Do you know what's in the new version of the PCI DSS released in November 2013?

Editor's note: This article introduces the white paper "PCI and What It Means to IBM i" available free from the MC White Paper Center.

While one may think that PCI is a thing of the past and that it's already been implemented, major breaches (most notably of the Target PoS systems) have brought it back into focus. Some retailers are just now understanding how PCI applies to them, and other organizations have started to accept credit cards when they didn't in the past. To refresh everyone's memory, here's an overview of what PCI means to the IBM i community and what organizations that use an IBM i to store, process, or access cardholder data need to be aware of.

The Payment Card Industry has developed a Data Security Standard (PCI DSS) that is composed of six major sections, with each of those divided into subsections for a total of 12 specific areas addressed. A new version of the PCI DSS was released in November 2013, and while it's not required to be implemented until 2015, the PCI Council is encouraging organizations to start implementing the new requirements as soon as possible. The intent of this update is to move from a focus of compliance to having security be part of the "business as usual" activities. Compliance implies a "point in time." We all know that compliance typically occurs at the time of an audit but also that compliance status usually slides the further away from the audit you get. With the emphasis on business as usual, data and systems have a chance of being secure—or perpetually in compliance. SkyView Partners has long talked about compliance needing to be a "lifestyle," not an event, so we are thrilled with the emphasis of this new version of the PCI DSS. Hopefully, all of our data will be secure when the attacks are mounted!

The intent of each section of PCI DSS is to mitigate risk to cardholder data. Let's take a look at each section in the terminology of the IBM i.

Build and Maintain a Secure Network

Section 1: Install and maintain a firewall configuration to protect cardholder data.

The obvious intent of this section is to ensure that networks are adequately protected by using a firewall. Since the IBM i should not be used as a firewall, this has no direct effect on the IBM i.

Section 2: Do not use vendor-supplied defaults for system passwords or other security parameters.

The easiest way to gain access to a network or server is to try to use the default passwords or exploit wide-open or default settings. This section has several requirements for the IBM i community, including:

• User profiles cannot have a default password—that is, a password that's the same as the user profile name (Section 2.1). This section was clarified in V3.0 to note that this also applies to service accounts. In the IBM i world, this could be vendor-supplied profiles, profiles used by vendors to maintain applications and/or profiles used for FTP, ODBC, or JDBC processes. No profile—including these service profiles—can have a default password.
• TCP/IP services that are not in use should be turned off and the auto-start value set to *NO (Section 2.2.2).
• System values and other settings should be set to prevent misuse. In other words, implement security best practices (Section 2.2.4).
• Products (including libraries and directories no longer in use) should be removed from the system (Section 2.2.5).
• All non-console administrator access must be encrypted. In other words, unless you're accessing the system from a hard-coded console terminal, anyone who has *ALLOBJ special authority must use a connection that is encrypted. This is typically accomplished using an SSL or SSH connection (Section 2.3).
• Security policies and operational procedures must be documented, in use, and known to all affected parties. In typical IBM i shops, this would mean that IBM i administrators, help desk, operators, developers, etc. would need to know the requirements of this section, especially when it comes to ensuring no default passwords and signing on with an encrypted session. This is an addition to version PCI DSS 3.0—not just in this section (Section 2.5) but in most sections of PCI DSS 3.0. It is the enforcement of the "business as usual ' concept.

One requirement that doesn't apply but must often be explained by the IBM i community to the PCI Qualified Security Assessor (QSA) is the requirement in Section 2.2.1 to implement only one function per server. Since the IBM i (and systems such as mainframe computers) were designed to be multi-functional, this does not apply. For example, the use of subsystems on IBM i allow you to separate servers and provide different performance characteristics for different types of jobs (web, batch, interactive). IBM specifically refers to the system as being able to run multiple applications and components.

Want to Know More?

Download the free white paper "PCI and What It Means to IBM i" from the MC White Paper Center.

 

Carol Woodbury is IBM i Security SME and Senior Advisor to Kisco Systems, a firm focused on providing IBM i security solutions. Carol has over 30 years’ experience with IBM i security, starting her career as Security Team Leader and Chief Engineering Manager for iSeries Security at IBM in Rochester, MN. Since leaving IBM, she has co-founded two companies: SkyView Partners and DXR Security. Her practical experience and her intimate knowledge of the system combine for a unique viewpoint and experience level that cannot be matched.

Carol is known worldwide as an author and award-winning speaker on security technology, specializing in IBM i security topics. She has written seven books on IBM i security, including her two current books, IBM i Security Administration and Compliance, 3^rd Edition and Mastering IBM i Security, A Modern, Step-by-Step Approach. Carol has been named an IBM Champion since 2018 and holds her CISSP and CRISC security certifications.

---

MC Press books written by Carol Woodbury available now on the MC Press Bookstore.

		IBM i Security Administration and Compliance: Third Edition Don't miss the newest edition by the industry’s #1 IBM i security expert. List Price $71.95 Now On Sale
		Mastering IBM i Security Get the must-have guide by the industry’s #1 security authority. List Price $49.95 Now On Sale