PCI Compliance with Netwrix All-in-One Suite

Integrated PCI DSS compliance solution for companies that accept credit cards

All vendors that accept credit cards are subject to PCI compliance. Failure to comply with PCI may result in fines, loss of reputation, and inability to accept major credit cards.

"It can be difficult to know what changed, when it changed, and who changed it. Add regulatory compliance and you'll need to hire a full crew to keep up the changes over time." /Michael Domingo, Executive Editor of MCPmag.com/

The following table summarizes requirements of PCI-DSS 2.0 compliance and shows how Netwrix All-in-One Suite helps sustain PCI compliance. This includes the following PCI DSS requirements covered:

#7 (Restrict access to cardholder data by business need-to-know);
#8 (Assign a unique ID to each person with computer access);
#10 (Track and monitor all access to network resources and cardholder data).

The rest must be covered by internal procedures (e.g. physical security, network perimeter security, testing and verification).

PCI DSS Requirement	Netwrix Solution	Components	Report Mapping
7. Restrict access to cardholder data by business need-to-know
7.1 Limit access to system components and cardholder data to only those individuals whose job requires such access.	Auditing functionality to monitor all security-related changes in Active Directory, Group Policy, Exchange, file servers, SQL Servers,virtualization environments. Audited use of high-privileged system accounts.	AD Change Reporter File Server Change Reporter Change Reporter for VMware SQL Server Change Reporter	AD Change Reporter / Administrative Group Membership Changes AD Change Reporter / Object Security Changes File Server Change Reporter / Permission Changes SQL Server Change Reporter / Object Changes
7.2 Establish a mechanism for systems with multiple users that restricts access based on a user´s need to know and is set to “deny all” unless specifically allowed.	Monitoring of file and folders and their permissions, Active Directory and Group Policy objects, SQL Server security for early detection of unauthorizedchanges to security access settings (e.g. granting of new permissions).	AD Change Reporter File Server Change Reporter SQL Server Change Reporter	AD Change Reporter / All Active Directory Changes Group Policy Change Reporter / All Group Policy Changes File Server Change Reporter / Permission Changes SQL Server Change Reporter / Login Changes SQL Server Change Reporter / Credential Changes
8. Assign a unique ID to each person with computer access
8.1 Assign all users with a unique user name before allowing them to access system components or cardholder data.	Complete auditing of user logons to analyze violations and prevent usage of the same ID by multiple persons (e.g. from different computers).	Event Log Manager Logon Reporter	Event Log Manager / Logon Reporter Logon Reporter / All logon reports
8.5.1 Control addition, deletion, and modification of user IDs, credentials and other identifier objects.	Full auditing of user account creations, deletions, password resets, and modifications to all user account attributes: in Active Directory and SQL Server.	AD Change Reporter SQL Server Change Reporter	AD Change Reporter / User Accounts Created AD Change Reporter / All Active Directory Changes SQL Server Change Reporter / Login Changes SQL Server Change Reporter / User Changes
8.5.2 Verify user identity before performing password resets.	Web-based challenge-response system based on verification question/answer pairs selected by users upon enrollment, with full control over the number of required verification answers. The same data can be used by help desk personnel to assist with password resets on the phone.	Password Manager	Password Manager / User Enrollment on-demand report
8.5.3 Set first-time passwords to a unique value for each user and change immediately after the first use.	Auditing of all newly created user accounts and their initial attributes(including "must change at next logon") to prevent violations.	AD Change Reporter	AD Change Reporter / User Account Modifications
8.5.4 Immediately revoke access for any terminated users.	Auditing of disabled accounts, automated de-provisioning of inactive user accounts.	AD Change Reporter Inactive Users Tracker	AD Change Reporter / Inactive Users Inactive Users Tracker / Daily report
8.5.5 Remove or disable inactive user accounts at least every 90 days.	Automated disabling and removal with full reporting.	Inactive Users Tracker	Inactive Users Tracker / Daily report
8.5.6 Enable accounts used by vendors for remote maintenance only during the time period needed.	Auditing of account creation, enabling, disabling, and deletion, with timestamps to analyze their lifetime.	AD Change Reporter SQL Server Change Reporter	AD Change Reporter / User Account Modifications SQL Server Change Reporter / Login Changes SQL Server Change Reporter / User Changes
8.5.7 Communicate password procedures and policies to all users who have access to cardholder data.	Automaticcustomizable reminders for expiring passwords, redirection to password requirements document if user enters "weak" password during reset.	Password Expiration Notifier Password Manager	Password Expiration Notifier / Daily report, User notification reports Password Manager / User Activity on-demand report
8.5.8 Do not use group, shared, or generic accounts and passwords.	Full auditing of account use (find all actions done under a shared accountand help eliminate its usage) and delegated access with account checkout/check-in concept.	AD Change Reporter File Server Change Reporter	AD Change Reporter / All Active Directory Changes by User File Server Change Reporter / All File Server Changes by User
8.5.9 Change user passwords at least every 90 days.	Audits changes to password policy settings in Active Directory, automatically reminds users about impending password expirations, provides easy way to change passwords to minimize the number of help desk calls.	Group Policy Change Reporter Password Expiration Notifier Password Manager	Group Policy Change Reporter / All Password Policy Changes Password Expiration Notifier / Daily report Password Manager / User Activity on-demand report
8.5.10- 8.5.12 Password complexity requirements (Require a minimum password length ofat least seven characters, Use passwords containing both numeric and alphabetic characters, Do not allow an individual to submit a new password that is the same as any of the last four passwords he or she has used).	Audits changes to password policies in Active Directory, implements self-service password reset functionality to help users with forgotten passwords without involvement of help desk personnel.	Group Policy Change Reporter Password Manager	Group Policy Change Reporter / All Password Policy Changes Password Manager / User Activity on-demand report
8.5.13 Limit repeated access attempts by locking out the user ID after notmore than six attempts.	Complements the built-in AD mechanism with extensive account lockout troubleshooting capabilities to resolve false positives and prevent user frustration and system downtime. Auditing of account unlock and password reset operations to monitor unauthorized access.	Account Lockout Examiner	AD Change Reporter / User Account Modifications
8.5.14 Set the lockout duration to thirty minutes or until administrator enables the user ID.	Auditing of account lockout policy changes to prevent non-compliant policy changes.	Group Policy Change Reporter	Group Policy Change Reporter / Account Lockout Policy Changes
8.5.16 Authenticate all access to any database containing cardholder data. This includes access by applications, administrators, and all other users.	Auditing of changes to database logins and roles, SQL server security settings.	SQL Server Change Reporter	SQL Server Change Reporter / Login Changes, Roles Changes, Credential Changes, User Changes
10. Track and monitor all access tonetwork resources and cardholder data
10.1 Establish a process for linking all access to system components (especially those done with administrative privileges such as root) to each individual user.	Full features auditing and reporting of all administrative activity within Active Directory, Group Policy, file servers, virtualization environments, SQL Server, etc. Detection of who changed what, when, andwhere.	AD Change Reporter File Server Change Reporter Change Reporter for VMware SQL Server Change Reporter	AD Change Reporter / All Active Directory Changes Group Policy Change Reporter / All Group Policy Changes SQL Server Change Reporter / All SQL Server Changes File Server Change Reporter / All File Server Changes Change Reporter for VMware / All VMware Changes
10.2 Implement automated audit trails to reconstruct the required events.	Complete audit trail processing capabilities for servers and workstations, both user-initiated and administrative activity.	Event Log Manager AD Change Reporter File Server Change Reporter Change Reporter for VMware SQL Server Change Reporter	AD Change Reporter / All Active Directory Changes File Server Change Reporter / All File Server Changes Change Reporter for VMware / All VMware Changes SQL Server Change Reporter / All SQL Server Changes Event Log Manager / All Events by Date
10.3 Record at least the following audit trail entries for all system components for each event: User identification, Type of event, Date and time, Success or failure indication, Origination of event, Identity or name of affected data, system component, or resource.	Full information of every change: who changed what, when, where, in Active Directory, File Server, virtual machines, SQL Servers.	AD Change Reporter File Server Change Reporter Change Reporter for VMware SQL Server Change Reporter	AD Change Reporter / All Active Directory Changes File Server Change Reporter / All File Server Changes Change Reporter for VMware / All VMware Changes SQL Server Change Reporter / All SQL Server Changes
10.5 Secure audit trails so they cannot be altered.	Securable file-based storage with optional SQL Server storage. Full featured rolebased access to all reports. Centralized collection, archiving, and consolidation of event logs to secure file-based storage.	All modules	All reports
10.6 Review logs for all system components at least daily.	Full-featured web-based reporting functionality with predefined reports and ability to create custom reports on any type of collected data. Out-of-the box reports scheduled daily and sent via e-mail for review.	All modules	All reports
10.7 Retain audit trail history for at least one year, with a minimum of three months immediately available for analysis.	Unlimited storage capabilities with efficient storage use to store up to 8 years of past audit trails and history of changes to system components and security settings. Full-featured web-based reporting for immediate access to all required data.	Event Log Manager AD Change Reporter File Server Change Reporter Change Reporter for VMware SQL Server Change Reporter	All reports