19.8. Contents of PCI DSS reports

To help you comply with the regulations of the Payment Card Industry Data Security Standard (PCI DSS), PSM can generate reports on the compliance status of PSM. Note that this is not a fully-featured compliance report: it is a tool to enhance and complement your compliance report by providing information available in PSM. The report corresponds with the document Payment Card Industry (PCI) Data Security Standard, Requirements and Security Assessment Procedures, Version 3.0, published by the PCI Security Standards Council.

For details on creating PCI DSS reports, see Procedure 19.7, Creating PCI DSS reports. The following table details the information included in the PSM PCI DSS reports, and the relevant PCI compliance requirement.

PCI DSS RequirementCompliance details

Requirement 1.1.6. Documentation and business justification for use of all services, protocols, and ports allowed, including documentation of security features implemented for those protocols considered to be insecure. Examples of insecure services, protocols, or ports include but are not limited to FTP, Telnet, POP3, IMAP, and SNMP v1 and v2.

The report lists the insecure connection policies configured in PSM, including SNMP server and agent settings, and the list of connection policies that permit unencrypted HTTP and Telnet. This list does not include any insecure connections that can be used to access PSM itself.

Requirement 2.1. Always change vendor-supplied defaults and remove or disable unnecessary default accounts before installing a system on the network. This applies to ALL default passwords, including but not limited to those used by operating systems, software that provides security services, application and system accounts, point-of-sale (POS) terminals, Simple Network Management Protocol (SNMP)community strings, etc.).

PSM can be accessed as "root" via the local management console, or - if explicitly enabled - remotely using a Secure Shell (SSH v2) connection. The report lists the local web user accounts that can access PSM. For details on configuring these accounts, see Section 5.1, Managing PSM users locally.

Requirement 2.2.2. Enable only necessary services, protocols, daemons, etc., as required for the function of the system.

The report includes the list of services running on PSM.

Requirement 2.2.3. Implement additional security features for any required services, protocols, or daemons that are considered to be insecure—for example, use secured technologies such as SSH, S-FTP, SSL, or IPSec VPN to protect insecure services such as NetBIOS, file-sharing, Telnet, FTP, etc.

The report lists the connection policies enabling unencrypted HTTP and Telnet access, and any such session that was active when the report was generated.

Requirement 2.3. Encrypt all non-console administrative access using strong cryptography. Use technologies such as SSH, VPN, or SSL/TLS'' for web-based management and other non-console administrative access.

Use HTTPS to connect to PSM. HTTP connections are forbidden.

Requirement 3.5.2. Store secret and private keys used to encrypt/decrypt cardholder data in one (or more) of the following forms at all times:

  • Encrypted with a key-encrypting key that is at least as strong as the dataencrypting key, and that is stored separately from the data-encrypting key

  • Within a secure cryptographic device (such as a host security module (HSM) or PTS-approved point-of-interaction device)

  • As at least two full-length key components or key shares, in accordance with an industry-accepted method

Note: It is not required that public keys be stored in one of these forms.

Audit trails are encrypted with AES128-GCM (audit trails recorded with PSM 5 F3 and earlier are encrypted with AES128-CBC). The master key is encrypted with the key you provided.

Requirement 5.1.2. For systems considered to be not commonly affected by malicious software, perform periodic evaluations to identify and evaluate evolving malware threats in order to confirm whether such systems continue to not require anti-virus software.

PSM is an appliance running minimal services and using a hardened operating system. Balabit, the vendor of PSM, continuously monitors vulnerabilities and CVEs that might affect the components of PSM, and publishes security updates and announcements as needed. Using an up-to-date PSM version should keep the risk of PSM being affected by malicious software at a minimum level.

Requirement 6.2. Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches. Install critical security patches within one month of release.

The report includes the firmware version running on PSM. You can check which is the latest version at the Balabit Downloads page.

Requirement 8.1.8. If a session has been idle for more than 15 minutes, require the user to reauthenticate to re-activate the terminal or session.

The report includes the timeout value to the PSM web interface (10 minutes by default). To change this value, see Section 4.2.3, Web interface timeout.

Requirement 8.2.1. Using strong cryptography, render all authentication credentials (such as passwords/phrases) unreadable during transmission and storage on all system components.

The report lists where PSM stores passwords, and the hash used to secure them.

Requirement 8.2.4. Change user passwords/passphrases at least every 90 days.

The report lists the password expiry settings of local web users of PSM, and also the last time the password of each user was changed. For details on configuring these accounts, see Section 5.1, Managing PSM users locally. For details on configuring password expiry for these accounts, see Procedure 5.2, Setting password policies for local users.

Requirement 8.2.5. Do not allow an individual to submit a new password/phrase that is the same as any of the last four passwords/phrases he or she has used.

The report includes the password history settings of local web users of PSM. For details on configuring password history for these accounts, see Procedure 5.2, Setting password policies for local users.

Requirement 10.5.3. Promptly back up audit trail files to a centralized log server or media that is difficult to alter.

The report lists the addresses of the logservers where PSM forwards its log messages. For details on forwarding log messages, see Procedure 4.5.1, Configuring system logging.

Requirement 10.5.4. Write logs for external-facing technologies onto a secure, centralized, internal log server or media device.

The report lists the security settings of the communication between PSM and the logservers where PSM forwards its log messages. For details on forwarding log messages, see Procedure 4.5.1, Configuring system logging.

Requirement 10.7. Retain audit trail history for at least one year, with a minimum of three months immediately available for analysis.

The retention time for local logs of PSM is seven days. To retain them longer, forward them to a remote logserver.

Table 19.19. Contents of PCI DSS reports