vss pcicomus-en

Facilitate PCI Compliance Using Tango/04 Multiplatform, Real-Time Solutions

Contents

© 2007 Tango/04 Computing Group Page 1

Contents

Contents................................................................................................................................................ 1 Executive Summary ............................................................................................................................. 2 Introduction........................................................................................................................................... 3 The Details Behind PCI DSS................................................................................................................ 4

Background....................................................................................................................................... 4 Compliance vs. Validation................................................................................................................. 5 Recent Incentives and Penalties Announced by Visa ....................................................................... 6

PCI DSS Requirements ........................................................................................................................ 7 Compliance Benefits ......................................................................................................................... 8

Achieving PCI DSS Compliance.......................................................................................................... 9 Automated Tools - Continuous Monitoring and Real-Time Alerts ..................................................... 9

Continuous Monitoring and Real-time Alerts................................................................................................... 9 Tango/04 Solutions for PCI DSS Compliance .................................................................................. 11

Full Operating System Level Coverage .......................................................................................... 12 Databases, Web 2.0 Enablers and other Middleware ..................................................................... 12 Record-level and Field-level Database Auditing ............................................................................. 13 Third Party Security Products, Network Appliances and Device Integration ................................... 13 Business Application Monitoring ..................................................................................................... 13 VISUAL Security Suite Output ........................................................................................................ 14

Business and Enterprise Views..................................................................................................................... 14 Real-time Alerts............................................................................................................................................. 16 Automated Actions ........................................................................................................................................ 16 Compliance Reports...................................................................................................................................... 17

Ease of Use .................................................................................................................................... 20 Tango/04 Solutions and the PCI DSS Requirements...................................................................... 20 Valid for Cross Compliance ............................................................................................................ 20 Extendability ................................................................................................................................... 20

Maximize Your Return on Investment ........................................................................................................... 21 Summary ............................................................................................................................................. 22

Multiplatform Cross Compliance ..................................................................................................... 22 Field Proven in Different Industries ................................................................................................. 22 Unique Extensibility......................................................................................................................... 22

Appendix A – Tango/04 Security Solutions...................................................................................... 23 VISUAL Security Suite: List of Controls .......................................................................................... 23 Tango/04 Solutions Offer Extensive Coverage for the System i ..................................................... 24

Technology Alliances outside of IBM ............................................................................................................ 24 Professional Services ..................................................................................................................... 24

Appendix B – PCI DSS Requirements .............................................................................................. 25 Mapping of Tango/04 Solutions to PCI DSS Detailed Requirements.............................................. 26

Executive Summary


"Tango/04 software certainly simplifies our auditing process. Tango/04 pre-sale activities, post-sale implementation and support services exceeded our expectations. The Tango/04 employees are intelligent, helpful, funny, patient and honest. The training they provided was outstanding"

David Dresdow, Team Leader

JD Edwards System Administration

Stora Enso

Executive Summary

The Payment Card Industry Data Security Standard pertains to any company that stores, processes or transmits credit card information. If this applies to your company, you are required to be compliant with this private industry standard today. Depending on the volume of credit card transactions you process, the task of demonstrating compliance may include an annual on-site audit conducted by an external auditor. In any case, you don’t want to operate your business in a non-compliant state because the associated penalties can be severe. For instance, if a data breach occurs while you are noncompliant, you can be fined up to $500,000 per incident and suffer revocation of your right to accept or process credit card transactions. This could certainly be fatal to your business.

So let’s agree that noncompliance is not an option. In that case, how do you begin to put together a strategy that will help you meet the robust requirements of PCI DSS year after year? It’s clear that a sustainable compliance plan must include the use of automated software technology. As a result, this paper includes a description of VISUAL Security Suite, the Tango/04 multiplatform, real-time security solution for achieving compliance with various regulations and industry standards. We explain how the product can successfully be used in your efforts to meet PCI requirements to protect your credit card data assets while actually reducing overall compliance costs.

For a number of years, the Tango/04 security solution has been used by many companies world-wide to facilitate sustainable compliance with various regulations. Our technology is field proven and has been adopted by 7 of the 18 largest banks in the world to facilitate their security strategies.

In fact, Stora Enso Inc. – a multi-billion dollar integrated paper, packaging and forest products company with multiple locations in the US and across the globe – is just one of our customers using Tango/04 software to ease their auditing procedures. Other well known companies using Tango/04 products include BankBoston, CocaCola, Pfizer, Shell, Office Depot and Nike.

Please visit our website at www.tango04.com to view testimonials from satisfied customers and to learn more about our Security and integrated Business Service Management solutions.

Introduction


Introduction

If your organization stores, processes or transmits credit card information, you are required to comply with the Payment Card Industry Data Security Standard (PCI DSS). Depending on the number of transactions you process, you may also be required to demonstrate compliance through an annual on site audit and validation process. The good news about the PCI DSS requirements is that they are explicit and well defined, unlike some regulations such as Sarbanes-Oxley (SOX) and the associated COBIT control objectives. Simply understanding the control objectives of SOX can be difficult because they are vague in many areas and wide open to interpretation.

Despite the direct nature of PCI DSS however, the associated requirements are very rigorous and can be quite challenging for many organizations. Some of the specific challenges to PCI compliance include the tracking and monitoring of access to all networks and systems containing cardholder information, encryption of cardholder data, authentication of users who access systems with credit card data and the installation and maintenance of firewalls.

Disregarding the challenges, however, there are many benefits to compliance. Among them is the protection of consumer credit card information according to industry best practices, a significant reduction in the risk of a potential data breach, the avoidance of costs associated with a breach and the enhancement of your company’s image. Conversely, the consequences of noncompliance can be financially damaging as a function of monetary penalties in addition to higher interchange rates on credit card transactions. If an actual data breach occurs due to noncompliance, the cost can be enormous as a result of imposed fines, time spent responding to and containing the breach as well as various law suits. The negative press associated with a breach can also lead to the loss of existing customers as well as new customer opportunities – none of which is good for your business.

In this white paper we discuss the evolution of PCI DSS primarily as a result of collaborative efforts between Visa and MasterCard, describe the requirements at hand and explain recent incentives and deadlines put forth by Visa to comply by certain dates. We also examine how the Tango/04 multiplatform, real-time security solution can be used to help you comply with PCI DSS while simultaneously increasing the efficiency of your business processes and generating a positive return on investment (ROI).

The Details Behind PCI DSS



First and foremost, PCI DSS is a multifaceted standard applicable to organizations that store, process or transmit credit card information that includes the customer’s Primary Account Number (PAN). The intent of the standard is to protect consumers by offering a single approach to safeguarding sensitive data for all credit card brands.

Before we get into the specifics of PCI DSS, let’s step back for a moment and discuss the independent efforts of individual credit card companies that led to the evolution of this widely accepted standard.

Background When customers provide their credit card information at a store, over the web, on the phone, or through the mail, they want to know that their account data is safe. In order to address this need for customer assurance, Visa created the Cardholder Information Security Program (CISP). Mandated since June 2001, CISP is intended to protect Visa cardholder data – wherever it resides – ensuring that members, merchants, and service providers maintain the highest information security standard.

To protect their own customer information, MasterCard implemented a similar version of data security requirements called the Site Data Protection (SDP) program in 2002. Both Visa and MasterCard categorized their merchant base into 4 levels focused primarily on the annual volume of transactions processed as shown below1.

• Level 1 – any merchant with more than 6,000,000 overall transactions per year as well as any merchant who has already experienced an account compromise (Visa and MasterCard);

• Level 2 – any merchant processing 1,000,000 to 6,000,000 overall transactions per year (Visa); all merchants processing 150,000 to 6,000,000 e-commerce transactions per year (MasterCard);

• Level 3 - any merchant processing 20,000 to 1,000,000 e-commerce transactions per year (Visa); any merchant processing 20,000 and 150,000 e-commerce transactions per year (MasterCard);

• Level 4 - any merchant processing less than 20,000 e-commerce transactions per year and all other merchants, regardless of acceptance channel processing less than 1,000,000 transactions per year (Visa); all other merchants (MasterCard).

There are also similar levels defined for service providers or organizations that process, store or transmit cardholder data for members, merchants or other service providers. The reason for the level categories is

1 It should be noted that the level definitions also include other criteria in some cases – for specifics regarding Visa levels, visit http://visa.com/cisp. For specific MasterCard levels, visit http://www.mastercard.com/us/sdp/merchants/merchant_levels.html



to identify high volume processors who are subject to stricter validation requirements. The basic concept is that the risk of a data compromise increases proportionately with the volume of transactions processed.

Over time, Visa International and MasterCard Worldwide worked together to align their individual data security programs and formed a single, industry wide standard for data security in December 2004 known as the Payment Card Industry Data Security Standard.

In short order, PCI DSS proceeded to be endorsed by American Express, Discover Financial Services, and JCB (a construction and agricultural equipment manufacturing company), even though some of these companies also had their own forms of data security standards. Finally, in September 2006 the five major credit card payment networks announced the formation of an independent body called the PCI Security Standards Council.2 Its purpose is to own, maintain and distribute information about PCI DSS to affected organizations. Advisors to the Council include representatives from well know companies such as Bank of America, Wal-Mart, Microsoft and PayPal.

Compliance vs. Validation All merchants that accept credit cards as a form of payment, and all service providers involved in the processing of credit card transactions are required to be compliant with PCI DSS right now! The fundamental difference between Level 1 and lower level merchants and service providers is the amount of third-party validation that must be done to meet the certification process. Specifically,

• Level 1 merchants and Levels 1 and 2 service providers must undergo an on site PCI security audit on an annual basis.

• Levels 2, 3 and 4 merchants and Level 3 service providers must submit an annual Self-Assessment Questionnaire and do not require an on site audit.

• Network scans are required to be completed quarterly by all level merchants and service providers. The only exception here is for Level 4 merchants, where a quarterly Network scan is recommended but not required.

So where do we stand in terms of industry compliance? According to Visa USA President and CEO John Coghlan, at year end 2006, only about 20 percent of the top 200 merchants were in compliance with the PCI standards. However, statistics from Gartner predict that by end of 2007, 75 percent of Level 1 merchants and 30 percent of Level 2 merchants will be compliant.3 The anticipated increase in compliance may in part be fueled by the deadlines associated with incentives and fines publicized by Visa at the end of last year.

2 To learn more about the PCI SSC, please visit their website at https://www.pcisecuritystandards.org/ 3 http://www.itcinstitute.com/display.aspx?id=4020



Recent Incentives and Penalties Announced by Visa In December 2006, Visa announced the PCI Compliance Acceleration Program (PCI CAP), offering $20 million in financial incentives as well as new sanctions in an effort to further PCI DSS compliance.4 In essence, PCI CAP sets a Sept. 30, 2007 deadline for compliance aimed at Level 1 merchants and a December 31, 2007 deadline for Level 2 merchants.5 Noncompliant merchants will face monthly fines up to $25,000 and be charged higher interchange rates which are the commissions they pay on transactions. (Prior to these new penalties, merchants and service providers were only assessed monetary fines if an actual data breach occurred).

Those who can validate compliance by September 30, 2008, however, may qualify for a refund of up to three months of the higher commissions, but will have to attest that they made strenuous efforts to comply by the earlier date.

Visa has also stated that it will reward acquiring banks whose members are fully compliant by September 30, 2007 and has set aside $20 million as an incentive. As of mid- August 2007, Visa had already paid out about $7 million to compliant companies.

4 http://usa.visa.com/about_visa/press_resources/news/press_releases/nr367.html 5“PCI Compliance Deadlines Have Retailers Scrambling”, SearchCIO.com, 09/13/2007.

PCI DSS Requirements



Now that we understand the evolution of PCI DSS and the importance of compliance, let’s take a closer look at the requirements themselves. Specifically, version 1.1 of the PCI Data Security Standard is comprised of 12 high level requirements further broken down into just over 200 sub-requirements. These 12 high level requirements fall under 6 different principles as shown below. (Note that PCI DSS version 1.1 and all supporting documentation can be found at www.pcisecuritystandards.org).

Build and Maintain a Secure Network

Requirement 1: Install and maintain a firewall configuration to protect cardholder data

Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters

Protect Cardholder Data

Requirement 3: Protect stored cardholder data

Requirement 4: Encrypt transmission of cardholder data across open, public networks

Maintain a Vulnerability Management Program

Requirement 5: Use and regularly update anti-virus software

Requirement 6: Develop and maintain secure systems and applications

Implement Strong Access Control Measures

Requirement 7: Restrict access to cardholder data by business need-to-know

Requirement 8: Assign a unique ID to each person with computer access

Requirement 9: Restrict physical access to cardholder data

Regularly Monitor and Test Networks

Requirement 10: Track and monitor all access to network resources and cardholder data

Requirement 11: Regularly test security systems and processes

Maintain an Information Security Policy

Requirement 12: Maintain a policy that addresses information security

These 12 security requirements apply to all “system components” which are defined as any network component, server or application that is included or connected to the card holder data environment.



Compliance Benefits PCI DSS is of great benefit to the consumer in terms of protecting their personal information from unauthorized use or disclosure. Compliance with the standard is also good for companies because a data breach can be very costly and wreak havoc on a company’s image. Beyond that, implementation of PCI DSS can actually reduce compliance costs over the long run. That’s because once it’s been implemented, the vigorous standard instills security best practices across the entire enterprise, which makes it easier and less expensive to meet new requirements that may be imposed in the future. The concept applies both to completely new sets of regulations and standards as well as potential revisions to PCI DSS.

That being said, achieving and maintaining compliance with this comprehensive standard is not trivial and is bound to be difficult for many companies.

Achieving PCI DSS Compliance



Similar to complying with other regulations such as Sarbanes-Oxley or HIPAA, compliance efforts are most successful when they are coordinated with business users and overall corporate objectives. Involving executive management from the very beginning facilitates corporate support, which is an essential component of a successful and ongoing compliance strategy.

Implementing the controls necessary to comply with PCI DSS also creates opportunities to improve the efficiency of business processes which in turn yield increased productivity and cost savings. Another cost benefit of compliance is that it decreases the likelihood of a data breach, which can be extremely expensive.

Case in point is the realization in January 2007 of a security breach that impacted the TJX Companies based in Framingham, Massachusetts and resulted in the exposure of more than 45 million credit and debit card holders over an 18 month period. As of August 2007, the breach had cost TJX more than $250 million. A large portion of the cost has been related to containing the intrusion, bolstering data security procedures and systems, notifying customers and responding to an increasing list of lawsuits.6 Had TJX been compliant with PCI DSS early on, it’s likely that the breach would not have occurred, or if it did, the exposure of consumer information would have been minimized.

An important aspect of complying with PCI DSS is the implementation of continuous monitoring. You need to know, on a 24/7 basis, of any unauthorized attempts to access your critical files. That leads us to the concept of automated software technology.

Automated Tools - Continuous Monitoring and Real-Time Alerts PCI DSS Requirement 10, Regularly Monitor and Test Networks, consists of seven first level sub-requirements. In particular, sub-requirement 10.2 calls for the implementation of automated audit trails for all system components in order to reconstruct specific events. It couldn’t be more clear – to satisfy this condition, companies need to utilize automated software technology.

Although technology solutions in the form of automated software tools do require an up-front investment, they generally render a positive ROI. Beyond that, automated tools also provide consistent, accurate and reliable monitoring and reporting – something you’ll need to demonstrate compliance to an outside auditor.

Continuous Monitoring and Real-time Alerts A major advantage of automated software tools is their ability to run 24/7, constantly keeping watch over your implemented PCI DSS security plan and critical data assets. Continuous monitoring is a vital component of a sustainable compliance plan.

6 Cost of Data Breach at TJX Soars to $256m”, Ross Kerber, The Boston Globe , August 15, 2007.



We recommend that you only consider automated tools that have the capacity to send alerts to you in real-time when a suspicious security event takes place. Real-time warnings are invaluable to your business because they allow you to minimize risk exposure and attend to security incidents as they occur. Once again, consider the TJX data breach that spanned an 18 month period. Had continuous monitoring and real-time alerts been in place, the company would have known the instant the first unauthorized data access event occurred and been able to immediately respond with defensive actions.

Continuous auditing is a major trend and since real-time alerting is technologically available today, there’s no reason not to know about a potentially serious security issue before it’s too late.

In the next section we examine the Tango/04 toolset that is currently in use by many companies worldwide in support of their compliance strategies.

Tango/04 Solutions for PCI DSS Compliance



The Tango/04 Computing Group7 is a leading developer of Security and Infrastructure Monitoring, Reporting and Business Service Management solutions. Its VISUAL Security Suite is a multiplatform security solution that can easily become a part of your automated processes for achieving sustainable PCI DSS compliance. As shown in Error! Reference source not found.1 below, VISUAL Security Suite receives audit information from various sources within your enterprise.

Figure 1 – Overview of VISUAL Security Suite

Conducive with PCI DSS requirements, its monitoring engine offers agents for your different platforms, network components, applications, logs and databases. In many cases, the monitors can run remotely (agentless), reducing deployment time and avoiding interference with other applications.

In addition, each monitor retrieves only the information you are interested in, allowing you to filter out all irrelevant data. This powerful filtering feature minimizes the monitoring process and keeps overhead down resulting in little to no performance impact on your system.

3 For detailed information about Tango/04, its solutions and customer case studies, please go to www.tango04.com



Full Operating System Level Coverage The VISUAL Security Suite agents for the System i, Windows, Unix, Linux and AIX can keep track of:

• Changes and access to all files and objects, including financial databases, configuration files, sensitive information, etc. Specifically, the tracking of:

− Deletes, copies, edits, renames, restores, and read-only access to specific data

− Unauthorized access attempts

• Authority failures, such as:

− Persistent failed sign on attempts − Object access denials

• System configuration changes, such as:

− Creation and modification of user profiles − System value changes

• Command use, so you can:

− Watch suspicious users − Monitor use of sensitive commands.

We have a library of standard controls you can leverage based on our experience with many different types of industries and security projects. However, new, custom checks can easily be added. For instance, system access times may be well defined at your company, and it is simple to define the time during the day when a login attempt (even if it is allowed by the operating system) should be considered suspicious.

Other controls can be less direct, but equally important. For example, unusually increased storage occupation or bandwidth consumption can be a symptom of a suspicious activity (such as a virus sending out spam from a compromised workstation). Because VISUAL Security Suite allows you to monitor several performance indicators in addition to traditional security events, you can define a comprehensive list of controls.

Please refer to Appendix A for a list of common controls per platform.

Databases, Web 2.0 Enablers and other Middleware VISUAL Security Suite can extract information and continuously audit several databases and middleware such as Web Application Servers, including the IBM WebSphere Application Server. Platform-specific controls can be set. Log files can be scrapped, formatted, and correlated in real time from several sources. Different adapters (WMI, JMX, SNMP, syslogs, text files, message queues, etc.) are also available to maximize the integration capabilities.



Record-level and Field-level Database Auditing The Data Monitor module captures all Changes, Inserts, Deletions and Reads to files you specify so you know Who, What, When and How. This is exactly the level of detail you need to help you comply with PCI DSS requirements 10.2 (Implement automated audit trails for all system components to reconstruct events) and 10.3 (Record specified audit trail entries - such as user identification, type of event and date and time of event – for all system components for each event). Specifically, Data Monitor provides you with record-level audit data for each transaction including:

• Type of event such as update, insert, delete or read

• Before and after image of record changed, clearly indicating the changed fields

• User that made the change (including the real user in application transactions)

• Timestamp

• Context data and platform specific information (such as the name of the application for SQL Server and library/program for DB2 on the System i).

With this level of visibility, you’re able to keep all users (including database administrators and privileged users) under control by tracking every action to your sensitive files. As the control is done at the database level, it doesn’t matter where the change came from or which tool had been used to make the change. In addition, the before and after images of record changes allow you to revert a change back to its original value when necessary.

Third Party Security Products, Network Appliances and Device Integration VISUAL Security Suite can monitor, correlate, inspect and immediately alert you of any log file, regardless of where it resides and the application that has produced it. In addition, it is easy to centralize the control of all disperse information, effectively monitoring the activity of network devices such as routers, switches, firewalls, and so on. Third party applications such as Intrusion Detection/Prevention Systems, antivirus products, vulnerability scanners, Virtual Private Networking (VPN), and the like, can also be easily integrated.

Business Application Monitoring One area where most security products fail is the ability to extract relevant security information from different business applications. Home grown applications are particularly difficult for most products. However, as your level of maturity increases, there is a strong need to go from basic audit controls on operating systems and equipment to business-level controls. VISUAL Security Suite can help you to automate the control of your existing applications. It includes a universal log reader (Applications Agent) which can read virtually any log at blazing speed. By using advanced BNF (Backus Normal Form) grammar definitions that can be created and modified easily, integration of practically any application events can be done in real time. In other cases, instead of text files, application security logs and events are stored in data tables, which can easily be integrated with the VISUAL Security Suite Data Adapter.



When more complex business-level controls are required (such as changes to dormant accounts in banks, excessively discounted sales, or other domain specific checks) Data Monitor can be a perfect tool to inspect every single one of millions of transactions in real time. Integrity checks can be placed to make sure no unauthorized changes are done from outside the applications, bypassing the applications integrity controls.

Examples of business applications that can be monitored with VISUAL Security Suite include SAP R/3, Siebel, JD Edwards, SWIFT, legacy (RPG/COBOL), and practically any custom application running in any environment, from mainframes to standalone desktop workstations. Modern Java applications can also be monitored by using JMX (Java Management Extension) technology.

The information presented in this section is merely a subset of the kind of audit data you can collect with VISUAL Security Suite. Please refer to Appendix A for a more complete listing by platform.

VISUAL Security Suite Output Once the audit information you specify has been collected, it can be accessed and presented to you in a variety of ways:

• Business and Enterprise views

• Real-time alerts

• Automated actions

• Reports

Let’s examine each one of these output mechanisms.

Business and Enterprise Views One of the key features of VISUAL Security Suite is that it allows you to centrally manage your security paradigm by consolidating events across all platforms in a single view. This is accomplished using the VISUAL Security Suite SmartConsole, shown below in Figure 2.



Figure 2 – The SmartConsole

Within the SmartConsole, the left most pane contains your business view as a series of hierarchical folders that are color coded to quickly draw your attention to important events. Although a default security configuration is shipped with VISUAL Security Suite, you are free to customize this view to best fit your corporate needs.

Note that the folders under the iSeries and Windows Security branches are green, indicating no imminent issues. However, there is a problem with the Infrastructure node as indicated by the red folder. Expanding any of the folders and then double clicking on the problem node will reveal underlying messages pertaining to the issue. These related messages contain detailed information about the problem and many soft-coded variables that can be passed to messages sent via email or to your cell phone.

The uppermost right pane in Figure 2 summarizes your business services and the pane below it identifies the most probable root cause of the failure. Although this figure shows both security and infrastructure configurations, you can install the security portion alone and either grow into infrastructure monitoring at a later date or continue to use whatever infrastructure monitoring you may already have in place.

In addition to business views, security information can also be presented in an enterprise view or dashboard accessible through the web. Enterprise views can be especially useful for CISO’s who need a high level glimpse of current security status but not the underlying details provided by the SmartConsole. Figure 3 below presents a sample enterprise view of a sample compliance scenario.



Figure 3 – Sample Enterprise View of a Compliance Scenario

Similar to the business view shown in Figure 2, the color of the icons provides visual information regarding status. For instance, at a high level you can quickly see there is a problem with the System i because its icon is red. The detail shown to the right under System i indicates a potential problem Object Access because the icon is yellow. Double-clicking on any icon allows you to drill down for specific information about the problem.

Real-time Alerts Besides visual notification, with VISUAL Security Suite you can also define alarms and actions to send alerts regarding urgent situations in real-time. These alerts can take various forms such as email, SMS messaging, sound or video. Having real-time access to your security information facilitates compliance with PCI DSS and minimizes exposure if a malicious security event occurs, such as an unauthorized user accessing your credit card files. Being notified the instant a suspicious activity occurs gives you total control - even if the incident occurs after hours or over the weekend.

Automated Actions



In addition to real-time alerts, VISUAL Security Suite can be configured to automatically respond to events that you define. For example, if a user changes a critical system setting, VISUAL Security Suite can send you a real-time alert and also initiate predefined actions such as reverting the system setting back to its original value, ending the user’s job and disabling his/her user profile to prevent further malicious actions.

Compliance Reports VISUAL Security Suite includes a robust reporting system so you can perform forensic analyses, review events against security policies and comply with regulations and standards such as PCI DSS. We ship over 200 built-in reports to provide you with all the information you’ll need to satisfy your auditors. Figure 4 below shows a segment of the reporting system in addition to the data selection parameters for one of the reports.

Figure 4 – Segment of the Reporting System and Sample Data Selection Screen

It’s worth noting that our built-in reports can be customized so you can create your own sub report version. Furthermore, reports can be generated in different formats such as .pdf, .xls, .doc, .html and can also be scheduled and automatically emailed to the appropriate stakeholders.



A sample report depicting User Inactivity on the Windows platform is shown below in Figure 5. This particular report will help you to meet PCI DSS requirement 8.5.5, which states that you should remove inactive user accounts at least every 90 days.

Figure 5 – Windows User Inactivity Report

As indicated in Figure 5, our report shows users defined on a particular domain, the number of days they have been inactive and whether or not their profile is enabled. By running this report you can identify users who have not signed on for 90 days (or any time period) and take appropriate action. A similar report is also available for the System i.

Figure 6 below, presents a segment of a Data Monitor report showing detailed information about a data record change. As indicated, Data Monitor can capture and report the date and time of a file access, the type of access (read, update, insert, deletion, etc), the actual user and even the before and after images of the accessed data record.



Figure 6 – Data Monitor Report Segment

As shown in Figure 6 you can even instruct Data Monitor to hide sensitive field values in the generated reports, such as Social Security or credit card numbers. This feature is essential in order to ensure and protect the privacy of consumer information.

The Data Monitor module also has many other advanced features including the ability to:

• Select the files you want to monitor and even particular fields within those files;

• Select particular users or user groups to monitor;

• Store your audit data on a different LPAR or platform which might be more secure or where storage space is less expensive;

• “Enrich” the audit data so, for instance, an account number can appear as a customer name on your reports, making them easier to read;

• Include information on your reports that is not stored in the journal such as user group or class.



Complete Coverage for the System i As a Premier IBM Business Partner, Tango/04 provides the most complete functionality on the market for auditing System i security environments. With more than 15 years experience on this platform, Tango/04 works directly with IBM laboratories in Rochester, Minnesota to take advantage of new i5 technology developments.

We continuously invest in improvements and support for the latest versions of i5/OS in order to offer you the best solution on the market.

(Refer to Appendix A for more information regarding our technology alliance with IBM)

Ease of Use VISUAL Security Suite is fast to deploy and easy to use so you can immediately begin to monitor and protect your corporate assets as soon as you install the product. We offer Professional Services to help you configure business views, real-time alerts and automated actions to meet your specific compliance needs. We also train your designated staff so they can add additional controls as you need them due to changes in regulations or in your corporate environment.

Because the SmartConsole component allows you to centralize the management of your security controls across platforms, within a single view, your security staff will be highly productive as they maintain the integrity of your compliance plan.

Tango/04 Solutions and the PCI DSS Requirements The twelve high level requirements of PCI DSS are broken down into numerous sub-requirements totaling just over 200 individual items for which you must demonstrate compliance. Although achieving sustainable compliance can be quite challenging, the burden can be significantly eased with the use of our multiplatform, real-time security solution. Having the ability to consolidate events from different platforms into a single view through the SmartConsole will also simplify your compliance efforts and help you to be more productive. For specific details regarding the manner in which we meet many of the PCI DSS requirements, please refer to Appendix B.

Valid for Cross Compliance We understand that many companies today are subject to multiple regulations such as PCI and SOX or HIPAA or GLBA. Despite the fact that the details of complying with these laws differ, they all share common objectives. That is, the intent of these regulations is to protect consumers, shareholders and patients from the disclosure of private information and financial misstatements. The Tango/04 security solution aptly supports this intent by providing you with the capabilities of real-time alerts, automated actions, visual status displays by PC or web, monitoring of data changes at the field level and overall abundant reporting. When used together, these aspects of our solution are very powerful and can be easily implemented at your company to help you successfully comply with multiple regulations.

Extendability One of the best parts about the Tango/04 solution suite is that you can implement it in a step-by-step fashion. Start with your most critical platform and begin to define the security controls you need to monitor and report on. Because our solution is so easy to use, you’ll find that once you’ve defined a business view and associated it with alarms and actions, it’s a snap to define other security views.



Although VISUAL Security Suite can be used exclusively as a security compliance solution, it shares a number of modules and agents with VISUAL Message Center, Tango/04’s solution for IT infrastructure monitoring and Business Service Management (BSM). This concept allows you to expand the scope of the solution in a progressive fashion over time as shown in Figure 7.

Figure 7 – Extend the Tango/04 Security Solution to Infrastructure and BSM

It also allows you to create dashboards in order to visualize the impact of security problems on your different business applications. Integrating IT with business operations will not only facilitate corporate support for your compliance activities, but will also help your company function more efficiently as a whole. As various departments work together, increases in productivity are achieved, resulting in overall cost reductions.

Maximize Your Return on Investment Because Security, Infrastructure and BSM all share the same concepts in terms of installation, configuration and training time, your initial investment can be reused to monitor the status of services, SLAs, user experience and application availability. Security administrators, auditors and operation managers can all have different views of the SmartConsole to focus in on what they need to know. In essence, you have one console with many possibilities at your finger tips.

Infrastructure

Security

BSM/SLM

Applications Management

BSM

Security

Operations

Summary


Summary

If you’ve read this far, it’s likely that you’re required to comply with PCI DSS and are looking for ideas on how best to do so. Clearly, you need to develop a compliance paradigm that’s comprehensive, sustainable and does not overburden your staff or your corporate bank account. While you’re at it, you might as well define a strategy that will benefit your company beyond compliance requirements. Namely, you want to develop a security plan that not only satisfies your auditing requirements but one that also provides the added benefits of increased productivity and overall cost reduction.

Multiplatform Cross Compliance The Tango/04 security solution can assist you in attaining sustainable compliance across multiple regulations and standards. With our built-in real-time alerting capability, you’ll not only meet mandated PCI DSS requirements but you will also have instant awareness of the efficacy of your security plan. This enables you to address problems as they occur, before they propagate and when they are easiest to fix. With our multi-platform capabilities, we can consolidate security information across your enterprise in a single view, greatly simplifying the task of assessing compliance. Our rich reporting feature will also help you to satisfy the needs of your external auditor as you demonstrate compliance year after year.

Field Proven in Different Industries The Tango/04 security solution is fast to deploy, easy to use and field proven. We have over one thousand customers across the globe and our technology has been adopted by 7 of the 18 largest banks in the world. In fact, Henry Schein Inc. – a Fortune 500 distributor of healthcare products with global operations based in Melville, NY – is just one of our customers to effectively meet compliance obligations year after year using VISUAL Security Suite. Our customer base also includes a number of well known enterprises such as BankBoston, CocaCola, Dole Fresh Fruit, Pfizer, Shell, Office Depot and Nike.

Unique Extensibility Beyond security auditing, our software also offers infrastructure monitoring, application monitoring and business service management, so you can continue to align IT with the business side of the house using a single software solution. The beauty of our solution is that you can implement additional controls and functions in a stepwise manner and at your own pace.

Consider the Tango/04 family of solutions to help you achieve your compliance goals, protect your corporate assets and facilitate business management. As you continue to grow into the Tango/04 solutions you will increase productivity levels and save money over time.

Appendix A – Tango/04 Security Solutions



VISUAL Security Suite: List of Controls As previously discussed and illustrated (see Error! Reference source not found. on pageError! Bookmark not defined.), VISUAL Security Suite can collect auditing information from multiple platforms and make it available for you to filter and analyze within a single console. Below is a summary of the types of events we can monitor by platform:

System i:

• System access • Profile and user activity or

inactivity • Adopted security • Sensitive commands • Object access • System values • Spool files • Any type of log such as

QSYSOPR, QHST or system audit log

• Use of service systems • Message queues

DB2 UDB:

• Use of special editing tools (e.g. DFU, STRSQL)

• Exit point control • SQL statement level

auditing • File access at record level

Windows:

• Changes in auditing configuration, privileges, directory services, domain policies…

• Complete event log monitoring (real-time)

• Auto control of logs with any format

• Control of Active directory, IIS, firewall service, Exchange, Citrix, remote access…

• Changes to system folders • Invalid logins • Inactive users

SQL Server:

• Instance status • Changes to roles and

users • Transaction log • Connections and access • SQL statements • Locks • Table auditing (field level) • Objects • Errors • Windows processes

Oracle:

• SQL statements run by sysda

• User SQL statements • Role and user monitoring • Critical processes • Special permissions • Relevant users • Table auditing (field level) • Super user activity • Authentication • Log monitoring

Linux, UNIX, AIX:

• Complete verification of syslogs (real-time)

• Changes made to system configuration

• Control of super users • Invalid logins • Changes to folders/objects • Changes in privileges and

user accounts • Change in security policies • Sensitive command

management • Suspicious processes



"Tango/04 pre-sale activities, post-sale implementation and support services exceeded our expectations. The Tango/04 employees are intelligent, helpful, funny, patient and honest. The training they provided was outstanding."

David Dresdow, Team Leader JDEdwards System Administration

Stora Enso

Beyond platform specific abilities, a full array of other third party products, including middleware, network equipment, appliances, firewalls, IDS, antivirus systems, etc. can also be integrated easily. Business applications logs can be monitored in real time, and custom business-specific controls are easy to create and maintain. Overall, Tango/04 offers the most comprehensive security solution on the market.

Tango/04 Solutions Offer Extensive Coverage for the System i Although our security solutions are multi-platform capable, it’s important to stress our strength on the i5 platform for those of you that manage System i centric shops. Tango/04 is a Premier IBM Business Partner and key member of IBM’s Autonomic Computing initiative. In addition to receiving industry recognition on numerous occasions, our solutions have been validated by IBM and designated as IBM ServerProven.

Other associations we have with IBM include:

• IBM PartnerWorld for Developers (Advanced Member)

• IBM ISV Advantage Agreement

• IBM OS Early Code Release member

• IBM ServerProven Solution Provider

Technology Alliances outside of IBM In addition to our strong ties to IBM, the success of our solution also relies on the working relationships we have with other platform providers. These include:

• Microsoft Developer Network (MSDN)

• Microsoft Early Code Release member

• Red Hat Linux Partner

Professional Services We provide top notch professional services to help you install and configure our products across your critical platforms to meet your specific security needs. We’ll work together with your staff to add the precise controls you need in order to achieve compliance year after year. We’re not happy with any implementation unless you are completely satisfied.

In fact, since 2004 we’re proud to say that all of our projects for security, data protection and operations monitoring have been implemented on time and with full customer satisfaction. The loyalty and high rate of customer satisfaction is one of the best guarantees we can offer you.

Appendix B – PCI DSS Requirements



PCI DSS is a private industry standard applicable to organizations that store, process or transmit credit card information. The intent of the standard is to protect consumers by offering a single approach to safeguarding sensitive data for all credit card brands.

The standard consists of 12 high-level requirements as depicted in Table 1.

Each high level requirement is broken up into a number of detailed sub-requirements leading to a total of just over 200 individual checklist items. In practical terms, compliance simply cannot be achieved without the help of automated software technology. The Tango/04 security solution set can easily be used to support your PCI DSS compliance efforts. Our multi-platform, real-time technology is especially strong in helping you comply with Requirement 10. That being said, our solution can also be used to facilitate compliance with many of the other requirements as described in the remainder of this appendix where we present a mapping of our solution to specific PCI DSS requirements.

Table 1 : PCI DSS Requirements

1. Install and Maintain a firewall configuration to protect cardholder data

2. Do not use vendor-supplied defaults for system passwords and other security parameters

3. Protect stored cardholder data

4. Encrypt transmission of cardholder data across open, public networks

5. Use and regularly update anti-virus software

6. Develop and maintain secure systems

7. Restrict access to cardholder data by business need-to-know

8. Assign a unique ID to each person with computer access

9. Restrict physical access to cardholder data

10.Track and monitor all access to network resources and cardholder data

11.Regularly test security systems and processes

12.Maintain a policy that addresses information security



Mapping of Tango/04 Solutions to PCI DSS Detailed Requirements

Build and Maintain a Secure Network

Requirement 1: Install and maintain a firewall configuration to protect cardholder data

Detailed Description of top level requirement:

Firewalls are computer devices that control computer traffic allowed into and out of a company’s network, as well as traffic into more sensitive areas within a company’s internal network. A firewall examines all network traffic and blocks those transmissions that do not meet the specified security criteria.

All systems must be protected from unauthorized access from the Internet, whether entering the system as e-commerce, employees’ Internet-based access through desktop browsers, or employees’ e-mail access. Often, seemingly insignificant paths to and from the Internet can provide unprotected pathways into key systems. Firewalls are a key protection mechanism for any computer network.

Tango/04 Solution: Although our technology is not a firewall solution, we can help you support this requirement because VISUAL Security Suite can monitor logs and alerts coming from many system components including firewalls (in addition to antivirus software, IDS, applications, web servers and network devices). Events are sent to a centralized console where they are consolidated into a single view for further analysis. Beyond that we provide you with the ability to generate real-time alerts when a suspicious event occurs so you can take immediate action to the problem at hand. Our technology additionally includes the ability to perform actions (such as disabling a user at once from several platforms and domains, modifying a system setting, or ending a process) when an alert is generated so incidents can be handled automatically.

Requirement 2: Do not use vendor supplied defaults for system passwords and other security parameters


Hackers (external and internal to a company) often use vendor default passwords and other vendor default settings to compromise systems. These passwords and settings are well known in hacker communities and easily determined via public information.

Sub-requirement 2.2.3 Configure system security parameters to prevent misuse

Tango/04 Solution: Once system settings have been defined, VISUAL Security Suite can monitor those values and alert appropriate personnel in real-time when changes are made. Information concerning security policy exceptions is consolidated and presented in the Tango/04 console for quick visual identification. Color coding is possible to immediately attract attention according to the impact of the problem. Our technology also includes the ability to perform automatic actions (such as disabling a user at



once from several platforms and domains, modifying a system setting, or ending a process) when an alert is generated so incidents can be handled immediately, minimizing risk.

Protect Cardholder Data

Requirement 3: Protect stored cardholder data


Encryption is a critical component of cardholder data protection. If an intruder circumvents other network security controls and gains access to encrypted data, without the proper cryptographic keys, the data is unreadable and unusable to that person. Other effective methods of protecting stored data should be considered as potential risk mitigation opportunities. For example, methods for minimizing risk include not storing cardholder data unless absolutely necessary, truncating cardholder data if full PAN is not needed and not sending PAN in unencrypted e-mails.

Tango/04 Solution: Although we do not provide data encryption, we strongly support this top-level requirement in general by providing layers of defense that surround your critical data files. For example, our technology provides you with object access control by monitoring file reads, deletes, insertions, changes, restores and renames regardless of the platform or form in which the data is stored (e.g. database or spreadsheet). We also monitor object access denials so you know if a user has attempted to get to sensitive information such as cardholder data. In addition, we audit changes to file security itself, so you’ll know if someone has modified the list of users who have authority to the file.

If any of these events occur, we can alert you in real-time so that you’re able to immediately attend to the potential security infraction. Along with alerts we can also execute automatic actions, such as disabling a user profile or ending their job in order to minimize risk and potential exposure while you execute other defensive measures.

In many cases, malicious access or updates to your data occurs by an actual employee – someone who has been recognized as an authorized user. If this occurs, our solution has the ability to provide you with “who, what, when, how and where” type of information in addition to the before and after images of the data change.

Multiple layers of defense such as these significantly add strength to the protection of your cardholder data.

Sub-requirement 3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed).

Tango/04 Solution: This requirement is easily satisfied with the use of our Data Monitor module which tracks changes to critical files at the field level. Data Monitor has the capacity to hide sensitive fields within generated reports as shown in Figure 8.



Figure 8 – Data Monitor Report Segment

During configuration, as you define the sensitive files you wish to audit, you simply indicate the fields within those files that you do not want to display.

Maintain a Vulnerability Management Program

Requirement 5: Use and regularly update anti-virus software or programs


Many vulnerabilities and malicious viruses enter the network via employees’ e-mail activities. Anti-virus software must be used on all systems commonly affected by viruses to protect systems from malicious software.

Sub-requirement 5.2: Ensure that all anti-virus mechanisms are current, actively running, and capable of generating audit logs.

Tango/04 Solution: Although our technology is not an anti-virus solution, we can help you support this requirement because VISUAL Security Suite can monitor logs and alerts coming from many system components including antivirus software (in addition to firewalls, IDS, applications, web servers and network devices). Events are sent to a centralized console where they are consolidated into a single view for further analysis. Beyond that we provide you with the ability to generate real-time alerts when a suspicious event occurs so you can take immediate action to the problem at hand. Our technology additionally includes the ability to perform actions (such as disabling a user at once from several platforms and domains, modifying a system setting, or ending a process) when an alert is generated so incidents can be handled automatically.

Requirement 6: Development and maintain secure systems and applications


Unscrupulous individuals use security vulnerabilities to gain privileged access to systems. Many of these vulnerabilities are fixed by vendor-provided security patches. All systems must have the most recently



released, appropriate software patches to protect against exploitation by employees, external hackers, and viruses. Note: Appropriate software patches are those patches that have been evaluated and tested sufficiently to determine that the patches do not conflict with existing security configurations. For in-house developed applications, numerous vulnerabilities can be avoided by using standard system development processes and secure coding techniques.

Sub-requirement 6.3: Develop software applications based on industry best practices and incorporate information security throughout the software development life cycle.

6.3.2 Separate development, test and production environments

6.3.3 Separation of duties between development, test and production environments

Tango/04 Solution: The intent of these sub-requirements is to prevent developers from making changes and installing them directly in the production environment. VISUAL Security Suite can help you support these requirements because we are able to monitor user activity such as access to applications and command usage, including SQL statements executed. Along those same lines, we can also audit the movement of objects and programs from one environment to another, verifying that the promotion was done by an authorized user. We can also monitor object access such as a user reading or updating a critical data file. The ability to identify who is accessing what files helps you to maintain separation of duties, by making sure that users are not inappropriately updating information that doesn’t correspond to their job role.

If the policy you define regarding separation of duties is not followed, we can issue real-time alerts to enable you to take immediate action.

Implement Strong Access Control Measures

Requirement 7: Restrict access to cardholder data by business need-to-know


This requirement ensures critical data can only be accessed by authorized personnel.

Sub-requirement 7.1 Limit access to computing resources and cardholder information only to those individuals whose job requires such access.

Sub-requirement 7.2 Establish a mechanism for systems with multiple users that restricts access based on a user’s need to know and is set to “deny all” unless specifically allowed.

Tango/04 Solution: Our technology is extremely capable in this area because access as well as modifications to critical data files on several platforms can be monitored and reported on. Specifically, our technology provides you with object access control by monitoring file reads, deletes, insertions, changes, restores and renames regardless of the platform or form in which the data is stored (e.g. database or spreadsheet). We also monitor object access denials so you know if a user has attempted to get to sensitive information such as cardholder data. If any of these events occur, we can alert you in real-time so



that you’re able to immediately attend to the potential security infraction. Along with alerts we can also execute automatic actions, such as disabling a user profile or ending their job in order to minimize risk and potential exposure while you execute other defensive measures.

In many cases, malicious access or updates to your data may take place by an actual employee – someone who has been recognized as an authorized user. If this occurs, our solution has the ability to provide you with detailed tracking information including “who, what, when, how and where” in addition to the before and after images of the data change. As the control is done at the database level, it doesn’t matter where the change came from or which tool had been used to make the change. Real-time alerts can also be triggered when data files are inappropriately read or modified so you can react immediately to unauthorized data access attempts.

Requirement 8: Assign a unique ID to each person with computer access


Assigning a unique identification (ID) to each person with access ensures that actions taken on critical data and systems are performed by, and can be traced to, known and authorized users.

Sub-requirement 8.5: Ensure proper user authentication and password management for non-consumer users and administrators on all system components as follows:

8.5.1 Control addition, deletion, and modification of user IDs, credentials, and other identifier objects

8.5.5 Remove inactive user accounts at least every 90 days

Tango/04 Solution: Continuous user profile monitoring and regularly scheduled reporting allows easy tracking of user accounts and access rights for your users. Procedures to keep authentication and access mechanisms in check include ongoing monitoring of user profile creation, deletion, changes to user profiles, and management of passwords. User activity such as log-ins and access to applications are also audited. Access right rules can be enforced using simple (IP address filtering) or complex custom rules (such as automatically holding user processes for a profile corresponding to an employee currently on vacation, until the incident is investigated). Correlation technology can be used to check authentication mechanisms. Real-time alerts can be executed when a suspicious event occurs (such as the granting of special authority to an existing user profile) and built-in reports can be run in order to provide user activity information to the appropriate management personnel.

8.5.9 Change user passwords at least every 90 days

8.5.10 Require a minimum password length of at least seven characters

8.5.11 Use passwords containing both numeric and alphabetic characters

8.5.12 Do not allow an individual to submit a new password that is the same as any of the last four passwords he or she has used



8.5.13 Limit repeated access attempts by locking out the user ID after not more than six attempts

8.5.14 Set the lockout duration to thirty minutes or until administrator enables the user ID

8.5.15 If a session has been idle for more than 15 minutes, require the user to re-enter the password to re-activate the terminal

Tango/04 Solution: On the System i, sub-requirements 8.5.9 through 8.5.15 all correspond to system values settings which are easily monitored with VISUAL Security Suite. When changes are made to these settings we can alert appropriate personnel in real-time and also perform automatic actions (such as disabling a user at once from several platforms and domains, modifying a system setting, or ending a process) so incidents can be handled immediately.

In Windows and most Unix/Linux platforms, our technology can audit if the policy is set to the right value and generate real- time alerts in case of differences. Furthermore, we can also send alerts in real time when any changes to the security policy occur. With regard to 8.5.13, automated actions can easily be defined to disable a user ID if more that six failed attempts were detected.

8.5.16 Authenticate all access to any database containing cardholder data. This includes access by applications, administrators, and all other users

Tango/04 Solution: Access and modifications to critical data files on several platforms can be monitored and reported on. As the control is done at the database level, it doesn’t matter where the change came from (i.e. applications, administrators or your users). Changes to data records are available on leading databases at the field level and reports show “before” and “after” images. Real-time alerts can also be triggered when data files are inappropriately read or modified so you can react immediately to unauthorized data access attempts.

Regularly Monitor and Test Networks

Requirement 10: Track and access all access to network resources and cardholder data


Logging mechanisms and the ability to track user activities are critical. The presence of logs in all environments allows thorough tracking and analysis if something does go wrong. Determining the cause of a compromise is very difficult without system activity logs.

Sub-requirement 10.1: Establish a process for linking all access to system components (especially access done with administrative privileges such as root) to each individual user.

Tango/04 Solution: Our technology is able to monitor user activity such as access to applications and command usage, including SQL statements executed. Real-time alerts can be generated when sensitive commands are used so you can immediately react to the event.



Sub-requirement 10.2: Implement automated audit trails to reconstruct the following events for all system components:

10.2.1 All individual accesses to cardholder data.

Tango/04 Solution: Data Monitor can track read, update, insert and delete actions taken against any file. For changed records, it will show “before” and “after” versions of the record. You can also mask or hide data in the reports such as credit cards.

10.2.2 All actions taken by any individual with root or administrative privileges.

Tango/04 Solution: With VISUAL Security Suite we can audit commands and SQL statements executed, objects accessed, created, deleted, restored, file changes, authorization failures, user log-ons and much more.

10.2.3 Access to all audit trails.

Tango/04 Solution: Authorized users can access our Reporting System which includes over 200 built-in reports that run over the collected audit data that we store in our own data files. You can also easily build custom sub-reports. In addition, we are also open about our file structure, so you can run query’s over the data as well.

Besides historical reports, our real-time alerting capacity let’s you know instantly if a suspicious security event has occurred so you can address the situation on the spot. You also have the ability to automatically respond to events. For example, if a user is attempting to access a critical file after hours, we can call your cell phone and simultaneously end the user’s job and disable his profile to prevent any unwarranted updates to the file.

10.2.4 Invalid logical access attempts.

Tango/04 Solution: We can track all invalid user log-ins, providing date/time of failed log-in, all user attributes (such as user class) as well as device and IP address of the attempt.

10.2.6 Initialization of the audit logs.

Tango/04 Solution: VISUAL Security Suite can promptly alert you regarding any attempt to clear the audit logs where they are generated (for instance, the Windows Event Log on Windows servers). Our technology can also monitor changes to logs other than operating system logs, such as application logs, in real time. Attempts to clear the collected audit log events once they have been processed, correlated and archived (i.e, once they are stored in the historical event log repositories) can be monitored in real time as well (see requirement 10.5.5).

10.2.7 Creation and deletion of system-level objects.

Tango/04 Solution: VISUAL Security Suite can easily audit the creation/deletion of all objects at any level.

Sub-requirement 10.3: Record at least the following audit trail entries for each event, for all system components:



10.3.1 User identification

10.3.2 Type of event

10.3.3 Date and time

10.3.4 Success or failure indication

10.3.5 Origination of event

10.3.6 Identity or name of affected data, system component, or resource

Tango/04 Solution: VISUAL Security Suite audit entries include all of the above information and more. Below is an example of the information received when a user changed a system value:

Figure 9 – Sample Message Triggered by a System Value Change

The additional tabs shown above include additional information that can be passed as soft-coded variables to messages you can send by email or as a text message to a cell phone.

The Data Monitor module can be used to track file access and can report on data file changes by showing the “before” and “after” image as previously shown in Figure 7. Confidential information can be masked on reports and shown as “Restricted” so actual data, such as credit card numbers, is not visible. The data can also be enhanced to render it more readable. For example, an account code that reads 374404534 can be enhanced to reflect that the account belongs to “JOHN SMITH”. We can also provide additional data such as the user class, group, country and accounting code.

Real-time alerts can also be generated to immediately inform you of any suspicious security events.

Sub-requirement 10.5: Secure audit trails so they cannot be altered.



10.5.5 Use file integrity monitoring/change detection software on logs to ensure that existing log data cannot be changed without generating alerts (although new data being added should not cause an alert).

Tango/04 Solution: VISUAL Security Suite can promptly alert you regarding any attempt to change a file (including log files) in most operating systems and databases. Encryption technologies could also be integrated and used to further protect the historical event log repositories. Note, however, that encryption can be resource consuming and very intrusive when there is a need to extract forensic data or generate historical auditing reports. Consequently, our recommendation for this particular requirement is to use Data Monitor, the Tango/04 technology that permits you to monitor changes or deletions to a database at the record and field levels, including the monitoring of our own auditing database files.

Sub-requirement 10.6: Review logs for all system components at least daily. Log reviews should include those servers that perform security functions like IDS and authentication (AAA) servers.

Tango/04 Solution: Reports can be scheduled to run daily and automatically emailed to appropriate personnel. Reports can also be generated in various formats (e.g., .pdf, .xls, .doc) so you can easily sort and analyze the information.

A major benefit of implementing our technology is that real-time alerts can be generated at the time a potential security breach is happening. This means that instead of finding out about a potential breach after the fact when reviewing logs, that you can be alerted immediately and you can even take automated actions based on the event and threat level.

Sub-requirement 10.7: Retain your audit trail history for a period that is consistent with its effective use, as well as legal regulations. An audit history usually covers a period of at least one year, with a minimum of three months available online.

Tango/04 Solution: A major advantage of our solution is that the audit data is stored in its own database. Because customers are urged to only monitor for exceptions or deviations from the security policy, the amount of information stored is reasonable from a DASD standpoint. This is extremely useful because it gives you the ability to run audit reports long after the journals have been removed from your system.

With the Data Monitor product, which logs information about file updates, the data can even be stored on a different iSeries system or LPAR as well as a different platform such as a Windows server. This is a great advantage because of the added security and heavily decreased costs (disk space on Windows is much cheaper than on the System i).

Requirement 11: Regularly test security systems and processes


Vulnerabilities are being discovered continually by hackers and researchers, and being introduced by new software. Systems, processes, and custom software should be tested frequently to ensure security is maintained over time and with any changes in software.



Sub-requirement 11.4 Use network intrusion detection systems, host-based intrusion detection systems, and intrusion prevention systems to monitor all network traffic and alert personnel to suspected compromises. Keep all intrusion detection and prevention engines up-to-date.

Tango/04 Solution: Our technology supports this requirement because VISUAL Security Suite can monitor logs and alerts coming from many system components such as intrusion detection systems (in addition to firewalls, anti-virus software, applications, web servers and network devices). We also directly integrate with one of the most powerful and comprehensive exit point solutions for the System i which provides protection for more than 2,000 access functions.

Events of interest from all sources are sent to a centralized console (either PC or web based) where they are consolidated into a single view for further analysis. We also provide the ability to generate real-time alerts when a suspicious event occurs so you can take immediate action to the problem at hand. Our solution also enables you to define an escalation list for critical events so you can be sure they are addressed.

Our rich reporting system lets you conduct forensic analysis over events as a means of evaluating and improving the security systems and processes you have in place. Beyond that, our technology additionally includes the ability to perform actions (such as disabling a user at once from several platforms and domains, modifying a system setting, or ending a process) when an alert is generated so incidents can be handled automatically, minimizing total risk exposure.

Sub-requirement 11.5: Deploy file integrity monitoring to alert personnel to unauthorized modification of critical system or content files, and perform critical file comparisons at least daily (or more frequently if the process can be automated).

Tango/04 Solution: The Data Monitor product has the ability to monitor any files on your system for changes. Reports can be run to see all forensic information about the change, including the “before and after” images of the records changed. Real-time alerts can also be fired so you know immediately if a record has been changed by an unauthorized user, outside of normal business hours or even if a change exceeds a predefined threshold. For example, you may want to be notified immediately if a customer service representative has given a customer more than a 15% discount on his/her purchase.

Our technology can also provide you with real-time alerts when a suspicious security event occurs.

vss pcicomus-en

Documents