@AlienVault
PCI DSS Reporting Requirements for People Who Hate PCI Reporting
@AlienVault@AlienVault2
Meet today’s presentersIntroductions
Patrick BedwellVP, Product Marketing
AlienVault
Brian SaenzSOC Supervisor
Terra Verde
Hoyt KestersonSenior Security Architect & QSA
Terra Verde
@AlienVault@AlienVault
Key reporting requirements of the PCI DSS standardSecurity technologies needed to collect the required dataHow AlienVault USM generates these reports in minutes, not daysHow to use your audit reports to improve security on an on-going basis
Agenda
@AlienVault@AlienVault
Key reporting requirements of the PCI DSS standard
@AlienVault
@AlienVault
Make an audit trail—follow the user
10.1 Establish a process for linking all access to system components (especially access done with administrative privileges such as root) to each individual user.10.2 Implement automated audit trails for all system components to reconstruct the following events: • 10.2.2 All actions taken by any individual with root or
administrative privileges
• 10.2.4 Invalid logical access attempts
• 10.2.5 Use of identification and authentication mechanisms
• 10.2.7 Creation and deletion of system level objects
@AlienVault
Make an audit trail—and protect it
10.2.3 Verify that access to all audit trails is logged. 10.2.6 Verify that initialization of audit logs is logged. 10.5.1 Verify that only individuals who have a job-related need can view audit trail files. 10.5.2 Verify that current audit trail files are protected from unauthorized modifications 10.5.5 Verify the use of file-integrity monitoring or change-detection software for logs
@AlienVault
Stuff to record
10.3.1 User identification 10.3.2 Type of event 10.3.3 Date and time
• Time must be synchronized across all systems—10.4
10.3.4 Success or failure indication 10.3.5 Origination of event 10.3.6 Identity or name of affected data, system component, or resource.
@AlienVault
Log RecordsLog Records
@AlienVault
Gather ye log records while ye may
10.5.3 Promptly back up audit trail files to a centralized log server or media that is difficult to alter.
10.5.4 Write logs for external-facing technologies onto a log server on the internal LAN.
10.7 Retain audit trail history for at least one year, with a minimum of three months immediately available for analysis.
@AlienVault
Log Records
Log Records
@AlienVault
Gaze upon your log records
10.6 Review logs for all system components at least daily. Log reviews must include those servers that perform security functions like intrusion-detection system (IDS) and authentication, authorization, and accounting protocol (AAA) servers (for example, RADIUS).This is tough for a human to do. It’s been compared to drinking from a fire hose.Acquire a Security Information and Event Management tool and/or service.Its purpose is to continually analyze log records across all the systems.If it detects anomalous behavior, it will send a signal to someone.
@AlienVault@AlienVault
@AlienVault
Pay attention to the bat signal
12.5.2 Monitor and analyze security alerts and information, and distribute to appropriate personnel.That’s it—there’s no requirement to have a documented process to handle the alert.
12.5.3 Establish, document, and distribute security incident response and escalation procedures to ensure timely and effective handling of all situations.How does an alert become an incident?
@AlienVault
Oh No!Not Another
Version!
@AlienVault
Version 3.0
Three year development cycleAvailable for compliance in 2014Mandatory for compliance beginning 2015
@AlienVault
Pay better attention to the bat signal
The PCI Security Standards Council is concerned that logs are used more for forensics after an attack instead of detecting and blocking the attack.They wanted to improve the “slow detection of compromise”.Version 3 of the PCI Data Security Standard provides more guidance on log reviews.New sub-requirement 10.6.3.a requires that procedures are defined for following up on exceptions and anomalies identified during the review process. New sub-requirement 11.5.1 requires the implementation of a process to respond to any alerts generated by the change-detection mechanismRevised sub-requirements 12.5.2–3 requires that
• responsibilities are assigned for monitoring and analyzing security alerts and for informing the people responding to those alerts; and that the,
• responsibility for establishing, documenting, and distributing the procedures to handle those alerts are also assigned.
@AlienVault
One more thing about logging
AlienVault USM can only operate on the log records provided.10.2.1 [Implement automated audit trails for all system components to reconstruct] All individual accesses to cardholder dataUser access to cardholder data (CHD) is typically implemented as follows:
• User is authenticated
• User’s request is processed by one or more intermediate applications.
• These applications are well known, e.g. WebLogic, bespoke, or legacy.
• Those applications send commands, typically SQL, to access the database and potentially CHD.
Each of these components must generate log records that link the identity of the user to the specific CHD accessed.
@AlienVault
Looking for bad stuff
Look for unauthorized wireless access points
• 11.1.d If automated monitoring is utilized (for example, wireless IDS/IPS, NAC, etc.), verify the configuration will generate alerts to personnel.
11.2 Run internal and external network vulnerability scans at least quarterly and after any significant change in the network …
• 11.2.1 Perform quarterly internal vulnerability scans.
• 11.2.1.c [The scan must be] performed by a qualified internal resource(s) or qualified external third party, and if applicable, organizational independence of the tester exists (not required to be a QSA or ASV).
@AlienVault
What you need from a SIEM
You need to be told if a critical event has been detected.
You need reports to help manage the environment.
You need reports to be provided as evidence to an auditor.
@AlienVault@AlienVault
Security technologies needed to collect the required data
@AlienVault@AlienVault
What functionali
ty do I need for PCI DSS?
@AlienVault@AlienVault
Identify systems &
applications
What functionali
ty do I need for PCI DSS?
@AlienVault@AlienVault
Identify systems &
applications
Document vulnerable
assets
What functionali
ty do I need for PCI DSS?
@AlienVault@AlienVault
Identify systems &
applications
Document vulnerable
assets
Find threats on your network
What functionali
ty do I need for PCI DSS?
@AlienVault@AlienVault
Identify systems &
applications
Document vulnerable
assets
Find threats on your network
Look for unusual behavior
What functionali
ty do I need for PCI DSS?
@AlienVault@AlienVault
Correlate the data
& respond
Identify systems &
applications
Document vulnerable
assets
Find threats on your network
Look for unusual behavior
What functionali
ty do I need for PCI DSS?
@AlienVault@AlienVault
The AlienVault approach
@AlienVault@AlienVault
Asset Discovery• Active Network Scanning• Passive Network Scanning• Host-based Software
Inventory
The AlienVault approach
@AlienVault@AlienVault
Asset Discovery• Active Network Scanning• Passive Network Scanning• Host-based Software
Inventory
Vulnerability Assessment• Network Vulnerability
Testing• Remediation Verification
The AlienVault approach
@AlienVault@AlienVault
Asset Discovery• Active Network Scanning• Passive Network Scanning• Host-based Software
Inventory
Vulnerability Assessment• Network Vulnerability
Testing• Remediation Verification
Threat Detection• Network IDS• Host IDS• Wireless IDS• File Integrity Monitoring
The AlienVault approach
@AlienVault@AlienVault
Asset Discovery• Active Network Scanning• Passive Network Scanning• Host-based Software
Inventory
Vulnerability Assessment• Network Vulnerability
Testing• Remediation Verification
Threat Detection• Network IDS• Host IDS• Wireless IDS• File Integrity Monitoring
Behavioral Monitoring• Log Collection• Netflow Analysis• Service Availability
Monitoring
The AlienVault approach
@AlienVault@AlienVault
Asset Discovery• Active Network Scanning• Passive Network Scanning• Host-based Software
Inventory
Vulnerability Assessment• Network Vulnerability
Testing• Remediation Verification
Threat Detection• Network IDS• Host IDS• Wireless IDS• File Integrity Monitoring
Behavioral Monitoring• Log Collection• Netflow Analysis• Service Availability
Monitoring
Security Intelligence• SIEM Event Correlation• Incident Response
The AlienVault approach
@AlienVault@AlienVault
AlienVault Server to aggregate data and manage the
deployment
AlienVault Sensor to collect data from the infrastructure
AlienVault Logger for long term
storage and reporting
AlienVault All-in-One to collect, aggregate, and
store data as well as manage
Three components
@AlienVault@AlienVault
Three components, three form factors
AlienVault Server to aggregate data and manage the
deployment
AlienVault Sensor to collect data from the infrastructure
AMIVirtual AppliancePhysical Appliance
AlienVault Logger for long term
storage and reporting
AlienVault All-in-One to collect, aggregate, and
store data as well as manage
@AlienVault@AlienVault
Integrated threat intelligence
36
• Free Tools• OSSIM• USM
@AlienVault@AlienVault
AlienVault Labs threat intelligenceCoordinated analysis, actionable guidance
Weekly updates to coordinated rule sets: Network IDS Host IDS Asset discovery / inventory database Vulnerability database Event correlation Report modules and templates Incident response templates / “how to” guidance for each alarm Plug-ins to accommodate new data sources
@AlienVault@AlienVault
Unified Security Management in action
@AlienVault@AlienVault
How AlienVault USM generates these reports in minutes, not days
@AlienVault
Log correlation is critical
Log correlation is about constructing rules that look for sequences and
patterns in log events that are not visible in the individual log sources.
System logs don’t say “Help! I’m being broken into with a
compromised account!”
• They say “Successful Login from Authenticated User”
They describe analysis patterns that would require human
interpretation otherwise, tied together by Logical Operators.
• “IF a new user IS created on the domain AND a new change control ticket
IS NOT created in the change control database”
@AlienVault
Why You Need Log Correlation
It monitors incoming logs for logical sequences, patterns and values
to identify events that are invisible to individual systems.
Log correlation:
• Performs analysis that would otherwise be done by repetitive human
analysis.
• Identify things happening that are unusual for your business processes.
• Provide more context and certainty as to what is happening on your
infrastructure by comparing events from multiple sources
• Prioritize investigation and analysis work by filtering log events into
meaningful alerts and reports
@AlienVault
Different, Everybody is the Same
Log correlation allows for the creation of alerts that represent what is
important to your business processes and security risks.
Done correctly, Log Correlation is the difference between reacting to:
“POSSIBLE-EXPLOIT: mssql improperly formed packet headers”
Or
“User In Accounting Department seen logging into Financial Database from a
workstation in Customer Support Department”
@AlienVault@AlienVault
Quickly create groups of assets
• E.g., in-scope devicesEnables, fast, easy analysis
• Run vulnerability scans against this host group
• Create reports only for hosts belonging to the host group.
• Review all alarms, events, other data just for that group
Power of groups
@AlienVault@AlienVault
How to use your reporting to demonstrate PCI DSS compliance
@AlienVault@AlienVault
Reports are easily configured and customized.Key is mapping signatures to requirements.Using views to limit what you want to see then create reporting modules.Insert and group reporting modules together to build a report with the information you require.Easily automate and schedule reports.
Reports
@AlienVault@AlienVault
AlienVault allows you to quickly generate a report to track actions taken by AlienVault Web interface users.
Provides accountability.
Value extends out of PCI such as when investigating sources of activity.
AlienVault User Activity Report – PCI 10.2.3
@AlienVault@AlienVault
AlienVault User Activity Report – PCI 10.2.3
@AlienVault@AlienVault
AlienVault User Activity Report – PCI 10.2.3
@AlienVault@AlienVault
PCI requirement of 1 year of log retention.
Report will show aggregate count of total logs per month for 365 days as bar graph.
Allows for quick review of compliance.
New configuration allows for log expiration.
AlienVault Log Retention - PCI 10.7.b
@AlienVault@AlienVault
AlienVault Log Retention - PCI 10.7.b
@AlienVault@AlienVault
AlienVault Log Retention - PCI 10.7.b
@AlienVault@AlienVault
Mapping requirements to modules is key.
One module per requirement to demonstrate compliance.
Can combine modules together to create one report with pertinent information.
Access Control Report - PCI 10.2.X
@AlienVault@AlienVault
Access Control Report - PCI 10.2.X
@AlienVault@AlienVault
Access Control Report - PCI 10.2.X
@AlienVault@AlienVault
Easy to follow, available in different formats.
Preference of PDF versus Excel.
Must have run at least one scan or imported a previous scan.
Vulnerability Scanning Report 11.X
@AlienVault@AlienVault
Vulnerability Scanning Report 11.X
@AlienVault@AlienVault
Vulnerability Scanning Report 11.X
@AlienVault@AlienVault
Vulnerability Scanning Report 11.X
@AlienVault@AlienVault
View date and time, host, what was changed, and statistics such as size and hash values.
Easy to set up with OSSEC.
OSSEC FIM - PCI 10.5.5
@AlienVault@AlienVault
OSSEC FIM - PCI 10.5.5
@AlienVault@AlienVault
OSSEC FIM - PCI 10.5.5
@AlienVault@AlienVault
Schedule reports and send to email.
Full report will be attached.
Scheduling Reports
@AlienVault@AlienVault
Scheduling Reports
@AlienVault@AlienVault
In summaryThe evidence the QSA wants What to give the QSA
Logs are held for one year Report showing 12 months of log counts
Modifications of, access to, and actions on, logs are restricted and reported
AlienVault User Activity report of recent authentications and actions is example
Recorded events—who had access to CHD, login success or failure, privileged access, creation or deletion of system objects,
User account enabled or created, Windows Logon Failure and Success, Log file size reduced, User account enabled or created, FIM as examples
Each record shows who did what to what, when, was successful or not
Show any log record like Access Control Report to demonstrate compliance
Logs reviewed daily with events reported Show example of automated alert that triggers investigation
@AlienVault@AlienVault
@AlienVault@AlienVault
Now for some Q&A…
Test Drive AlienVault USMDownload a Free 30-Day Trial
http://www.alienvault.com/free-trial
Try our Interactive Demo Site
http
://www.alienvault.com/live-demo-site