmission and storage
  • No use of default passwords
  • Must disable accounts for employees who are no longer there
  • Must disable accounts that are not used in 90 days

This webinar also gives an overview of each of these sub-requirements:

Requirement 8.1 – Define and implement policies and procedures

Requirement 8.2 – Everyone gets their username and something to authenticate with (like a password, token, or biometric)

Requirement 8.3 – Incorporate two-factor authentication for remote network access originating from outside the network by personnel (including administrators and vendors)

Requirement 8.4 – Document and communicate authentication policies and procedures to all users

Requirement 8.5 – Do not use group, shared, or generic IDs, passwords, or other authentication methods

Requirement 8.6 – Where other authentication mechanisms are used (security tokens, smart cards, certificates, etc), use of these mechanisms must be assigned

Requirement 8.7 – All access to any database containing cardholder data (including access by applications, administrators, and all other users) is restricted

Requirement 8.8 – Ensure that security policies and operational procedures for identification and authentication are documented, in use, and known to all affected parties

To learn more about PCI compliance, check out our PCI Demystified video resources or contact us today.