How can OSSIM help you with your PCI DSS Wireless requirements?

Transcription

1 How can OSSIM help you with your PCI DSS Wireless requirements?

2 Topics PCI DSS How PCI applies to Wireless What is OSSIM? The advantages of Open Source The Open Source approach

3 PCI DSS PCI DSS is a security standard for enhancing payment account data security. Includes requirements for several protective measures like policies, procedures, software design PCI purpose is to protect customer account data.

4 Isolate wireless traffic from the Cardholder Data Environment and monitor logs generated and deploy an IDS/IPS. PCI DSS outlines some Wireless requirements: How PCI applies to wireless Maintains an up-to-date wireless hardware inventory. Scan for the presence of wireless access points / deploy a wireless IDS. Deploy an automatic system to alert and eliminate rogue devices and unauthorized wireless connections.

5 OSSIM What is Ossim? Alienvault SIEM (Ossim) provides the industry s most complete and integrated Information Security Management Solution offering all the necessay levels, from the detection at low level to the report and definition of security metrics. Ossim is capable to collect all the information of your network and systems and process the information to discover potential risk for your organization offering high level state indicators that allow us to guide inspection and measure the security situation of our organization.

6 The advantages of Open Source The advantages of the Open Source Lower Software costs Access to underlying source code Easily modifiable and adaptable to customer needs.

7 Ossim approach Case Study: Using Ossim to comply with PCS DSS Wireless requirements On the proposed approach Ossim leans on Kismet, an Open Source detector and wireles intrusion detection system to collect the necessary information to cover PCI DSS requirements.

8 Environment

9 Environment Collection To comply with PCI DSS requirements Ossim will collect and process: Firewall logs to Cardholder Data Environment (CDE). Router/VPN logs to CDE location. IDS alerts (Snort ) from the Ossim sensor receiving mirrored traffic from the switch. Wireless IDS (Kismet) logs and alerts from wireless sensors deployed covering wireless

10 PCI Requirements I PCI Requirement: Maintains an up-to-date wireless hardware inventory. Ossim system incorporates active inventory through OCS deployment, passive host discovery via Ntop and integrates with Nedi to automatically network discovery.

11 PCI Requirement II PCI Requirement: Scan for the presence of wireless access points / deploy a wireless IDS. The deployed wireless sensors allow us to detect wireless access points as well as alerts generated from the included wireless intrusion detection system.

12 PCI Requirement II PCI Requirement: Scan for the presence of wireless access points / deploy a wireless IDS.

13 PCI Requirement II PCI Requirement: Scan for the presence of wireless access points / deploy a wireless IDS.

14 PCI Requirement III PCI Requirement: Deploy an automatic system to alert and eliminate rogue devices and unauthorized wireless connections. The Wireless sensors will detect non registered Access Points. Once an AP is detected, the Ossim system will check if the hardware is connected to the enterprise network (Rogue AP) through the information collected by Ntop and Nedi.

15 PCI Requirement IV PCI Requirement: Isolate wireless traffic from the Cardholder Data Environment and monitor logs generated and deploy an IDS/ IPS. The system will collect, correlate and report possible attacks detected from wireless clients to the Cardholder Data envirnment.

16 PCI Requirement IV PCI Requirement: Isolate wireless traffic from the Cardholder Data Environment and monitor logs generated and deploy an IDS/ IPS.

17 PCI Requirement V PCI Requirement: Verify strong cryptography is being used on transmission of cardholder data over encrypted Wireless networks. The Wireless sensor is capable to detect unencrypted wireless access points inside the defined wireless network.

18 Reporting Reporting Make the most of the customizable reporting capabilities with a high abstraction layer.

19 Reporting Reporting

20 Credits Jaime Blasco Alienvault Labs