As you probably know, the PCI DSS is a minimum set of security controls that must be in place around anything that transmits, stores, or processes cardholder data. That’s probably why the card brands and the SSC get so irritated that even this basic set of good practices is so hard to achieve.
That said, unless you have a way of monitoring and maintaining your compliance within these baselines, it’s not only VERY difficult to stay compliant (let alone secure), it makes validation of your compliance an annual nightmare of gathering screenshots, log samples, and so on. I estimated that that validation of controls can take up to 25% of the entire annual assessment cycle.
This is a tremendous loss of resource time, and does nothing for your ROI, so why DOES the PCI DSS only require an annual point-in-time validation, and not validation of continuous compliance? Yes, you are accountable to stay compliant at all times, but you only have to validate it once a year, and – if you’ve earned it – on only a sample of your systems.
The answer is, they simply cannot go that far. Continuous Compliance is far more difficult than achieving PCI compliance, and is firmly in the realms of good security practices. They can enforce minimums, they cannot enforce more than that and get the necessary acceptance.
So what IS Continuous Compliance? “It is the near real-time notification of a variation from your baselined norms.” Or to put it another way; once you know what something should look like normally, you want to know if it changes from that.
For example, the PCI DSS specifies about a dozen or so validation points for an operating system: business justification for all listening ports, access control, logging, FIM and so on. Once a year, you have to show your assessor that these validation points meet the DSS requirements, and that’s it for the YEAR! All too often, systems fall out of compliance within a matter of days.
Instead, what I propose, is that you should automate (as much as possible) the collection of that validation data, and compare it to not only the PCI DSS requirement minimums, but to ALL of your compliance / regulation / internal policy standards. And not yearly, but hourly, daily, weekly, whatever makes sense. Wouldn’t you rather show your assessor a green checkmark for ALL of your systems than a dozen screenshots for a mere sample?
If this can be configured for just 50% of your in-scope devices, your entire annual validation burden will be reduced by 30% or more. Plus, you also have a very convincing addition to your compensating controls for lack of FIM or AV (if applicable).
Best of all, you are now doing security as it was meant to be done; Enterprise wide, and Business As Usual.
Any operating system experts out there want to help me put this together?
[If you liked this article, please share! Want more like it, subscribe!]