Inscreva-se no feed

The Payment Card Industry Data Security Standard (PCI DSS) is not new. It has existed for several years and provides security guidelines and best practices for the storage and processing of personal cardholder data. This article takes a look at PCI DSS 3.2 (published in April of 2016) and shows how Identity Management in Red Hat Enterprise Linux (IdM) and related technologies can help customers to address PCI DSS requirements to achieve and stay compliant with the standard. If you need a copy of the PCI DSS document it can be acquired from the document library at the following site:

In October of 2015 Red Hat published a paper that gives an overview of the PCI DSS standard and shows how Red Hat Satellite and other parts of the Red Hat portfolio can help customers to address their PCI compliance challenges. In this post I would like to expand on this paper and drill down into more detail about

the Identity Management solution Red Hat provides and how it can be leveraged to achieve PCI DSS compliance in conjunction with other technologies as covered in the paper.

Note that this post assumes familiarity with the Red Hat IdM solution. If you're not "up-to-speed" - please review our Identity Management documentation. Also, my previous blog posts provide a good foundation for the problem space and understanding of the solution. Identity Management in Red Hat Enterprise Linux is an open source solution based on the FreeIPA community project. There is a public instance of the FreeIPA server running in the cloud that you can connect to and explore using the following link:

Since the standard is quite big I will break this article into a series of individual posts - addressing one section at a time. The following table will help in terms of mapping each section of the PCI document to each follow-up post.


Requirement Number Requirement Description Link to Blog Post / Reference
1 Install and maintain a firewall configuration to protect cardholder data. PCI Series: Requirement 1 - Install and Maintain a Firewall Configuration to Protect Cardholder Data
2 Do not use vendor-supplied defaults for system passwords and other security parameters. PCI Series: Requirement 2 - Do Not Use Vendor-Supplied Defaults for System Passwords and Other Security Parameters
3 Protect stored cardholder data. PCI Series: Requirement 3 - Protect Stored Cardholder Data
4 Encrypt transmission of cardholder data across open, public networks. The same approach as discussed for requirement number two (2) can be employed to meet requirements in this part of the PCI DSS standard.
5 Protect all systems against malware and regularly update anti-virus software or programs. Red Hat Identity Management is not directly related to this section. Reference / review section five (5) of the PCI DSS standard.
6 Develop and maintain secure systems and applications. PCI Series: Requirement 6 - Develop and Maintain Secure Systems and Applications
7 Restrict access to cardholder data by business need to know. PCI Series: Requirement 7 - Restrict Access to Cardholder Data by Business Need to Know
8 Identify and authenticate access to system components. PCI Series: Requirement 8 - Identify and Authenticate Access to System Components
9 Restrict physical access to cardholder data. Red Hat Identity Management is not directly related to this section. Reference / review section nine (9) of the PCI DSS standard.
10 Track and monitor all access to network resources and cardholder data. PCI Series: Requirement 10 - Track and Monitor All Access to Network Resources and Cardholder Data
11 Regularly test security systems and processes.
Requirements 11 and 12 talk about testing of the security controls. This includes scanning and monitoring and best practices around the security policy itself that organizations should create and maintain. Red Hat Identity Management is not directly related to these sections.
12 Maintain a policy that addresses information security for all personnel.


It's worth mentioning that while this series is focused on IdM and its ecosystem - there are other parts of Red Hat portfolio that would allow for addressing some of the PCI DSS requirements that we did not drill down into here. For example, the OpenSCAP scanner that's integrated into Red Hat Satellite 6 allows for the regular detection of unaddressed CVEs and misconfigurations according to a defined policy. To get more information about these technologies and how they help to address PCI DSS requirements please see the Achieving and Maintaining PCI DSS Compliance with Red Hat paper on the Red Hat site.

In closing - stay tuned for my future posts on PCI DSS.  If they're already live - you'll see active links in the table (above).  General questions about PCI DSS and IdM?  Feel free to reach out using the comments section (below).

Sobre o autor


Navegue por canal

automation icon


Últimas novidades em automação de TI para empresas de tecnologia, equipes e ambientes

AI icon

Inteligência artificial

Descubra as atualizações nas plataformas que proporcionam aos clientes executar suas cargas de trabalho de IA em qualquer ambiente

open hybrid cloud icon

Nuvem híbrida aberta

Veja como construímos um futuro mais flexível com a nuvem híbrida

security icon


Veja as últimas novidades sobre como reduzimos riscos em ambientes e tecnologias

edge icon

Edge computing

Saiba quais são as atualizações nas plataformas que simplificam as operações na borda

Infrastructure icon


Saiba o que há de mais recente na plataforma Linux empresarial líder mundial

application development icon


Conheça nossas soluções desenvolvidas para ajudar você a superar os desafios mais complexos de aplicações

Original series icon

Programas originais

Veja as histórias divertidas de criadores e líderes em tecnologia empresarial