Terminal Security Changes

Transcription

1 Terminal Security Changes Terminal security requirements will be strengthened in support of Payment Card Industry Data Security Standards. This advisory addresses these new requirements. Galileo by Travelport Web: Terminal Security Changes January 4, External Audience Page: 1

2 Contents Terminal Security Changes...1 Terminal Security Changes...3 Product Enhancement Advisory...3 Summary... 3 Overview... 3 Background... 3 Enhancement Description... 3 Password required...3 Minimum number of characters in password...3 Removal of inactive sign ons...4 Robotic account and robotic gtid...4 Structured Data...5 Target Market... 5 Best Practices... 5 References... 5 Terminal Security Changes January 4, External Audience Page: 2

3 Terminal Security Changes Product Enhancement Advisory Summary Who All Apollo and Galileo system users What Terminal security changes Where All markets When April 23, 2007 Action Required Update sign on profiles to meet the new requirements 90 Day Advisory Yes Contact Your Account Executive Overview Terminal security enhancements in support of Payment Card Industry Data Security Specifications (PCIDSS or PCI compliance) require additional restrictions in the handling of sign on profiles. These restrictions apply to the use of passwords, the characteristics of the passwords, and the use of shared sign ons. Details of these changes will be covered in this advisory and these changes can be made beginning right away. In addition, changes will be made to sign on profiles and gtid initialization for automated applications (robotics). These changes will be implemented in April. Background PCIDSS requires each user have their own access to the system, that the system access be password protected, and that the password be robust. Details on PCIDSS can be found at this link: rity_standard.pdf PCI compliance is in the best interests of everyone. Agency customers expect their data to be protected by their agency and their agency s business partners. These enhancements will strengthen system access security and make customer data more secure. Enhancement Description Password required Each sign on profile will be required to use a password, except for robotic sign ons. Today some sign on profiles have been set to allow password bypass. With the new checks, passwords will be required for each user of the Apollo or Galileo systems. Sign ons which do not currently use a password can be changed starting right away. Although the checks will not occur until April, agencies should begin adding passwords for all agents. Minimum number of characters in password Passwords will be required to contain at least seven characters. Today passwords require a minimum of six characters. As passwords expire over the next several months, system users should use a minimum of seven characters in their new password. This change can be made immediately. After the enhancement goes into effect, attempts to set a password with less than seven characters will receive one of the following responses, depending on the system used: ERR: PASSWORD APOLLO ERR: PASSWORD GALILEO Terminal Security Changes January 4, External Audience Page: 3

4 Removal of inactive sign ons With this enhancement, sign on profiles that have not been used in 90 days will be automatically removed from the system. Agents who occasionally access the system should be sure to sign in regularly to keep their sign on live. No other action is required on the part of agencies or users. Robotic account and robotic gtid In addition to the enhancements above which agencies can being to support immediately, a new setting in the sign on profile will be created which will indicate the sign on profile is associated with a robotic application. In addition, the robotic sign on can only be used in association with a gtid initialization, or terminal type, for robotics. Specifics of the new terminal type will be announced in an update to this advisory. The new sign on profile setting will be on the third page of the profile, which is accessed by adding the characters /** to the sign on display entry. For example, for C0V sign on TS, enter STD/ZTS/** or STD/ZC0V/** to display the third page. The new indicator is RBTC. The following screen captures indicate how the third page of the sign on profile will look. Apollo >STD/ C /** NAME: TEST ACCOUNT ADDRESS CODE: COVNZ. TERMINALS IN USE: F30E11/... AUTHORITY LEVEL: SECOND 1ST LEVEL: N 2ND LEVEL: N SELAC Y Y PFARE Y Y PDQA- Y Y BILL- N. APHDL N. DARVP Y Y COWNR Y Y ETOD- Y Y STRT- N N FSHP- N N DIAL- N N SPVRQ Y Y MSGQ- Y Y RULB- Y Y RULD- Y Y RULX- Y Y MNTR- N N HORAC Y Y PREV- Y Y PRO-C Y Y PRO-D Y Y PRO-M Y Y PRO-N Y Y PRO-O Y Y PRO-R Y Y PRO-T Y Y PRO-U Y Y QFWD- Y Y QSUM- Y Y AATV- N N DOTA N N HMLRG N N CMSK Y Y RBTC Y N Galileo >STD/ C /** NAME: TEST ACCOUNT ADDRESS CODE: COVNZ TERMINALS IN USE:.../... AUTHORITY LEVEL: SECOND REQUESTER ID:... TYPE:... STOCK Y Y SALE Y Y MCOST Y Y CHKIN Y Y COMM Y Y PAYMT Y Y RFRSH Y Y HLINE Y Y DEBT Y Y SELL Y N CLEAR Y Y PINV Y Y APRT Y Y ECCBP Y Y CCBYP Y Y PDQA Y Y PDQB Y CFILO Y Y CFILC Y Y CFILM Y Y QSORT Y Y CFILD Y Y CFILR Y Y CFILN Y Y CFILT Y Y HORAC Y Y RULB Y Y RULD Y Y RULX Y Y ETOD Y Y CFILU Y Y STRT Y Y AATV N N QFWD N N QSUM N N TKMC N N DOTA N N HMLRG N N CMSK N Y RBTC Y N Most users will have the RBTC indicators set to N N by default. Secondary authorizers and above will have the RBTC field set to Y N by default. This allows them to modify other sign on profiles to indicate they are robotic. Robotic sign ons will be allowed to utilize the password bypass option. Terminal Security Changes January 4, External Audience Page: 4

5 The robotic sign on profile must be used with a robotic terminal type. Typical user sign ons can be used on a robotic gtid or a traditional gtids, but robotic sign ons can only be used on robotic gtids. The following diagram shows the relationships: Robotic GTID Traditional GTID Robotic Sign-on Password bypass=y/n Not able to SON User Sign-on Password bypass=n Structured Data There is no impact to structured data as a result of these changes. Target Market These changes will apply to all users of all types in all countries. Best Practices Agencies should ensure they have at least one secondary authorizer. This will enable agency personnel to update sign on profiles in order to support passwords, robotic indicator, and auto sign off time. If your agency does not have a secondary authorizer, please contact the help desk to have an appropriate person set up as an authorizer. The auto sign off time for profiles should be changed to 30 minutes in order to protect the customers booking data. All agents should set Windows screen savers to keep the screen display secure when their computer is unattended for periods of time. References 2007 Galileo International. All rights reserved. Information in this document is subject to change without notice. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or any means electronic or mechanical, including photocopying and recording for any purpose other than the purchaser s personal use without the written permission of Galileo International. All screen examples and other inserts associated with system output are provided for illustration purposes only. They are not meant to represent actual screen responses, rates, etc. Galileo International may have patents or pending patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. The furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property rights except as expressly provided in any written license agreement from Galileo International. All other companies and product names are trademarks or registered trademarks of their respective holders. Terminal Security Changes January 4, External Audience Page: 5