PCI Requirement 10 – Track and Monitor all Access to Network Resources and Cardholder Data

by Randy Bartels / May 1st, 2018

Importance of Logging and Tracking

If data was compromised at your organization, how would you determine the cause? PCI Requirement 10 focuses on a critical aspect of data protection: logging and tracking. Implementing logging mechanisms at your organization gives you the ability to track user activities, which is crucial in preventing, detecting, and minimizing the consequences of a data breach. Without logging and tracking, it’s even more difficult to find the source of the data breach. This is why PCI Requirement 10 requires, ““Track and monitor all access to network resources and cardholder data.”

How to Track and Monitor All Access to Network Resources and Cardholder Data

To ensure that organizations implement logging and tracking mechanisms and track and monitor all access to network resources and cardholder data, PCI Requirement 10 details the following sub-requirements:

• 10.1 – Implement audit trails to link all access to system components to each individual user.
• 10.2-10.2.7 – Implement automated audit trails for all system components to reconstruct the following events: all individual user accesses to cardholder data, all actions taken by any individual with root or administrative privileges, access to all audit trails, invalid logical access attempts, use of and changes to identification and authentication mechanisms and all changes, additions, or deletions to accounts with root or administrative privileges, initialization, stopping, or pausing of the audit logs, and the creation and deletion of system-level objects.
• 10.3-10.3.6 – Record at least the following audit trail entries for all system components for each event: user identification, type of event, date and time, success or failure indication, origination of event, and identity or name of affected data, system component, or resource.
• 10.4 – Using time-synchronization technology, synchronize all critical system clocks and times and ensure that the following is implemented for acquiring, distributing, and storing time.
• 10.4.1 – Critical systems have the correct and consistent time.
• 10.4.2 – Time data is protected.
• 10.4.3 – Time settings are received from industry-accepted time sources.
• 10.5 – Secure audit trails so they cannot be altered.
• 10.5.1 – Limit viewing of audit trails to those with a job-related need.
• 10.5.2 – Protect audit trail files from unauthorized modifications.
• 10.5.3 – Promptly back up audit trail files to a centralized log server or media that is difficult to alter.
• 10.5.4 – Write logs for external-facing technologies onto a secure, centralized, internal log server or media device.
• 10.5.5 – Use file-integrity monitoring or change-detection software on logs to ensure that existing log data cannot be changed without generating alerts.
• 10.6 – Review logs and security events for all system components to identify anomalies or suspicious activity.
• 10.6.1 – Review the following at least daily: all security events, logs of all system components that store, process, or transmit CHD and/or SAD, logs of all critical system components, and logs of all servers and system components that perform security functions.
• 10.6.2 – Review logs of all other system components periodically based on the organization’s policies and risk management strategy, as determined by the organization’s annual risk assessment.
• 10.6.3 – Follow up exceptions and anomalies identified during the review process.
• 10.7 – Retain audit trail history for at least one year, with a minimum of three months immediately available for analysis.
• 10.8 – Additional requirement for service providers only: Implement a process for the timely detection and reporting of failures of critical security control systems, including but not limited to failure of: firewalls, IDS/IPS, FIM, anti-virus, physical access controls, logical access controls, audit logging mechanisms, and segmentation controls.
• 10.8.1 – Additional requirement for service providers only: Respond to failures of any critical security controls in a timely manner. Processes for responding to failures in security controls must include: restoring security functions, identifying and documenting the duration of the security failure, identifying and documenting cause(s) of failure, including root cause, and documenting remediation required to address root cause, identifying and addressing any security issues that arose during the failure, performing a risk assessment to determine whether further actions are required as a result of the security failure, implementing controls to prevent cause of failure from reoccurring, and resuming.
• 10.9 – Ensure that security policies and operational procedures for monitoring all access to network resources and cardholder data are documented, in use, and known to all affected parties.

PCI Requirement 10 is specifically focused on the log generation and being able to attribute actions back to an individual account; not necessarily back to an individual person, but back to an individual account. This would encompass making sure that logging and tracking is enabled. It defines the requirements around when an event happens, what gets logged, and your time management when reviewing these logs. Have a look at the rest of these videos and PCI Requirement 10 for the specific information around logging and tracking.