File Integrity Monitoring – PCI DSS Requirements 10, 10.5.5 and 11.5
Although FIM or File-Integrity Monitoring is only mentioned specifically in two sub-requirements of the PCI DSS (10.5.5 and 11.5), it is actually one of the more important measures in securing business systems from card data theft.
What is it, and why is it important?
File Integrity monitoring systems are designed to protect card data from theft. The primary purpose of FIM is to detect changes to files and their associated attributes. However, this article provides the background to three different dimensions to file integrity monitoring, namely:
- secure hash-based FIM, used predominantly for system file integrity monitoring
- file contents integrity monitoring, useful for configuration files from firewalls, routers and web servers
- file and/or folder access monitoring, vital for protecting sensitive data
Secure Hash Based FIM
Within a PCI DSS context, the main files of concern include:
- System files e.g. anything that resides in the Windows/System32 or SysWOW64 folder, program files, or for Linux/Unix key kernel files
The objective for any hash-based file integrity monitoring system as a security measure is to ensure that only expected, desirable and planned changes are made to in scope devices. The reason for doing this is to prevent card data theft via malware or program modifications.
Imagine that a Trojan is installed onto a Card Transaction server – the Trojan could be used to transfer card details off the server. Similarly, a packet sniffer program could be located onto an EPoS device to capture card data – if it was disguised as a common Windows or Unix process with the same program and process names then it would be hard to detect. For a more sophisticated hack, what about implanting a ‘backdoor’ into a key program file to allow access to card data??
These are all examples of security incidents where File-Integrity monitoring is essential in identifying the threat.
Remember that anti-virus defenses are typically only aware of 70% of the world’s malware and an organization hit by a zero-day attack (zero-day marks the point in time when a new form of malware is first indentified – only then can a remediation or mitigation strategy be formulated but it can be days or weeks before all devices are updated to protect them.
How far should FIM measures be taken?
As a starting point, it is essential to monitor the Windows/System32 or SysWOW64 folders, plus the main Card Data Processing Application Program Folders. For these locations, running a daily inventory of all system files within these folders and identifying all additions, deletions and changes. Additions and Deletions are relatively straightforward to identify and evaluate, but how should changes be treated, and how do you assess the significance of a subtle change, such as a file attribute? The answer is that ANY file change in these critical locations must be treated with equal importance. Most high-profile PCI DSS security breaches have been instigated via an ‘inside man’ – typically a trusted employee with privileged admin rights. For today’s cybercrime there are no rules.
The industry-acknowledged approach to FIM is to track all file attributes and to record a secure hash. Any change to the hash when the file-integrity check is re-run is a red alert situation – using SHA1 or MD5, even a microscopic change to a system file will denote a clear change to the hash value. When using FIM to govern the security of key system files there should never be any unplanned or unexpected changes – if there are, it could be a Trojan or backdoor-enabled version of a system file.
Which is why it also crucial to use FIM in conjunction with a ‘closed loop’ change management system – planned changes should be scheduled and the associated File Integrity changes logged and appended to the Planned Change record. 2
File Content/Config File Integrity Monitoring
Whilst a secure hash checksum is an infallible means of identifying any system file changes, this does only tell us that a change has been made to the file, not what that change is. Sure, for a binary-format executable this is the only meaningful way of conveying that a change has been made, but a more valuable means of file integrity monitoring for ‘readable’ files is to keep a record of the file contents. This way, if a change is made to the file, the exact change made to the readable content can be reported.
For instance, a web configuration file (php, aspnet, js or javascript, XML config) can be captured by the FIM system and recorded as readable text; thereafter changes will be detected and reported directly. 2
Similarly, if a firewall access control list was edited to allow access to key servers, or a Cisco router startup config altered, then this could allow a hacker all the time needed to break into a card data server. For more information visit Database outsourcing
One final point on file contents integrity monitoring – Within the Security Policy/Compliance arena, Windows Registry keys and values are often included under the heading of FIM. These need to be monitored for changes as many hacks involve modifying registry settings. Similarly, a number of common vulnerabilities can be identified by analysis of registry settings. For more information visit Database outsourcing
File and/or Folder Access Monitoring
The final consideration for file integrity monitoring is how to handle other file types not suitable for secure hash value or contents tracking. For example, because a log file, database file etc will always be changing, both the contents and the hash will also be constantly changing. Good file integrity monitoring technology will allow these files to be excluded from any FIM template.
However, card data can still be stolen without detection unless other measures are put in place. As an example scenario, in an EPoS retail system, a card transaction or reconciliation file is created and forwarded to a central payments server on a scheduled basis throughout the trading day. The file will always be changing – maybe a new file is created every time with a time stamped name so everything about the file is always changing.
The file would be stored on an EPoS device in a secure folder to prevent user access to the contents. However, an ‘inside man’ with Admin Rights to the folder could view the transaction file and copy the data without necessarily changing the file or its attributes. Therefore the final dimension for File Integrity Monitoring is to generate an alert when any access to these files or folders is detected, and to provide a full audit trail by account name of who has had access to the data.
Much of PCI DSS Requirement 10 is concerned with recording audit trails to allow a forensic analysis of any breach after the event and establish the vector and perpetrator of any attack.
Article done by Mark Kedgley Article Source: http://EzineArticles.com/?expert=Mark_Kedgley
|
|
2 Channel 100 Mb/s Serial PCI BERT Card, w/ cable – NEW $13,550.00 |
|
|
2 Channel 100 Mb/s Serial PCI BERT Card – NEW $13,200.00 |
|
|
2 Channel 50 Mb/s Serial PCI BERT Card, w/ cable – NEW $8,750.00 |
|
|
2 Channel 50 Mb/s Serial PCI BERT Card – NEW $8,400.00 |
|
|
ADAPTEC 2410SA RAID SERIAL ATA PCI 4-PORTS 10-PACK 2083700 $4,091.20 |
|
|
Adaptec 52445 28 Port Serial Ata/sas Raid Controller – 512mb Ddr2 – Pci Express $1,378.44 |
|
|
Digi AccelePort 16EM – Serial adapter – PCI – RS-232 – 115.2 Kbps – 16 port(s) $1,172.39 |
|
|
Intel Rs2sg244 Sas Raid Controller – Serial Ata/600, Serial Attached Scsi – Pci $1,133.98 |
|
|
Intel RAID Controller RS25SB008 – Serial Attached SCSI (SAS) – PCI Express 2.0 $1,007.65 |
|
|
Digi AccelePort 16em – Serial adapter – PCI – RS-232 – 16 ports 70001757 $994.99 |
|
|
Adaptec 51645 20 Port Serial Ata/sas Raid Controler – 512mb Ddr2 – Pci Express $931.75 |
|
|
Adaptec 6805Q 8-port SAS Controller – Serial Attached SCSI (SAS) – PCI Express $925.47 |
|
|
Adaptec 6805TQ 8-port SAS Controller – Serial Attached SCSI (SAS) – PCI Express $925.26 |
|
|
ADAPTEC SERIAL ATTACHED SCSI RAID 4805SAS SERIAL ATA-300 PCI-E X8 2183300 $873.27 |
|
|
2 Serial + 1 Parallel IEEE 1284 PCI I/O Card (Lots 100) $860.00 |
|
|
Adaptec 5085 8 Port Serial Ata/sas Raid Controller – 512mb Ddr2 – Pci Express X8 $821.08 |
|
|
Adaptec 51645 20 Port Serial Ata/sas Raid Controler – 512mb Ddr2 – Pci Express $810.99 |
|
|
Intel 8-port SAS Controller – Serial Attached SCSI (SAS) – PCI Express 2.0 x8 - $780.55 |
|
|
PROMISE 4-PORTS SERIAL ATA 3GB/S PCI SW RAID 5 CONTROLLER FASTTRAKTX4310ROHS $763.61 |
|
|
Adaptec 51245 Sas Raid Controller – Serial Attached Scsi, Serial Ata/300 – Pci $757.94 |
|
|
Intel RS25DB080 8-port SAS RAID Controller Serial ATA/600 SAS PCI Express x8 $738.71 |
|
|
Cisco 9261-8i Sas Raid Controller – Serial Attached Scsi, Serial Ata/300 – Pci $746.68 |
|
|
NEW LSI00209 MegaRAID 9280-4i4e SAS RAID Controller – Serial Attached SCSI – PCI $711.37 |
|
|
Cisco 9260-4i SAS RAID Controller – Serial Attached SCSI, Serial ATA/600 – PCI $710.08 |
|
|
Adaptec 51245 Sas Raid Controller – Serial Attached Scsi, Serial Ata/300 – Pci $699.74 |
|
|
Intel Rs2mb044 Sas Raid Controller – Serial Attached Scsi, Serial Ata/600 – Pci $683.67 |
|
|
(Lots100) eSATA+SATA Serial ATA+IDE PCI Controller Card $675.00 |
|
|
Intel 4-port SAS Controller – Serial Attached SCSI (SAS) – PCI Express 2.0 x8 - $655.42 |
|
|
Digi International 70001362 Digi – Serial Adapter – Pci – Serial Rs-232 – 8 $647.48 |
|
|
Digi International 70001548 Digi Acceleport Xp-serial Adapter-pci-rs-232-8 Ports $641.96 |
|
|
Intel SRCSASPH16I 16 Port Serial ATA/SAS RAID Controller – 256MB Embedded – PCI $641.72 |
|
|
DIGI – SERIAL ADAPTER – PCI – SERIAL RS-232 – 8 PO $615.99 |
|
|
Digi AccelePort 8r 920 – Serial adapter – PCI – serial RS-232 – 8 ports 77000561 $616.99 |
|
|
Sun X2156A Serial Asynchronous Interface PCI (SAI/P) 3.0 Card 375-0100 LVN SYS $600.00 |
|
|
Comtrol 991267 Comtrol Rocketport Universal Pci Serial Adapter Pci 64 32-ports $609.65 |
|
|
OEM BEG009-01 ConnectTech BlueStorm/Express PCI-e 8 port Serial Card (includes c $595.00 |
|
|
Digi International 77000561 Digi – Serial Adapter – Pci – Serial Rs-232 – 8 $593.80 |
|
|
3WARE SERIAL ATA II HARDWARE RAID PCI 9550SX-8LP 9550SX8LP $582.00 |
|
|
3ware 9750-8i Sas Raid Controller – Serial Attached Scsi – Pci Express X8 - $569.15 |
|
|
Adaptec 5805 8 Port Serial Ata/sas Raid Controller – 512mb Ddr2 – Pci Express X8 $563.75 |
|
|
Adaptec 5445 8 Port Serial Ata/sas Raid Controller – 512mb Ddr2 – Pci Express X8 $563.73 |
|
|
Brainboxes Universal PCI Serial Adapter UC-235-X10 $521.88 |
|
|
Digi AccelePort 4r 920 – Serial adapter – PCI – serial RS-232 – 4 ports 70001361 $550.99 |
|
|
Intel Rs2bl080 Sas Raid Controller – Serial Ata/600, Serial Attached Scsi – Pci $547.96 |
|
|
Digi AccelePort 8r 920 includes DB-25M fan-out cable Serial adapter – PCI – 8 po $540.00 |
|
|
Brainboxes UC-235 – Serial adapter – PCI low profile – RS-232 (pack o UC-235-X10 $524.99 |
|
|
Adaptec 5445 8 Port Serial Ata/sas Raid Controller – 512mb Ddr2 – Pci Express X8 $521.19 |
|
|
Adaptec 6805T 8-port SAS Controller – Serial Attached SCSI (SAS) – PCI Express $521.03 |
|
|
Adaptec 5805 8 Port Serial Ata/sas Raid Controller – 512mb Ddr2 – Pci Express X8 $518.44 |
|
|
Brainboxes 1-port Universal PCI Serial Adapter – 1 x 9-pin DB-9 Male RS-232 $506.18 |
|
|
EQUINOX SST128P SERIAL ADAPTER RAS/UNIX HOST BOARD PCI 990305 $502.41 |
|
|
Intel Rms2mh080 Sas Raid Controller – Serial Attached Scsi, Serial Ata/600 – Pci $491.49 |
|
|
Comtrol Rocketport Plus Upci Quad Db25 Multiport Serial Adapter – Universal Pci $482.99 |
|
|
NEW Digi 70001208 AccelePort Xem Univ. PCI Multiport Serial Adapter + 8em DB25 $449.99 |
|
|
2 Serial + 1 Parallel IEEE 1284 PCI I/O Card (Lots 50) $450.00 |
|
|
Brainboxes PX-275 8-port Multiport Serial Adapter – PCI Express x16 – 8 x DB-25 $447.31 |
|
|
HP 337972-B21 PCI-X Serial ATA-150 SATA RAID Controller $425.00 |
|
|
Intel Rt3wb080 Sas Raid Controller – Serial Ata/600, Serial Attached Scsi – Pci $440.07 |
|
|
COMTROL RocketPort Universal PCI Octa DB25 Multiport Serial Adapter 8 x D-Sub $438.64 |
|
|
COMTROL RocketPort Universal PCI 16-Port Multiport Serial Adapter 16 x $435.39 |
|
|
Comtrol RocketPort uPCI – Serial adapter – PCI – serial – 16 ports 99355-1 $427.99 |
|
|
Digi 70001193 Digi Acceleport 4r Series 422 Serial Adapter Pci Card (70001193) $410.05 |
|
|
Digi 70001194 Pci/4r-eia442 Multi-port Serial Card $410.05 |
|
|
3WARE SERIAL ATA II RAID 4CH PCI-E 9550SX4LPKIT $407.71 |
|
|
ADAPTEC – 2258100-R Serial ATA RAID 5405 RAID SATA/SAS Kit 256MB PCI Express $403.86 |
|
|
Sun 370-2810 Rev 50 Serial Asynchronous Interface PCI Card Digi 50000490-07 RevC $399.99 |
|
|
SIIG 8-port Multiport Serial Adapter – PCI Express – 8 x DB-9 Male $395.27 |
|
|
Adaptec 5405 4 Port Serial Ata/sas Raid Controller – 256mb Ddr2 – Pci Express X8 $392.92 |
|
|
3ware 9750-4i Sata Raid Controller – Serial Ata/600, Serial Attached Scsi – Pci $391.82 |
|
|
Promise SATA300 TX4-5PK Cost-effective 4-Port Serial ATA PCI Adapter $391.61 |
|
|
DIGI INTERNATIONAL 77000889 Neo Universal Pci Serial Adapter $390.26 |
|
|
Lot of 12, 4-port S-ATA II card for PCI slot, SATA2 (Serial ATA) 2 INT & 2 EXT $389.99 |
|
|
COMTROL RocketPort Universal PCI Octa DB9 Multiport Serial Adapter 8 x D-Sub $382.88 |
|
|
NI PCI-8430/16 RS-232 16-PORT SERIAL INTERFACE RS232 $380.00 |
|
|
HP 468406-B21 SAS RAID Controller – Serial Attached SCSI – PCI Express – Pl… $375.42 |
|
|
Digi 5500053402 Pci/4r-eia442 Multi-port Serial Card $375.30 |
|
|
Adaptec 5405 4 Port Serial Ata/sas Raid Controller – 256mb Ddr2 – Pci Express X8 $369.33 |
|
|
SIIG 8-port Multiport Serial Adapter – Universal PCI – 8 x DB-9 Male RS-232 $365.47 |
|
|
Comtrol RocketPort uPCI Octa DB9 – Serial adapter – PCI – RS-232 – seria 99342-1 $363.99 |
|
|
COMTROL RocketPort Universal PCI Quad DB25 Multiport Serial Adapter 4 x D-Sub $359.00 |
|
|
SIIG 4-port MultiPort Serial Adapter – Universal PCI – 4 x DB-9 Male $357.63 |
|
|
ADAPTEC 2420SA HALF-SIZE PCI-X TO SERIAL ATA II RAID CONTROLLER 2169300R $351.87 |
|
|
990305 Equinox (Avocent) PCI Serial I/O SST-128P Port Adapter (SST128P) $350.00 |
|
|
22P4471 IBM PCI Serial I/O SST128P Port Adapter Card $350.00 |
|
|
37L1416 IBM PCI Serial I/O SST-128P Port Adapter Card 5V $350.00 |
|
|
37L1429 IBM PCI Serial I/O SST128P Port Adapter Card 32-Bit $350.00 |
|
|
37L1457 IBM PCI Serial I/O SST128P Port Adapter Card $350.00 |
|
|
950257-1 Equinox (Avocent) PCI Serial IO SST-128P Port Adapter (9502571 SST128P) $350.00 |
|
|
X1155A 370-2728 – Sun High Speed Serial PCI Card $350.00 |
|
|
eSATA+SATA Serial ATA+IDE PCI Controller Card (Lots 50) $350.00 |
|
|
COMTROL 30000-7 ROCKETPORT INFINITY OCTA DB9M 8PT SERIAL PCI-X $349.46 |
|
|
COMTROL 30000-7 ROCKETPORT INFINITY OCTA DB9M 8PT SERIAL PCI-X $349.46 |
|
|
Comtrol 970200 Comtrol Rocketport Plus Serial Adapter Pci 8-ports 970200 $345.45 |
|
|
Digi Neo – Serial adapter – PCI Express – RS-232 – 8 ports 77000889 $342.99 |
|
|
Comtrol Rocketport Express Octacable Db9 Multiport Serial Adapter – Pci Express $341.18 |
|
|
Sun X1155A High Speed Serial Interface PCI (HSI/P) 2.0 Card 370-2728 LVN SYSTEMS $325.00 |
|
|
Comtrol RocketPort EXPRESS Octacable DB25 – Serial adapter – PCI Express 30129-5 $336.99 |
|
|
Comtrol RocketPort INFINITY Octacable DB9 – Serial adapter – PCI-X – RS- 30000-7 $336.99 |
|
|
Comtrol RocketPort EXPRESS Octacable DB9 – Serial adapter – PCI Express 30128-8 $336.99 |
|
|
COMTROL RocketPort Universal PCI Quad DB9 Multiport Serial Adapter 4 x D-Sub $333.81 |
|
|
PIC Programmer & Experimenter Kit $34.49 Unlike the stand-alone programmer K8076, this programmer also acts as an advanced experimenters board for PIC microcontrollers. Separate 8, 14, 18, and 28 pin sockets accommodate a wide variety of controllers. This eliminates the need for patching a universal ZIF socket. In addition, programming switches and LED status and feedback indicators to help you with your programming. Once programmed, no … |
|
|
Adaptec Serial ATA RAID 2405 ROHS KIT SATA/SAS RAID PCI-E 3Gbs Low-profile Retail Low Profile New $518.48 The Series 2 family of Adaptec Unified Serial (SATA/SAS) RAID controllers leverages the same industry-leading dual-core hardware RAID design as our industry-leading Series 5 Performance RAID controllers.The Adaptec RAID 2405 features 800 MHz of processing power, a 128MB of DDR2 write cache, connectivity with the latest X8 PCI-Express, and direct I/O connectivity for SATA/SAS tape devices and hard … |
|
|
Alarm Lock AL-PCI 2 Serial Computer Interface Serial computer interface with software. For use with Trilogy series locks…. |
|
|
Handy PC Complete Computer System $1,265.00 Handy PC Desktop is a complete computer in a standard computer keyboard. It’s the number one choice for dorm room students at college. For those working with limited space, the Handy PC provides you with power of a desk top in a mobile computer. You can carry the World in the Palmof your Hand. The Handy PC includes the following product information. PC Pentium 4 GHz, 256 MB RAM, 80 GB Hard Drive, … |
|
|
Syba SY-BIR-IDESA IDE/SATA Converter Bi-Directional IDE to SATA $5.99 SYBA SATA/IDE 2WAY CONVERTER JM… |
|
|
Startech. Com 2 PORT LP PCI EXPRESS SERIAL CARD Native RS232 PCI Express Serial Card with 16950 UART $46.29 while reducing the load applied to the CPU by as much as 48% over conventional bridge chip serial cards. The PCI Express RS232 Serial Adapter Card is compatible with a broad range of operating systems including Windows? 7/ Server 2008 R2 / Vista/ XP/ 2000, Linux Kernel 2.6.11 and up. The card comes pre-configured with a low profile bracket, but also includes an optional full profile bracket that l… |
|
|
Usb Universal Charging Adapter Charge From Any Usb Port Regardless Of The Power Output $12.99 Normally devices will not begin charging unless they detect power output of 1A or higher from the port they are plugged into. This handy device bypasses that detection and enables the devices to charge from any USB port regardless of the power output. T… |
|
|
Industrial Grade PCI Express PCIe ExpressCard adapter/reader 2.5Gb/S : Supports 1394/FireWire/iLINK Gigabit Ethernet SATA II Serial Port TV Tuners USB Wireless LAN (802.11a/b/g, WiFi) WAN/Wireless Broadband Internet ExpressCards. $34.98 Applications and Solutions: 1. Use the PCI Express to ExpressCard adapter for your wireless broadband connections and be able to connect to the internet > Connect USB 2.0, IEEE-1394 FireWire, RS-232 Serial, LAN/Network, Serial ATA, modem laptop cards as well as other laptop Features 2. Compliant with PCI Express Base Specification 1.0a 3. No need to buy separate cards for both your laptop and desk… |
|
|
New – 4 Port PCI Express Serial Card by Startech.com – PEX4S950 $106.14 4 Port PCI Express 16C950 Serial Card… |
|
|
New – 10pk 2-Port Serial PCI Cards by Startech.com – 10PKPCI2S550 $386.16 10 Pack of 2 Port 16550 Serial PCI Cards. Get more out of your serial devices! StarTech s 10PKPCI2S550 10 pack bulk serial cards give you two serial ports per card for connecting any new or old serial peripheral. Ideal for system builders these cards come in non-retail packaging with a single driver disk providing you with over 35% in savings! Perfect for connecting serial modems POS devices PDA… |
