The Payment Card Industry Data Security Standard (PCI DSS) is not new. It has existed for several years and provides security guidelines and best practices for the storage and processing of personal cardholder data. This article takes a look at PCI DSS 3.2 (published in April of 2016) and shows how Identity Management in Red Hat Enterprise Linux (IdM) and related technologies can help customers to address PCI DSS requirements to achieve and stay compliant with the standard. If you need a copy of the PCI DSS document it can be acquired from the document library at the following site: www.pcisecuritystandards.org
In October of 2015 Red Hat published a paper that gives an overview of the PCI DSS standard and shows how Red Hat Satellite and other parts of the Red Hat portfolio can help customers to address their PCI compliance challenges. In this post I would like to expand on this paper and drill down into more detail about
the Identity Management solution Red Hat provides and how it can be leveraged to achieve PCI DSS compliance in conjunction with other technologies as covered in the paper.
Note that this post assumes familiarity with the Red Hat IdM solution. If you're not "up-to-speed" - please review our Identity Management documentation. Also, my previous blog posts provide a good foundation for the problem space and understanding of the solution. Identity Management in Red Hat Enterprise Linux is an open source solution based on the FreeIPA community project. There is a public instance of the FreeIPA server running in the cloud that you can connect to and explore using the following link: http://www.freeipa.org/page/Demo
Since the standard is quite big I will break this article into a series of individual posts - addressing one section at a time. The following table will help in terms of mapping each section of the PCI document to each follow-up post.
Requirement Number | Requirement Description | Link to Blog Post / Reference |
1 | Install and maintain a firewall configuration to protect cardholder data. | PCI Series: Requirement 1 - Install and Maintain a Firewall Configuration to Protect Cardholder Data |
2 | Do not use vendor-supplied defaults for system passwords and other security parameters. | PCI Series: Requirement 2 - Do Not Use Vendor-Supplied Defaults for System Passwords and Other Security Parameters |
3 | Protect stored cardholder data. | PCI Series: Requirement 3 - Protect Stored Cardholder Data |
4 | Encrypt transmission of cardholder data across open, public networks. | The same approach as discussed for requirement number two (2) can be employed to meet requirements in this part of the PCI DSS standard. |
5 | Protect all systems against malware and regularly update anti-virus software or programs. | Red Hat Identity Management is not directly related to this section. Reference / review section five (5) of the PCI DSS standard. |
6 | Develop and maintain secure systems and applications. | PCI Series: Requirement 6 - Develop and Maintain Secure Systems and Applications |
7 | Restrict access to cardholder data by business need to know. | PCI Series: Requirement 7 - Restrict Access to Cardholder Data by Business Need to Know |
8 | Identify and authenticate access to system components. | PCI Series: Requirement 8 - Identify and Authenticate Access to System Components |
9 | Restrict physical access to cardholder data. | Red Hat Identity Management is not directly related to this section. Reference / review section nine (9) of the PCI DSS standard. |
10 | Track and monitor all access to network resources and cardholder data. | PCI Series: Requirement 10 - Track and Monitor All Access to Network Resources and Cardholder Data |
11 | Regularly test security systems and processes. |
Requirements 11 and 12 talk about testing of the security controls. This includes scanning and monitoring and best practices around the security policy itself that organizations should create and maintain. Red Hat Identity Management is not directly related to these sections.
|
12 | Maintain a policy that addresses information security for all personnel. |
It's worth mentioning that while this series is focused on IdM and its ecosystem - there are other parts of Red Hat portfolio that would allow for addressing some of the PCI DSS requirements that we did not drill down into here. For example, the OpenSCAP scanner that's integrated into Red Hat Satellite 6 allows for the regular detection of unaddressed CVEs and misconfigurations according to a defined policy. To get more information about these technologies and how they help to address PCI DSS requirements please see the Achieving and Maintaining PCI DSS Compliance with Red Hat paper on the Red Hat site.
In closing - stay tuned for my future posts on PCI DSS. If they're already live - you'll see active links in the table (above). General questions about PCI DSS and IdM? Feel free to reach out using the comments section (below).
Sobre el autor
Más similar
Navegar por canal
Automatización
Las últimas novedades en la automatización de la TI para los equipos, la tecnología y los entornos
Inteligencia artificial
Descubra las actualizaciones en las plataformas que permiten a los clientes ejecutar cargas de trabajo de inteligecia artificial en cualquier lugar
Nube híbrida abierta
Vea como construimos un futuro flexible con la nube híbrida
Seguridad
Vea las últimas novedades sobre cómo reducimos los riesgos en entornos y tecnologías
Edge computing
Conozca las actualizaciones en las plataformas que simplifican las operaciones en el edge
Infraestructura
Vea las últimas novedades sobre la plataforma Linux empresarial líder en el mundo
Aplicaciones
Conozca nuestras soluciones para abordar los desafíos más complejos de las aplicaciones
Programas originales
Vea historias divertidas de creadores y líderes en tecnología empresarial
Productos
- Red Hat Enterprise Linux
- Red Hat OpenShift
- Red Hat Ansible Automation Platform
- Servicios de nube
- Ver todos los productos
Herramientas
- Training y Certificación
- Mi cuenta
- Soporte al cliente
- Recursos para desarrolladores
- Busque un partner
- Red Hat Ecosystem Catalog
- Calculador de valor Red Hat
- Documentación
Realice pruebas, compras y ventas
Comunicarse
- Comuníquese con la oficina de ventas
- Comuníquese con el servicio al cliente
- Comuníquese con Red Hat Training
- Redes sociales
Acerca de Red Hat
Somos el proveedor líder a nivel mundial de soluciones empresariales de código abierto, incluyendo Linux, cloud, contenedores y Kubernetes. Ofrecemos soluciones reforzadas, las cuales permiten que las empresas trabajen en distintas plataformas y entornos con facilidad, desde el centro de datos principal hasta el extremo de la red.
Seleccionar idioma
Red Hat legal and privacy links
- Acerca de Red Hat
- Oportunidades de empleo
- Eventos
- Sedes
- Póngase en contacto con Red Hat
- Blog de Red Hat
- Diversidad, igualdad e inclusión
- Cool Stuff Store
- Red Hat Summit