2014
Meet PCI DSS Requirements with FOSS
This document helps you to Identify the Free and Open Source Software which can be used to meet one or more PCI-DSS Requirements
Rajagopalan S Blog: Http://securityncompliance.wordpress.com 12/07/2014 Meet PCI DSS Requirements with FOSS
About this document:
This document is created in order to utilize the Free & Open Source Software which helps us to meet one or more PCI-DSS Requirements. Document was created on my sole interest aimed at helping the PCI-DSS Professionals and entities who are required to be PCI-DSS Compliant. The FOSS is mapped to each PCI-DSS requirement. I have tried my best to search and gather all open source applications which could be used to meet / assess the PCI-DSS Compliance. If you find any useful free and open source software let me know we could add to this list.
This document doesn’t recommend any entity to forcefully use only the FOSS to meet its PCI-DSS compliance and also it doesn’t replace the interest of any organization buying Commercial Products. Also Read Disclaimer Section of this document.
Targeted Audience:
PCI-QSA’s PCI Internal Assessors Organization that are required to comply with PCI-DSS Standard Compliance Professionals
Abbreviations & Acronyms:
PCI DSS – Payment Card Industry Data Security Standards FOSS – Free and Open Source Software
Copyright:
This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License. To view a copy of this license, visit http://creativecommons.org/licenses/by-nc-nd/4.0/ or send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
Page 1 of 28 Meet PCI DSS Requirements with FOSS
Contents
Requirement 1: Install and maintain a firewall configuration to protect cardholder data ...... 3 Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters ...... 5 Requirement 3: Protect stored cardholder data ...... 6 Requirement 4: Encrypt transmission of cardholder data across open, public networks ...... 12 Requirement 5: Maintain a Vulnerability Management Program ...... 13 Requirement 6: Develop and maintain secure systems and applications ...... 14 Requirement 7: Restrict access to cardholder data by business need to know ...... 17 Requirement 8: Identify and authenticate access to system components ...... 17 Requirement 9: Restrict physical access to cardholder data ...... 20 Requirement 10: Track and monitor all access to network resources and cardholder data ...... 20 Requirement 11: Regularly test security systems and processes...... 22
Page 2 of 28 Meet PCI DSS Requirements with FOSS
Requirement 1: Install and maintain a firewall configuration to protect cardholder data
Requirement 1.1.2:
Current network diagram that identifies all connections between the cardholder data environment and other networks, including any wireless networks
Application listed below will help you to create a network diagram at free of cost. If you require all-in- one suite then MS Visio is the best of all, but it cost.
Application to design a Network Diagram:
Gliffy Flowchart Software (Create Flow Charts Online) URL: http://www.gliffy.com/uses/flowchart-software/
CADE URL: http://www.weresc.com/home.php
Diagram Designer URL: http://logicnet.dk/DiagramDesigner/
yEd URL: http://www.yworks.com/en/products_yed_about.html
Open Office Draw
Requirement 1.2:
Build firewall and router configurations that restrict connections between untrusted networks and any system components in the cardholder data environment.
1. Firewall Auditor Inspect Firewall Configuration to ensure its properly configured URL: http://www.firewallauditor.com/Download/
Supported Firewall:
Check Point Firewall-1 versions NG™ FP3 and later (including those firewalls that are cluster members), Cisco (PIX versions 6.0 and later, ASA versions 7 and later, FWSM version 3.0 and later Juniper Networks (NetScreen versions 5.0 and later)
2. Nipper
Page 3 of 28 Meet PCI DSS Requirements with FOSS
Configuration audit using Nipper
Titania Nipper (Evaluation, Free version are available with BackTrack OS) URL: https://www.titania.com/nipperstudio
Page 4 of 28 Meet PCI DSS Requirements with FOSS
Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters
1. Default Username and password of some Network Devices URL: http://www.datarecovery.com/default_passwords.php
2. Configuration audit using Nipper Titania Nipper (Evaluation, Free version are available with BackTrack OS) URL: https://www.titania.com/nipperstudio
3. Open Audit
Open-AudIT is an application to tell you exactly what is on your network, how it is configured and when it changes.
URL: http://www.open-audit.org/
4. Lynis
Security and system auditing tool (Linux Security Audit Tool) URL: http://cisofy.com/downloads/
5. Tiger (The Unix security audit and intrusion detection tool)
URL: http://www.nongnu.org/tiger/ Download: http://download.savannah.gnu.org/releases/tiger/?C=M;O=D
Page 5 of 28 Meet PCI DSS Requirements with FOSS
Requirement 3: Protect stored cardholder data
Requirement 3.1:
Keep cardholder data storage to a minimum by implementing data retention and disposal policies, procedures and processes that include at least the following for all cardholder data (CHD) storage:
Limiting data storage amount and retention time to that which is required for legal, regulatory, and business requirements Processes for secure deletion of data when no longer needed
Secure Deletion:
1. Eraser:
Eraser is an advanced security tool for Windows which allows you to completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
URL: http://eraser.heidi.ie/download.php
OS Supported : It works with Windows XP (with Service Pack 3), Windows Server 2003 (with Service Pack 2), Windows Vista, Windows Server 2008, Windows 7 and Windows Server 2008 R2, Windows 98, ME, NT, 2000 can still be used with version 5.7
2. Sdelete Utility from SysInternals:
SDelete is a command line utility that takes a number of options. In any given use, it allows you to delete one or more files and/or directories, or to cleanse the free space on a logical disk. SDelete accepts wild card characters as part of the directory or file specifier.
URL: http://technet.microsoft.com/en-us/sysinternals/bb897443.aspx
3. Secure Deletion on Mac OS X Apple's advice on preventing forensic undeletion on Mac OS X is as follows:
To prevent the recovery of files you deleted previously, open Disk Utility (in Applications/Utilities), choose Help > Disk Utility Help, and search for help on erasing free disk space.
4. Secure Deletion on *nix Operating Systems
Secure Deletion of Individual Files
Page 6 of 28 Meet PCI DSS Requirements with FOSS
Linux, FreeBSD and many other UNIX systems have a command line tool called shred installed on them. Shred works quite differently to the Windows cipher.exe program; rather than trying to prevent previously deleted files from being recoverable, it singles out specified files and repeatedly overwrites them and their names with random data.
If you are comfortable using a terminal or command line, secure deletion of files with shred is simple. Just run the following command:
Command: shred -u
5. Wipe: Like Eraser, Wipe overwrites deleted files in order to make them impossible to restore.