OmniPCX Record PCI Compliance 2.3

Transcription

1 S T R A T E G I C W H I T E P A P E R OmniPCX Recrd PCI Cmpliance 2.3 Alcatel-Lucent Enterprise Services Page 1/11

2 OmniPCX-Recrd R2.3 PCI Cmpliance White Paper Legal ntice Alcatel, Lucent, Alcatel-Lucent and the Alcatel-Lucent lg are trademarks f Alcatel-Lucent. All ther trademarks are the prperty f their respective wners. The infrmatin presented is subject t change withut ntice. Alcatel-Lucent assumes n respnsibility fr inaccuracies cntained herein. Cpyright 2013 Alcatel-Lucent. All rights reserved. Alcatel-Lucent Enterprise Services Ref. 3KF30040SMNGSPZZA Ed.03 Page 2/11

3 OmniPCX-Recrd R2.3 PCI Cmpliance White Paper Index table Dcument histry Scpe Overview Purpse f this dcument Glssary f Terms Intrductin Overview PCI Cmpliance Applicability Statement Current PCI Requirements Reference Accmmdating PCI Cmpliance PCI DSS v Build and Maintain a Secure Netwrk Prtect Cardhlder Data Maintain a Vulnerability Management Prgramme Implement Strng Access Cntrl Measures Regular Mnitr & Netwrk Tests OmniPCX RECORD Mving Frward Rad Map Alcatel-Lucent Enterprise Services Ref. 3KF30040SMNGSPZZA Ed.03 Page 3/11

4 OmniPCX-Recrd R2.3 PCI Cmpliance White Paper Dcument histry Editin Date Changes / Cmments / Details Initial Dcument Remve statement suggesting that OPXR supprts 256 Bit Encryptin & Vide Encryptin Initial Release Alcatel-Lucent Enterprise Services Ref. 3KF30040SMNGSPZZA Ed.03 Page 4/11

5 OmniPCX-Recrd R2.3 PCI Cmpliance White Paper 1 Scpe 1.1 Overview Purpse f this dcument This OmniPCX Recrd white paper has been written t explain PCI standards, hw they prtect persnal infrmatin when transactins are prcessed, bur mst imprtantly, t demnstrate that OmniPCX Recrd V2.0 and abve Offers the necessary features t enable cmpanies t cmply with these regulatins. Nte: Fr a full list f the features & functinality that OmniPCX RECORD ffers in rder t maintain PCI cmpliance, please refer t the OmniPCX RECORD feature list. Alcatel-Lucent Enterprise Services Ref. 3KF30040SMNGSPZZA Ed.03 Page 5/11

6 OmniPCX-Recrd R2.3 PCI Cmpliance White Paper 2 Glssary f Terms PCIDSS Payment Card Industry Data security standard PCI Payment Card Industry QSA Qualified Security Assessr SAQ Self Assessment Questinnaire API Applicatin Prgrammers Interface IT Infrmatin Technlgy PIN Private Identificatin Number SHA Secure Hash Algrithm PC Persnal Cmputer SNMP Simple Netwrk Management Prtcl ID Identificatin Alcatel-Lucent Enterprise Services Ref. 3KF30040SMNGSPZZA Ed.03 Page 6/11

7 OmniPCX-Recrd R2.3 PCI Cmpliance White Paper 3 Intrductin 3.1 Overview PCI Cmpliance The Payment Card Industry Data security standard (PCIDSS) is a wrldwide infrmatin security standard defined by the cuncil f the same name. The standard was created t help rganisatins that prcess card payments in preventing credit card fraud thrugh increased cntrls arund data and their expsure t cmprmise. The standard applies t all rganisatins that hld, prcess, r exchange cardhlder infrmatin frm any card branded with the lg f ne f the credit card brands. Valuatin f cmpliance can be perfrmed internally r externally depending upn the vlume f the card transactins the rganisatin is handling, but regardless f the size f the rganisatin, cmpliance must be assessed annually. Organisatins handling large vlumes f transactins must have their cmpliance assessed by an independent assessr knwn as a Qualified Securities Assessr (QSA), while cmpanies handling smaller vlumes have the ptin f demnstrating cmpliance by cmpleting a Self Assessment Questinnaire (SAQ). In sme regins, SAQs still require sign-ff by a QSA fr submissin. Cmpanies whse cmpliance is shwn t have shrt cmings and wh maintain a relatinship with ne r mre f the card brands risk lsing their ability t prcess credit card payments and being audited and/ r fined. Nte: It is imprtant t nte that n call recrding systems can be regarded as being PCI DSS cmpliant: it is the envirnment in which they are used that may be said t be cmpliant, as cncluded by the security assessr. This is because the PCI DSS is subject t interpretatin and nly cmpanies can cmply. 3.2 Intended Readership This manual targets the persn respnsible fr maintaining PCI Cmpliance thrughut their rganisatin. 3.3 Applicability Statement This white paper applies t: OmniPCX Recrd versin 2.x (and abve). 3.4 Current PCI Requirements Reference The current versin f the PCI Cmpliance standards is V2.0 released n 26/10/2010 See: Alcatel-Lucent Enterprise Services Ref. 3KF30040SMNGSPZZA Ed.03 Page 7/11

8 OmniPCX-Recrd R2.3 PCI Cmpliance White Paper 4 Accmmdating PCI Cmpliance 4.1 PCI DSS v2.0 PCI DSS v2.0 must be adpted by all rganisatins with payment card data by 1st January 2011, and frm 1st January 2012 all assessments must be under versin 2.0 f the standard. The headings and explanatins belw summarize the pints frm V1.2 01/10/2008 and specify the requirements fr cmpliance and then a discussin n hw OmniPCX Recrd assists in helping cmpany s cmply. These are rganised int six lgically related grups, which are called "cntrl bjectives" as utlined belw Build and Maintain a Secure Netwrk The first relevant PCI DSS requirement here is t install and maintain a firewall cnfiguratin t prtect cardhlder data. OmniPCX Recrd perates with a netwrk firewall. A list f services and prts necessary fr its peratin is prvided and the default settings can be changed by the netwrk administratr. The secnd relevant PCI DSS requirement states that cmpanies shuld nt use vendrsupplied defaults fr system passwrds during the system installatin and custmers are advised t change system default passwrds during system installatin. OmniPCX Recrd incrprates strng authenticatin and passwrd encryptin and it als prvides supprt fr user authenticatin via a Radius Server. All server-based cmpnents f the OmniPCX Recrd slutin run as Micrsft Windws services t prvide enhanced security and data prtectin and they can be safely assciated with Windws dmains fr better cntrl and cmpliance with custmer IT plicies Prtect Cardhlder Data The third relevant PCI DSS requirement states that stred card hlder data must be prtected. OmniPCX Recrd prvides supprt fr data archival and retentin plicies. Strng encryptin f stred audi is prvided using 128 bit key lengths. Wherever these files are stred, they remain encrypted. This als includes data backups and archives. OmniPCX Recrd prvides at the entry-level a web-based PC applicatin, which allws the user t manually select a sftware buttn n their PC t cmmence the suppressin f audi/vide (pause) and resume the recrding f audi/vide. In additin there is an autmatic time ut setting which will ptinally start the recrder again, if the user frgets t resume recrding. OmniPCX Recrd als prvides an API (Applicatin Prgrammer s Interface) fr system integratrs t develp middleware t pause and resume recrding during a transactin. This prevents credit card and ther persnal data frm being recrded via vice r screen. A system can then avid all capture and retentin f infrmatin cntaining card validatin cdes, and ther PIN infrmatin. The furth relevant PCI DSS requirement is t encrypt transmissin f cardhlder data acrss pen and public netwrks. Recrdings can be encrypted and therefre all netwrk transmissins under these circumstances will als be encrypted. When the calls are required Alcatel-Lucent Enterprise Services Ref. 3KF30040SMNGSPZZA Ed.03 Page 8/11

9 OmniPCX-Recrd R2.3 PCI Cmpliance White Paper fr replay r fr any further analyses they are nly decrypted just befre use n the lcal device. OmniPCX Recrd prvides an encrypted player fr this purpse Maintain a Vulnerability Management Prgramme The fifth relevant PCI DSS requirement is t develp and maintain secure systems and applicatins. OmniPCX Recrd emplys a fast prcess fr certifying Micrsft s critical and imprtant security patches. Certificatin f these patches is based upn the Alcatel-Lucent Security Certificatin plicy. Alcatel-Lucent develps sftware applicatins based n industry best practices. Infrmatin security is incrprated thrughut the sftware develpment life cycle Implement Strng Access Cntrl Measures The sixth relevant PCI DSS requirement is t restrict access t cardhlder data by business need-t-knw. OmniPCX Recrd uses a prfile-based user administratin methdlgy t cntrl user access. A prfile cnsists f a set f privileges that define system functins and resurces t which access is permitted. Changes f prfile are dynamic and changes will take effect as sn as the infrmatin is saved. Every user with access t the system is assigned a unique User ID. All users need t input a unique user ID and a valid passwrd befre gaining access t the recrder. User passwrds are hashed and stred using an industry standard 128-bit SHA (Secure Hash Algrithm designed by the Natinal Security Agency). Specific passwrd management capabilities f the OmniPCX Recrd slutin supprting this requirement include the fllwing: Additin, deletin and mdificatin f user infrmatin is nly allwed by authrised and verified persnnel Users are autmatically required t repeat the lgin prcess after 15 minutes f activity (user cnfigurable) Optinal supprt fr Radius Server is prvided t allw fr user authenticatin and single sign-n based n users Micrsft Windw s credentials as well as fr cnsistent user administratin and passwrd management plicies in the rganisatin. The seventh relevant PCI DSS requirement is t restrict access t cardhlder data. With OmniPCX Recrd, users must have specific access prfile rights in rder t exprt audi and vide t ther media and frmats Alcatel-Lucent Enterprise Services Ref. 3KF30040SMNGSPZZA Ed.03 Page 9/11

10 OmniPCX-Recrd R2.3 PCI Cmpliance White Paper Regular Mnitr & Netwrk Tests The next relevant PCI DSS requirement is t track and mnitr resurces and cardhlder data. T this end, OmniPCX Recrd autmatically captures system audit infrmatin n many different user transactins, as fllws: User accunt security settings including bth successful and failed lgin attempts Playback events including exprting f the recrding User, grup r prfile changes Silent mnitring and recrd n demand events Changing the system rules Changes t the system cnfiguratin. Includes lggers, servers and dmains In additin, we audit infrmatin cntained in the audit trails including User identificatin Type f event Date and Time Success r failure indicatin Originatin f event Identity f name f affected data, system cmpnents r resurce All users must have specific access rights in rder t access the audit trail infrmatin. Audit trail infrmatin is maintained n line. Audit trail infrmatin is saved in a Micrsft SQL Server database prviding query, reprting, backup, archiving and security features. All system cmpnents maintain cmprehensive lgs and utilise SNMP alerts t reprt malfunctins. And finally the last relevant PCI DSS requirement is t regularly test systems and prcesses. Alcatel-Lucent ensures that OmniPCX Recrd underges rigrus testing fr cmpliance with best practice security requirements. 5 OmniPCX RECORD Mving Frward 5.1 Rad Map Fr each successive radmap delivery f OmniPCX Recrd versin 2+, there are nging updates and imprvements t the system. This paper highlights the lengths that we have gne t in rder t ffer cmpanies a prduct that will help them be PCI cmpliant. Fr further infrmatin abut hw individual levels f sftware have new cmpliant-friendly features built in, please cntact Alcatel-Lucent Prfessinal Services by at the fllwing address. prfessinal.services@alcatel-lucent.cm Alcatel-Lucent Enterprise Services Ref. 3KF30040SMNGSPZZA Ed.03 Page 10/11

11 OmniPCX-Recrd R2.3 PCI Cmpliance White Paper Alcatel, Lucent, Alcatel-Lucent and the Alcatel-Lucent lg are trademarks f Alcatel-Lucent. All ther trademarks are the prperty f their respective wners. The infrmatin presented is subject t change withut ntice. Alcatel-Lucent assumes n respnsibility fr inaccuracies cntained herein. Cpyright 2013 Alcatel-Lucent. All rights reserved. Alcatel-Lucent Enterprise Services Ref. 3KF30040SMNGSPZZA Ed.03 Page 11/11