• Security
• Compliance
• SOX 404
• GLBA
• NISPOM
• HIPAA
• FFIEC
• PCI
• FISMA
• Operations

Compliance - PCI Data Security Standard

Payment Card Industry (PCI) Data Security Standard

The Payment Card Industry is a private industry group setup by the major credit card companies to define standards for companies that process card card transactions. The Data Security Standard was defined to prevent credit card fraud, hacking and other security issues. A company processing, storing, or transmitting credit card numbers must be PCI-DSS compliant or they risk losing the ability to process credit card payments. The PCI-DSS includes requirements covering network security, data protection, vulnerability management, access control, monitoring and testing, and information security. According to the PCI data security standard, an organization must be able to monitor, report, and alert on attempted or successful access to systems and data security for those applications that contain sensitive cardholder data, and explicitly calls for the collection and monitoring of event logs.

Prism Microsystems solutions fulfill the following PCI requirements:

Establish a process for linking all access to system components (especially those done with administrative privileges such as root) to an individual user.

• Change security settings of any files or directory
• Audit the files or directory of any system
• Control the access permission setting of domain wide directory or files from a central console

Implement automated audit trails to reconstruct events for all system components.

• Track and monitor all user activities including user logons, user logoffs, user login failures, user added/ deleted/modified, user logon failure/success on VPN servers, and success/failure of critical file access by users

Record audit trail entries for each event for all system components.

• Automatic log back-up in a Centralized Warehouse

Secure audit trails so they cannot be altered.

• Event archive is compressed, encrypted and stored with an MD-5 chhecksum to prevent tampering

Review logs for all system components at least daily. Log reviews should include those servers that perform security functions like IDS and authentication (AAA) servers.

• Reports Console to create and schedule customized reports and automatically send the summary or detail report at scheduled intervals

Retain your audit trail history for a minimum of a one year, with 3 months available on-line.

• No limitation on how long events can be archived on-line

See a complete Mapping of EventTracker Reports and Alerts to PCI-DSS Requirements