The Payment Card Industry Data Security Standard (PCI DSS) is not new. It has existed for several years and provides security guidelines and best practices for the storage and processing of personal cardholder data. This article takes a look at PCI DSS 3.2 (published in April of 2016) and shows how Identity Management in Red Hat Enterprise Linux (IdM) and related technologies can help customers to address PCI DSS requirements to achieve and stay compliant with the standard. If you need a copy of the PCI DSS document it can be acquired from the document library at the following site: www.pcisecuritystandards.org
In October of 2015 Red Hat published a paper that gives an overview of the PCI DSS standard and shows how Red Hat Satellite and other parts of the Red Hat portfolio can help customers to address their PCI compliance challenges. In this post I would like to expand on this paper and drill down into more detail about
the Identity Management solution Red Hat provides and how it can be leveraged to achieve PCI DSS compliance in conjunction with other technologies as covered in the paper.
Note that this post assumes familiarity with the Red Hat IdM solution. If you're not "up-to-speed" - please review our Identity Management documentation. Also, my previous blog posts provide a good foundation for the problem space and understanding of the solution. Identity Management in Red Hat Enterprise Linux is an open source solution based on the FreeIPA community project. There is a public instance of the FreeIPA server running in the cloud that you can connect to and explore using the following link: http://www.freeipa.org/page/Demo
Since the standard is quite big I will break this article into a series of individual posts - addressing one section at a time. The following table will help in terms of mapping each section of the PCI document to each follow-up post.
Requirement Number | Requirement Description | Link to Blog Post / Reference |
1 | Install and maintain a firewall configuration to protect cardholder data. | PCI Series: Requirement 1 - Install and Maintain a Firewall Configuration to Protect Cardholder Data |
2 | Do not use vendor-supplied defaults for system passwords and other security parameters. | PCI Series: Requirement 2 - Do Not Use Vendor-Supplied Defaults for System Passwords and Other Security Parameters |
3 | Protect stored cardholder data. | PCI Series: Requirement 3 - Protect Stored Cardholder Data |
4 | Encrypt transmission of cardholder data across open, public networks. | The same approach as discussed for requirement number two (2) can be employed to meet requirements in this part of the PCI DSS standard. |
5 | Protect all systems against malware and regularly update anti-virus software or programs. | Red Hat Identity Management is not directly related to this section. Reference / review section five (5) of the PCI DSS standard. |
6 | Develop and maintain secure systems and applications. | PCI Series: Requirement 6 - Develop and Maintain Secure Systems and Applications |
7 | Restrict access to cardholder data by business need to know. | PCI Series: Requirement 7 - Restrict Access to Cardholder Data by Business Need to Know |
8 | Identify and authenticate access to system components. | PCI Series: Requirement 8 - Identify and Authenticate Access to System Components |
9 | Restrict physical access to cardholder data. | Red Hat Identity Management is not directly related to this section. Reference / review section nine (9) of the PCI DSS standard. |
10 | Track and monitor all access to network resources and cardholder data. | PCI Series: Requirement 10 - Track and Monitor All Access to Network Resources and Cardholder Data |
11 | Regularly test security systems and processes. |
Requirements 11 and 12 talk about testing of the security controls. This includes scanning and monitoring and best practices around the security policy itself that organizations should create and maintain. Red Hat Identity Management is not directly related to these sections.
|
12 | Maintain a policy that addresses information security for all personnel. |
It's worth mentioning that while this series is focused on IdM and its ecosystem - there are other parts of Red Hat portfolio that would allow for addressing some of the PCI DSS requirements that we did not drill down into here. For example, the OpenSCAP scanner that's integrated into Red Hat Satellite 6 allows for the regular detection of unaddressed CVEs and misconfigurations according to a defined policy. To get more information about these technologies and how they help to address PCI DSS requirements please see the Achieving and Maintaining PCI DSS Compliance with Red Hat paper on the Red Hat site.
In closing - stay tuned for my future posts on PCI DSS. If they're already live - you'll see active links in the table (above). General questions about PCI DSS and IdM? Feel free to reach out using the comments section (below).
Sobre o autor
Navegue por canal
Automação
Últimas novidades em automação de TI para empresas de tecnologia, equipes e ambientes
Inteligência artificial
Descubra as atualizações nas plataformas que proporcionam aos clientes executar suas cargas de trabalho de IA em qualquer ambiente
Nuvem híbrida aberta
Veja como construímos um futuro mais flexível com a nuvem híbrida
Segurança
Veja as últimas novidades sobre como reduzimos riscos em ambientes e tecnologias
Edge computing
Saiba quais são as atualizações nas plataformas que simplificam as operações na borda
Infraestrutura
Saiba o que há de mais recente na plataforma Linux empresarial líder mundial
Aplicações
Conheça nossas soluções desenvolvidas para ajudar você a superar os desafios mais complexos de aplicações
Programas originais
Veja as histórias divertidas de criadores e líderes em tecnologia empresarial
Produtos
- Red Hat Enterprise Linux
- Red Hat OpenShift
- Red Hat Ansible Automation Platform
- Red Hat Cloud Services
- Veja todos os produtos
Ferramentas
- Treinamento e certificação
- Minha conta
- Suporte ao cliente
- Recursos para desenvolvedores
- Encontre um parceiro
- Red Hat Ecosystem Catalog
- Calculadora de valor Red Hat
- Documentação
Experimente, compre, venda
Comunicação
- Contate o setor de vendas
- Fale com o Atendimento ao Cliente
- Contate o setor de treinamento
- Redes sociais
Sobre a Red Hat
A Red Hat é a líder mundial em soluções empresariais open source como Linux, nuvem, containers e Kubernetes. Fornecemos soluções robustas que facilitam o trabalho em diversas plataformas e ambientes, do datacenter principal até a borda da rede.
Selecione um idioma
Red Hat legal and privacy links
- Sobre a Red Hat
- Oportunidades de emprego
- Eventos
- Escritórios
- Fale com a Red Hat
- Blog da Red Hat
- Diversidade, equidade e inclusão
- Cool Stuff Store
- Red Hat Summit