PCI Requirement 10.2.7 – Creation and Deletion of System-Level Objects

by Randy Bartels / December 20, 2022

 What is a System-Level Object? PCI Requirement 10.2.7 requires that audit trails can reconstruct the creation and deletion of system-level objects. The PCI SSC defines a system-level object as anything on a system component that is required for its operation, including but not limited to database tables, stored procedures, application executables and configuration files, system configuration files, static and shared libraries and DLLs, system executables, device drivers and device…

PCI Requirement 10.2.6 – Initialization, Stopping, or Pausing of the Audit Logs

by Randy Bartels / December 20, 2022

 What Does the Initialization, Stopping, or Pausing of Audit Logs Indicate? Stopping or pausing audit logs prior to performing malicious activities is a common practice for users hoping to avoid detection, and initialization of audit logs could indicate that the log function was disabled by a user. This is why PCI Requirement 10.2.6 requires that audit trails can reconstruct the initialization, stopping, or pausing of audit logs. To demonstrate…

PCI Requirement 10.2.5 – Use of and Changes to Identification and Authentication Mechanisms and Accounts with Root or Administrative Privileges

by Randy Bartels / December 20, 2022

 What is PCI Requirement 10.2.5? PCI Requirement 10.2.5 requires that organizations implement automated audit trails to reconstruct the use of and changes to identification and authentication mechanisms — including but not limited to creation of new accounts and elevation of privileges — and all changes, additions, or deletions to accounts with root or administrative privileges. The guidance on PCI Requirement 10.2.5 explains that without knowing which users were logged…

PCI Requirement 10.2.4 – Invalid Logical Access Attempts

by Randy Bartels / May 31, 2023

 Is There a Log of That? Invalid logical access attempts are often an indication of a malicious user attempting to access something they don’t have permission to. This is why PCI Requirement 10.2.4 requires that organizations implement automated audit trails to reconstruct invalid logical access attempts. Misspell your password? There should be a log of that. Someone tries to view a file that they don’t have permission to? There…

PCI Requirement 10.2.3 – Access to All Audit Trails

by Randy Bartels / December 20, 2022

 Examine Audit Trails PCI Requirement 10.2.3 requires that organizations implement automated audit trails to reconstruct access to audit trails. What’s the purpose of this? Guidance for PCI Requirement 10.2.3 states, “Malicious users often attempt to alter audit logs to hide their actions, and a record of access allows an organization to trace any inconsistencies or potential tampering of the logs to an individual account. Having access to logs identifying…