View PDF of this issue - The Green Sheet

67
Education
Unauthorized or improper access to cardholder data and
systems is punishable by management actions up to and
including immediate termination.
more on confronting the issues raised by Requirement 7
and doing the right thing, rather than on attempting to
avoid the issue. With two main aspects to Requirement 7,
there are two main sets of actions called for:
1. The right policy and process framework
Merchants must have a formal security policy that
explicitly lays out a statement of least privilege. It
need not contain fancy language or be complicated
(simple and obvious is better). Something along the
lines of:
Access to cardholder information, and access
to devices that touch cardholder information
(such as POS devices) is restricted to
employees who have been formally granted
access permission and who need that particular
access to do their jobs. Unauthorized
or improper access to cardholder data and
systems is punishable by management actions
up to and including immediate termination.
What you need to do for your merchants
Again, merchants don't particularly need rescuing
from technical nightmares to comply with this part of the
PCI, so it should not be a significant pain point in PCI
conversations.
Merchants might need assistance in liaising with vendors
of payment applications, POS terminals and other PCI
devices. They might also require some general advice on
security and access control. ISOs can do this themselves,
if they choose, but for many, it is simpler and better to
partner with a security specialist as part of a broader PCI
program that also deals with the other, messier, parts of
the PCI DSS.
Dr. Tim Cranny is an internationally recognized security and compliance
expert and is Chief Executive Of ficer of Panoptic Security Inc.
(www.panopticsecurity.com). He speaks and writes frequently for the
national and international press on compliance and technology issues.
Contact him at tim.cranny@panopticsecurity.com or 801-599-3454.
The merchant also needs formal processes to grant
access permissions, but they don't need to be elaborate.
A small organization might establish a written
rule, such as, "You don't have access privileges
unless your name is on the following list maintained
by the manager."
That rule can then be combined with a set of rules for
the manager, such as, "Only add names to this list if
the person needs the access to do his or her job and
seems trustworthy after a reasonable background
check. Keep the list up to date; remove names of
those no longer authorized as soon as possible."
2. The right technology to execute this access control policy
Merchants need an automated access control system,
which is typically much simpler than it sounds.
The biggest area of concern here is controlling
access to computers. All modern computers already
have built-in systems for user accounts and privilege
controls.
In addition, all modern payment application or
POS software must have these sorts of access controls
built in, and they should be fairly easy to set
up and use. If merchants' payment applications or
POS software do not have these sorts of controls
built in, they should upgrade their systems as an
urgent priority.