Achieving PCI DSS compliance
using DataSecurity Plus

Requirement 2.2.5

Remove all unnecessary functions, such as scripts, drivers, features, subsystems, file systems, and unnecessary web servers.

Locate unused files:

Receive reports on files, scripts, batch files, and more that have not been accessed or modified for extended periods of time. These reports simplify redundant, outdated, and trivial (ROT) file management and reduce the number of vulnerable files with outdated permissions or data.

Requirement 3.1

Keep cardholder data storage to a minimum by implementing data retention and disposal policies, procedures, and processes that include at least the following for all cardholder data storage:

• Limiting data storage amount and retention time to that which is required for legal, regulatory, and/or business requirements
• Specific retention requirements for cardholder data
• Processes for secure deletion of data when no longer needed
• A quarterly process for identifying and securely deleting stored cardholder data that exceeds defined retention

• Periodically scan for regulated data in your card data environment (CDE).
• Set up data retention policies—collected data should be deleted when it is no longer needed.
• Locate and remove cardholder data that is stored beyond its permissible life time.

PCI and cardholder data discovery

Use built-in data discovery rules to locate PCI and cardholder data stored by your organization. Create an inventory of what data is stored, where, by whom, and for how long. This allows administrators to ensure that only necessary data is stored.

ROT data analysis

Identify old, stale, and unmodified files to ensure that cardholder data is not stored beyond its intended retention period.

Scheduled data risk assessment scans

Perform periodic cardholder data discovery scans, enable incremental scanning of new and recently modified files, and ensure that every instance of regulated data is discovered and cataloged. You can also use scripts to quarantine or delete files that violate sensitive data storage policies.

Requirement 3.2

Do not store sensitive authentication data after authorization.

Sensitive authentication data includes cardholder name, primary account number (PAN), card verification code, personal identification number (PIN), and more.

It is permissible for issuers and companies that support issuing services to store sensitive authentication data if:

• There is a business justification
• And the data is stored securely

PCI data discovery

Implement effective data discovery with a combination of keyword-matching and pattern-matching. Together, these will help you locate card verification values (CVV), PIN, PAN, and other authentication data.

Confidence scoring

Verify the context of potential matches to determine the certainty of a match being a True Positive instead of a False Positive.

Response automation

Automate the deletion or quarantining of detected card data, or limit its use by carrying out a customized action using scripts.

Requirement 3.5.2

Restrict access to cryptographic keys to the fewest number of custodians necessary.

NTFS and share permissions reporting

Receive detailed reports on the NTFS and share permissions of files and folders to know which user has what permission to them.

Requirement 7.1

Limit access to system components and cardholder data to only those individuals whose job requires such access.

7.1.1 Define access needs for each role

7.1.2 Restrict access to privileged user IDs

7.1.3 Assign access based on individual personnel's job classification and function.

Note: System components include network devices, servers, computing devices, and applications.

• Necessary for that individual’s job function
• Restricted to least privileges necessary to perform job responsibilities.

NTFS permission reporting

Effective permission analysis

Detection of overexposed files

Locate files that can be accessed by every employee and files that allow full control access to users.

Requirement 8.1.3

Immediately revoke access for any terminated users.

Analyze file ownership

Identify orphaned files and files owned by stale, disabled, or inactive users to prevent malicious file change attempts by terminated employees.

Requirement 10.1

Implement audit trails to link all access to system components to each individual user.

Detailed audit trail

Track critical file accesses, web app usage, USB usage, printer usage, and more with a centralized access audit log.

Root cause analysis

Leverage granular report filtering options to expedite root cause analysis and identify the extent of a breach.

Requirement 10.2

Implement automated audit trails for all system components to reconstruct the following events:

10.2.1 All individual user accesses to cardholder data

10.2.2 All actions taken by any individual with root or administrative privileges

• Audit user activity in your CDE in real time.
• Track changes made by users with administrative privileges.

File activity monitoring

Track all file and folder events—read, create, modify, overwrite, move, rename, delete, and permission change events—happening in your PCI and cardholder data storage environment.

Privileged user monitoring

List users with privileged access to sensitive files and customize reports to monitor all file changes made by them.

Requirement 10.3

Record at least the following audit trail entries for each event:

10.3.1 User identification

10.3.2 Type of event

10.3.3 Date and time

10.3.4 Success or failure indication

10.3.5 Origination of event

10.3.6 Identity or name of affected data

Real-time change auditing

Get complete information on every file access, including details on who attempted what change, in which file, when, from where, and whether they were successful.

Requirement 10.5

Secure audit trails so they cannot be altered.

10.5.5 Use file integrity monitoring or change detection software on logs to ensure that existing log data cannot be changed without generating alerts (although new data being added should not cause an alert).

PCI file integrity monitoring

Audit every successful and failed file access attempts in real time. Maintain a detailed audit trail for analysis.

Real-time alerts

Trigger instant alerts to notify stakeholders when suspicious file changes are detected.

Automated security incident response

Execute automated responses to minimize potential damage in the event of a security incident.

Requirement 10.6

Review logs and security events for all system components to identify anomalies or suspicious activity.

Scheduled delivery of PCI compliance reports

Deliver scheduled reports to stakeholders' mailboxes in PDF, HTML, CSV, or XLSX format.

Requirement 10.7

Retain audit trail history for at least one year with a minimum of three months immediately available for analysis (for example, online, archived, or restorable from a backup).

Long-term audit log retention

Retain audit data for long periods. You can also archive older logs and upload them at a later date to analyze file accesses.

Requirement 11.5

Deploy a change detection mechanism (for example, file integrity monitoring tools) to alert personnel to unauthorized modification (including changes, additions, and deletions) of critical system files, configuration files, or content files; and configure the tool to perform critical file comparisons at least weekly.

• Monitor changes in system executables, application executables, configuration and parameter files, and more.
• Trigger alerts in the event of unexpected changes.

FIM

Audit changes made to application and OS-critical binaries, configuration files, application files, log files, and more.

Instant alerts

Notify administrators instantly when anomalous file changes are detected.

Execute custom incident responses

Automate batch files to shut down machines, end user sessions, and more.

Requirement 12.3.10

For personnel accessing cardholder data via remote-access technologies, prohibit the copying, moving, and storing of cardholder data on local hard drives and removable electronic media, unless explicitly authorized for a defined business need.

File copy protection

Monitor file copy actions in real time and prevent the unwarranted transfer of critical data across local and network shares.

USB write-protection

Blocklist suspicious USB devices and prevent users from exfiltrating sensitive data.

Requirement A3.2.5

Implement a data discovery methodology to confirm the scope of PCI DSS and to locate all sources and locations of clear-text PAN at least quarterly and upon significant changes to the cardholder environment or processes.

A3.2.5.1

A3.2.5.2

Implement response procedures to be initiated upon the detection of clear-text PAN outside of the CDE to include:

• Procedures for determining what to do if clear-text PAN is discovered outside of the CDE, including its retrieval, secure deletion and/or migration into the currently defined CDE
• Procedures for determining how the data ended up outside of the CDE
• Procedures for identifying the source of the data

• Periodically report on the locations of cardholder data in file storage environment.
• Identify sensitive data residing outside the defined CDE.
• Perform remedial actions when sensitive data is discovered outside the CDE.

Schedule-based PCI data discovery

Identify and document PCI data (including clear-text PAN) across enterprise storage.

Multi-platform visibility

Detect sensitive cardholder and PCI data across Windows file servers, failover clusters, and MSSQL databases.

Automate remediation

When sensitive files are found outside the CDE, DataSecurity Plus can be configured to automatically delete, move, or otherwise manage them.

Ownership and access analysis

Know who owns the sensitive file and trace all user actions in the time frame under analysis. This will help you determine how it ended up outside the CDE.

Requirement A3.2.6

Implement mechanisms for detecting and preventing clear-text PAN from leaving the CDE via an unauthorized channel, method, or process, including generation of audit logs and alerts.

A3.2.6.1

Implement response procedures to be initiated upon the detection of attempts to remove clear-text PAN from the CDE via an unauthorized channel, method, or process.

Unified data loss prevention platform

Classify sensitive data and prevent its leakage via external storage devices, Outlook, and printers.

Control peripheral device usage

Restrict the use of USB devices, wireless access points, and CD/DVD drives using central device control policies to protect against data exfiltration.

Prevent data leaks via USBs

Block USB devices in response to anomalous data transfers and attempts to exfiltrate sensitive data.

Requirement A3.4.1

Review user accounts and access privileges to in-scope system components at least every six months to ensure user accounts and access remain appropriate based on job function.

PCI DSS reference: Requirement 7

Security permission analysis:

Track permission changes, list effective permissions, identify files that can be accessed by every employee, find users with Full control privileges, and more to help ensure that the principle of least privilege is followed.

These reports can be mailed on a set schedule to multiple stakeholders.

Requirement A3.5.1

Implement a methodology for the timely identification of attack patterns and undesirable behavior across systems—for example, using coordinated manual reviews and/or centrally managed or automated log-correlation tools—to include at least the following:

• Identification of anomalies or suspicious activity as it occurs
• Issuance of timely alerts upon detection of suspicious activity or anomaly to responsible personnel
• Response to alerts in accordance with documented response procedures

PCI DSS reference: Requirements 10, 12

Anomaly detection

Identify user activity anomalies such as file accesses after business hours, an excessive number of failed access attempts, and more.

Rapid alerts

Configure alerts for unwarranted changes in critical files, discovery of sensitive data outside the CDE, and more.

Threat detection and response

Detect ransomware intrusions and execute scripts to quarantine infected machines and prevent the spread of malware.