An Implementation and Evaluation of PCI DSS 3.0 for E-Commerce in a Testing Environment
Total Page：16
File Type：pdf, Size：1020Kb
LETTERKENNY INSTITUTE OF TECHNOLOGY A thesis submitted in partial fulfilment of The requirements for the Master of Science in Computing in Information Systems and Software Security Letterkenny Institute of Technology ________________________________________________________________ An Implementation and Evaluation of PCI DSS 3.0 for E-Commerce in a Testing Environment Author: Supervisor: Kelly McWeeney Mr. John McGarvey Submitted to Quality and Qualifications Ireland (QQI) Dearbhú Cáilíochta agus Cáilíochtaí Eireann) March 2015 1 Declaration I hereby certify that the material, which I now submit for assessment on the programmes of study leading to the award of Master of Science in Computing in Enterprise Application Development, is entirely my own work and has not been taken from the work of others except to the extent that such work has been cited and acknowledged within the text of my own work. No portion of the work contained in this thesis has been submitted in support of an application for another degree or qualification to this or any other institution. Signature of candidate: __________________ Date: _________________ 2 Acknowledgments This thesis would not have been possible without the support of many people at the Letterkenny Institute of Technology. The author would like to acknowledge and express her sincere gratitude to her supervisor John McGarvey for his guidance and support. The author would also like to extend her gratitude to the Head of Computing Department Mr. Thomas Dowling, and all the staff in Letterkenny Institute of Technology. Finally the author would also like to thank Sean McWeeney, Darina McWeeney, Shane McWeeney, Enda Cassidy, Gary Cassidy and Anthony Caldwell for their support. 3 Abstract Threats to personal payment card information are continually on the rise. To implement a formal process for protecting this information PCI DSS was created. However credit card fraud is still rising. This leads to the question of whether or not PCI DSS is effective in protecting this data. This dissertation implements the 12 PCI DSS 3.0 requirements and tests the effectiveness in regard to the complexity of implementation. While there are clearly issues within the standard: existing ambiguities, speed of adapting to industry findings: the main issue with the standard is not with the standard itself but with a failure to comply and still accepting electronic payments. The self-assessment options as found in testing would have left many network vulnerabilities that would remain undiscovered without full standard implementation. 4 Table of Figures Figure 1: PCI Security Standards Council (2010) requirements evolution .............................. 15 Figure 2: Data Breach Statistics (Sullivan, 2013) ..................................................................... 20 Figure 3: Full Network Design for PCI DSS 3.0 Compliance Testing......................................... 26 Figure 4: Network Switches ..................................................................................................... 31 Figure 5: Ubuntu Hard Disk Partitions ..................................................................................... 31 Figure 6: Removal of Default PhpMyAdmin Users .................................................................. 32 Figure 7: Audit Ubuntu Server Checklist (Center of Internet Security, 2015) ......................... 33 Figure 8: Apache Server Confirmation ..................................................................................... 34 Figure 9: CIS Audit Apache Server Checklist (Centre of Internet Security, 2012) ................... 34 Figure 10: ClearOS Interfaces................................................................................................... 35 Figure 11: Smoothwall Configuration and Logging Options .................................................... 36 Figure 12: Implementation of RSA SSL..................................................................................... 37 Figure 13: TLS v1.2 configuration............................................................................................. 37 Figure 14: Successful MySQL SSL configuration ...................................................................... 38 Figure 15: php.ini configuration .............................................................................................. 39 Figure 16: Comodo Installation ................................................................................................ 40 Figure 17: Self-Assessment Versions ....................................................................................... 40 Figure 18: Wireshark TLS handshake ....................................................................................... 41 Figure 19: HTTPS Communications .......................................................................................... 42 Figure 20: Nikto Configuration................................................................................................. 42 Figure 21: Scan for Wireless Routers ....................................................................................... 43 Figure 22: De-Authorisation Packet Injection .......................................................................... 44 Figure 23: Wireshark capture of AES keys ............................................................................... 44 Figure 24: Failed Aircrack Attack ............................................................................................. 45 Figure 25: PCI DSS Requirement 11.3 ...................................................................................... 47 5 Table of Acronyms Acronym Meaning Acronym Meaning ACL Access Control Lists NAT Network Address Translation AES Advanced Encryption Standard NIC Network Interface Controller CDE Card Data Environment NIST National Institute of Standards and Technology CIS Centre for Internet Security OS Operating System DMZ De-Militarised Zone PCI Payment Card Industry DPA Data Protection Act PCI DSS Payment Card Industry Data Security Standard EAPOL Extensible Authentication Protocol over SHA Secure Hash Algorithm LAN GUI Graphical User Interface SDLC Systems Development Life Cycle IDS Intrusion Detection Systems SSL Secure Sockets Layer IP Internet Protocol TLS Transport Layer Security ISO International Organization for VLAN Virtual Local Area Network Standardization IEC International Electro-Technical VM Virtual Machine Commission MD5 Message Digest Algorithm WPA Wi-Fi Protected Access 6 Table of Contents Acknowledgments...................................................................................................................... 3 Abstract ...................................................................................................................................... 4 Table of Figures .......................................................................................................................... 5 Table of Acronyms ..................................................................................................................... 6 1. Introduction ...................................................................................................................... 12 1.1 Purpose ................................................................................................................................. 12 1.2 Background ........................................................................................................................... 13 1.3 Outline of Report .................................................................................................................. 13 1.4 Research Question ................................................................................................................ 13 1.5 Research Objectives .............................................................................................................. 13 2. Literature Review ............................................................................................................. 14 2.1 Introduction .......................................................................................................................... 14 2.2 The History and Evolution of PCI DSS ................................................................................... 14 2.2.1 The Founding and Early Conceptions of the PCI Model ................................................ 14 2.2.2 PCI DSS 2.0 .................................................................................................................... 15 2.2.3 PCI DSS 3.0 .................................................................................................................... 16 2.3 The Importance of the Payment Card Industry Data Security Standard .............................. 17 2.3.1 Protecting Data ............................................................................................................. 17 2.3.2 Implications of Non-Compliance ................................................................................... 18 2.3.3 Lack of Understanding .................................................................................................. 18 2.4 PCI DSS and Legislation ......................................................................................................... 19 2.5 Data Breaches ....................................................................................................................... 19 2.6 Implementing the Standard .................................................................................................