| PCI Req. |
|
PCI Section/Requirement Summary |
|
|
 |
|
1 |
|
Build a Firewall configuration that restricts connections
1.2.3 - Install perimeter firewalls between any wireless networks and the
cardholder data
1.3.7 - Place the database in an internal network zone, segregated from the DMZ
Most firewalls allow or block traffic as a whole. With Enzo database connections
can be
allowed based on custom security rules providing greater flexibility and
granularity. For example Enzo can enforce a rule that allows only one database account
to be used from a wireless connection or the DMZ, further improving security.
|
|
|
|
|
6 |
|
Develop software applications in accordance with PCI DSS
6.3.2 - Separate develompent/test/production environments
For organizations that use a single domain for development, test and production
or that have trust relationship established between the domains, Enzo Firewall can
limit or prevent cross-domain database access for increase security. This allows
network administrators to enforce different database access control between domains.
|
|
|
|
|
7 |
|
Limit access to computing resources to those individuals that require such
access
7.1.1 -
Restrict access rights to privileged user ids
7.1.4 - Implemention of an automated access control system
7.2.3 - Default "deny all" setting
With Enzo organizations can implement strong access control measures that confirm
a user's identity (two-factor authentication) before allowing a database connection
and restrict use of privileged database user IDs to individuals that need it.
|
|
|
|
|
|
8 |
|
Assign a unique ID to each person
8.1 -
Identify all users with a unique user name
8.2 -
Employ at least password or two-factor authentication
8.3 -
Implement two-factor authentication for remote access
8.5.6 -
Enable accounts used by vendors only during the time period needed
8.5.8 -
Do not use group, shared or generic accounts
8.5.16b -
Application IDs can only be used by applications
Enzo offers significant capabilities to solve access control challenges including
the ability to use unique virtual user IDs that map to database logins and requiring
two-factor authentication. In addition Enzo offers the ability to tie a login to
an application which can help in mitigating requirement 8.5.16b.
|
|
|
|
|
|
10 |
|
Regularly Monitor and Test Networks
10.3 -
Record user id, type of event, date/time, success/failure...
Enzo keeps a detailed audit log of all connection attempts including the user id
and the location of the user (by IP and originating MAC address). The Enzo logs
can be very useful to correlate events generated by other tracing tools.
|
|
|
|
|
|
11 |
|
Regularly Test Security Systems and Processes
11.4 -
Use Network Intrusion Detection systems... to monitor all network traffic...
Enzo is by definition an IDS/IPS which proactively blocks undesired database connection
attempts and sends alerts instantly when a violation occurs.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
