You are required to use industry-accepted configuration and hardening standards when setting up systems that are part of your PCI scope.
Quick Answer:
What is required for PCI DSS system hardening?
PCI DSS requires industry-accepted configuration and hardening standards for every system in scope, including disabling unused services, removing unnecessary applications, limiting servers to a single role, and changing all default passwords and accounts.
- Hardening applies to any system touching or securing cardholder data: web servers, databases, firewalls, POS systems, and even workstations used for card transactions.
- Start by documenting the full cardholder data flow to identify every system, device, and application that touches it, plus systems that could affect the security of those that do.
- Consistency matters most: once a hardening standard is documented, it must be followed over time and updated as the environment and threat landscape change.
- Automated configuration management tools can help administrators quickly identify systems that have drifted out of compliance with the standard.
*This article was taken from our PCI Guide. For more information on this topic, download our free PCI Guide.
You are required to use industry-accepted configuration and hardening standards when setting up systems that are part of your PCI scope.
Configuration and hardening requirements apply to all computer systems, network devices, and applications used to process or secure cardholder data. This may include things like web servers, database software, firewalls, point-of-sale systems, or workstations used to process credit card transactions.
Examples of system hardening practices include:
- Disabling services and features you don’t use
- Uninstalling applications you don’t need
- Limiting servers to perform a single role
- Removing or disabling default accounts
- Changing default passwords
- Configuring other security settings
Permitting anything unnecessary to remain on a system could introduce vulnerabilities and open you up to additional risk.
Often, organizations get overwhelmed trying to understand how and where to begin implementing system configuration standards, especially in an environment that has expanded and changed over time.
The first step in securing your environment to meet PCI standards is to understand where credit card data is stored, processed, and transmitted. Begin by documenting the flow of cardholder data through your environment, making a list of each system, device, and application it touches along the way. Next, look at the systems and applications that, while not directly touching the data, can affect the security of those that do. Add this information to your documentation.
The key to effective system configuration and hardening is consistency. Once you have identified the systems and applications that need attention and documented a standard that meets your environment’s requirements, make sure processes are in place to follow this standard as time goes on. Keep your standard and process up to date as your business changes and as you discover new threats and vulnerabilities.
Automated tools can simplify the task of enforcing configuration standards, allowing administrators to quickly discover systems that are out of compliance.
Related Posts
.svg)