PCI Compliance Policy

1.1   Introduction

This document explains Grant’s Septic Techs’ information security requirements for all employees. Grant’s Septic Techs' management has committed to these policies to protect information utilized by Grant’s Septic Techs in attaining its business goals. All employees are required to adhere to the policies described within this document.

 

1.2   Regulatory Compliance

The Payment Card Industry Data Security Standard (PCI DSS) Program is a mandated set of security standards that were created by the major credit card companies to offer merchants and service providers a complete, unified approach to safeguarding credit cardholder information for all credit card brands.

 

In September of 2006, a group of five leading payment brands including American Express, Discover Financial Services, JCB, MasterCard Worldwide and Visa International jointly announced formation of the PCI Security Standards Council, an independent council established to manage ongoing evolution of the PCI standard. Concurrent with the announcement, the council released version 1.1 of the PCI standard.

 

The PCI Data Security Standard requirements apply to all payment card network members, merchants and service providers that store, process or transmit cardholder data. The requirements apply to all methods of credit card processing, from manual to computerized; the most comprehensive and demanding of which apply to e-commerce websites, and retail POS systems that process credit cards over the internet.

 

During normal course of compliance and reporting activities Grant’s Septic Techs will ensure that proper scoping of compliant PCI operations and reporting are in effect.

 

1.3   Scope of Compliance

This Information Security Policy applies to all “system components.” System components are defined as any network component, server, or application that is included in or connected to the company’s information environment. The company information environment is that part of the network that possesses company information. For example, the following types of systems would be in scope for compliance within any environment:

                                                                                                     

­   Systems storing company information (e.g. databases, PC’s used by accounting for generating reports)

­   Systems processing company information (e.g. web servers, application servers, etc.)

­   Network devices transporting or directing company information traffic (e.g. border router, DMZ firewall, intranet firewall, etc.)

­   Devices that create media containing company information (e.g. fax machine, printer, backup tape silo)

­   Support systems (e.g. Active Directory, PC’s performing support functions such as system administration, etc.)

 

2    POLICY ROLES AND RESPONSIBILITIES

2.1   Policy Applicability

All employees, contractors, vendors and third-parties that use, maintain or handle

Grant’s Septic Techs information assets must follow this policy.

 

2.2   Role of Chief Technical Officer

The Chief Technical Officer is responsible for coordinating and overseeing Grant’s Septic Techs’ compliance with policies and procedures regarding the confidentiality, integrity and security of its information assets.

 

The Chief Technical Officer will work closely with the other Grant’s Septic Techs’ managers and staff involved in securing the company’s information assets to enforce established policies, identify areas of concern, and implement appropriate changes as needed. Specific responsibilities of the Chief Technical Officer include:

 

­   Make high-level decisions pertaining to the information security policies and their content. Approve exceptions to these policies in advance on a case-by-case basis.

­   On an annual basis, coordinate a formal risk assessment to identify new threats and vulnerabilities and identify appropriate controls to mitigate any new risks.

­   At least annually review the Information Security policies and procedures to maintain adequacy in light of emergent business requirements or security threats.

­   Make sure that third parties, with whom company information is shared, are contractually required to adhere to the PCI DSS requirements and to acknowledge that they are responsible for the security of the company information which they process.

­   Assure that connections to third parties are managed per PCI requirements via the relationship procedures described in Management of Connected Entities (Appendix O)

­   Complete tasks as required by the Periodic Operational Security Procedures (Appendix N).

­   Disseminating Grant’s Septic Techs information security policies and acceptable use guidance, and other user policies to all relevant system users, including vendors, contractors and business partners.

­   Ensure background checks are carried out on potential employees who will have access to systems, networks, or data, for example background, pre-employment, criminal, or reference checks.

­   Work with the Information Security Team on disseminating security awareness information to system users.

­   Work with the Information Security Team to administer sanctions and disciplinary action relative to violations of Information Security Policy.

­   Notify Access Management personnel when any employee is terminated Maintain all Security Awareness and Acceptable Use (Appendix A) and Authorization Request Forms (Appendix B) in employee files.

 

2.3   Information Security Team

Successfully securing Grant’s Septic Techs information systems requires that the various individuals and groups consistently adhere to a shared vision for security. The Information Security Team works with system managers, administrators and users to develop security policies, standards and procedures to help protect the assets of Grant’s Septic Techs

 

The Information Security Team is dedicated to security planning, education and awareness. Specific responsibilities of the Information Security Team:

 

­   Create new information security policies and procedures when needs arise. Maintain and update existing information security policies and procedures. Review the policy on an annual basis and assist management with the approval process.

­   Act as a central coordinating department for implementation of the Information Security Policies.

­   Maintain and distribute incident response and escalation procedures.

­   Monitor and analyze security alerts and distribute information to appropriate information security, technical and business unit management personnel.

­   Review logs daily. Follow up on any exceptions identified.

­   Restrict and monitor access to sensitive areas. Ensure appropriate physical controls are in place where sensitive cardholder information is present.

­   Complete tasks as required by the Periodic Operational Security Procedures (Appendix L).

 

2.4   System Administrators

Grant’s Septic Techs System Administrators are the direct link between information security policies and the network, systems and data. System Administrator responsibilities include:

­   Applying Grant’s Septic Techs information security policies and procedures as applicable to all information assets.

­   Administering user account and authentication management.

­   Assisting the Information Security Team with monitoring and controlling all access to Grant’s Septic Techs data.

­   Maintain an up to date network diagram including wireless networks.

­   Restrict physical access to publicly accessible network jacks, wireless access points, gateways and hand held devices.

­   Completing tasks as required by the Periodic Operational Security Procedures (Appendix L).

 

2.5   Users

Each user of Grant’s Septic Techs computing and information resources must realize the fundamental importance of information resources and recognize their responsibility for the safekeeping of those resources. Users must guard against abuses that disrupt or threaten the viability of all systems. The following are specific responsibilities of all Grant’s Septic Techs information system users:

 

­   Understand what the consequences of their actions are with regard to computing security practices and act accordingly. Embrace the “Security is everyone’s responsibility” philosophy to assist Grant’s Septic Techs in meeting its business goals.

­   Maintain awareness of the contents of the information security policies.

­   Read and sign at least annually the Grant’s Septic Techs Security Awareness and Acceptable Use Policy (Appendix A)

­   Classify confidential and sensitive information that is received unclassified. Limit the distribution of this information accordingly.

 

2.6   Role Assignment

Grant’s Septic Techs uses role-based access control (RBAC) to restrict data resource access to unauthorized subjects. All personnel are assigned appropriate roles before they can exercise permissions and access data resources. Each role is connected to data resource access needs and a level of privilege as defined in Appendix Q2.

Roles are based on individual personnel’s job classification and function. All privileged user IDs are granted the least privilege necessary to perform job responsibilities. The security team is responsible for assigning roles with corresponding level of privilege and provides documented approval for each role in appendix Q1. 

 

3    IT CHANGE CONTROL POLICY

3.1   Policy Applicability

All proposed changes to Grant’s Septic Techs network devices, systems and application configurations must follow this policy.

 

3.2   Change Request Submittal

The responsible party that will be implementing the change must complete and submit a Change Request Form to the COO. A model form is shown in Appendix C illustrating the minimum data to be captured electronically or on hard copy. This form will not be reviewed without the following information completed, at a minimum:

 

­   Resources Affected by Change (customers) – If a change could impact the functionality of customers, internal or external, this item must be completed. This documentation must include changes to features, applications and procedures that will be different from the existing system. Included in this documentation are any upgrades that the customer needs to perform to the operating system or other required 3rd party software or hardware.

­   Back out Procedures – If the change does not go as intended a plan must be in place that describes the process of reverting the environment to its original configuration.

­   Test Plan - A set of planned tests must be developed to verify that the change accomplished what it was supposed to do, and does not adversely affect other system components or create a weakness in the security posture of the environment. This plan may be specific to each change.

 

Completion of the relevant details in the Grant’s Septic Techs issue tracking system is equivalent to completion of the change request form.

 

3.3   Change Request Approval

After all planning and documentation is complete all management and concerned parties must sign off on the Change Request Form. This can be achieved verbally in the weekly IT Development meeting.

 

3.4   Change Testing

Prior to introduction into the production network or systems all changes must first be tested on a QA or test network isolated from the production environment.

 

The documented test plan must be followed to ensure no adverse effects on the network, systems or applications. Any discrepancies should be documented and a new Change Request Form generated once all issues have been resolved. All relevant PCI DSS requirements are implemented on all new or changed systems and networks, and documentation updated as applicable.

 

3.5   Change Implementation

All changes must be implemented according to the documented change procedures that were tested successfully. Any discrepancies between expected results and actual results that impact the network, systems, applications, business requirements or support procedures must result in the immediate invocation of the documented back out procedures.

 

4    DATA CLASSIFICATION AND CONTROL POLICY

4.1   Policy Applicability

All data stored and accessed on Grant’s Septic Techs information systems, whether managed by employees or by a third party, must follow this policy. Policy exemptions will be permitted only if approved in advance and in writing by the COO.

 

4.2   Data Classification

4.2.1  Introduction

All data stored on Grant’s Septic Techs computing resources must be assigned a classification level by the information owner or creator. This level is used to determine which users are permitted to access the data.

 

4.2.2  Grant’s Septic Techs Internal Information Categories

Confidential - applies to the most sensitive business information which is intended strictly for use within Grant’s Septic Techs. Unauthorized disclosure could seriously and adversely impact the company, stockholders, business partners, and/or its customers.

Confidential information includes:

­   Passwords

­   Encryption keys

­   Cardholder information

­   Bank account information

­   Intellectual property

 

Sensitive - Applies to less sensitive business information, which is intended for use within Grant’s Septic Techs. Unauthorized disclosure could adversely impact the company, its stockholders, its business partners, and/or its customers.

Sensitive information includes:

­   Internal market research

­   Audit reports, etc.

 

Private - Applies to personal information, which is intended for use within Grant’s Septic Techs.

­   Unauthorized disclosure could adversely impact the company and/or its employees.

­   Examples of Private information include: policies and procedures, procedure metrics, human resources information, etc.

 

Public - Applies to all other information which does not clearly fit into any of the above three classifications. Unauthorized disclosure isn’t expected to seriously or adversely impact the company. Any release of this information must be authorized by the COO or CEO. Public information includes:

 

PCI Data – The class of credit card and transaction data identified for protection under the Payment Card Industry (PCI) Data Security Standard (DSS). Two types of data are defined: Cardholder Data which may be stored after transaction authorization and Sensitive Authentication Data which may not be stored after transaction authorization.

­   Card Holder Data – Applies to credit card data taken as payment for services. Data elements as specified in the PCI DSS version 3.2 are

o   Primary Account Number (PAN)

o   Card holder Name

o   Service Code

o   Expiration Date

­   Sensitive Authentication Data – Applies to credit card data required for authentication and processing of credit card transactions as specified in the PCI DSS version 3.2 are

o   Full Track Data

o   CAV2/CVC2/CVV2/CID

o   PIN/PIN Block

 

4.3   Data Access

All confidential or sensitive data must be protected via access controls to ensure that data is not improperly disclosed, modified, deleted or rendered unavailable. The access controls must track all access to such data and identify who and when the data was accessed (See Section 16 Logging Controls Policy for more details). All access to systems must be configured to deny-all but what information a particular user needs to access per their business role.

 

Access to systems or applications handling confidential, sensitive or private information must follow the data access request process. All requests require approval by the Information Security Team and a valid Authorization Request Form (Appendix B - A model form is shown illustrating the minimum data to be captured electronically or on hard copy. Access to data exceeding the employee’s authorized role must also follow the data access request process and must include documented limits around such access (e.g. access source, access time limits, etc.).

 

4.3.1  Data Access Request Process

The following generally describes the workflow used by Grant’s Septic Techs for requesting new access:

 

1. The user’s manager will request or grant (as appropriate) authorization for access to confidential data via the New Employee Card (Appendix P).
2. The user’s manager must approve the request for access based on the employee’s role, identify any additional access requirements and submit the request to a member of the Information Security Team for approval.
3. If the access requested requires privileges above the employee’s role a member of the Information Security Team will engage additional system owners or management to confirm.
4. The Information Security Team will forward the approved request to the System Administrator for account creation.
5. The System Administrator will create the user account(s) requested. Once the accounts have been created, the System Administrator must forward the request form to the COO for inclusion in the Users employee records and notify the Information Security Team that the request has been completed.

 

Requests for change of access must be submitted by the user’s manager utilizing the last version of the New Employee Card (Appendix M). Business units are expected to capture this data in such a form that a clear audit trail is available for review at all times on file and the workflow shall be the same as above. Direction regarding removal of an employee’s access shall follow the same workflow above. When an employee leaves the business a note will be added to their New Employee Card to confirm that access has been removed.

 

4.4   Physical Security

Hard copy materials and electronic media containing sensitive or confidential information must be protected by appropriate physical access controls.

­   Cameras must be used to monitor server closets and data centers where systems reside that store sensitive, confidential, and cardholder data. The data collected must be stored for at least 3 months unless otherwise restricted by law.

­   Appropriate facility controls must be used to limit and monitor physical access to systems that store confidential or sensitive data.

­   Visitor logs and physical audit trails of access to these systems must be collected and kept at least 3 months unless otherwise restricted by law.

­   Physical access must be restricted to publicly accessible network jacks, wireless access points and handheld devices.

4.5   User Authentication

4.5.1  Users

Each user’s access privileges shall be authorized according to business need. User access authority to computer resources shall be provided only when necessary to perform tasks related to Grant’s Septic Techs business.

 

The use of non-authenticated (e.g., no password) User IDs or User IDs not associated with a single identified user are prohibited. Shared or group user IDs are never permitted for user-level access. Every user must use a unique user account and a personal secret password for access to Grant’s Septic Techs information systems and networks. Systems and applications must authenticate using a password or token entry.

 

All users must acknowledge understanding of the Grant’s Septic Techs Information Security Policies by reading and signing the Grant’s Septic Techs Security Acknowledgment and Acceptable Use Policy (Appendix A) prior to being allowed to access Grant’s Septic Techs information systems and networks.

 

4.5.2  Systems

Each computer system shall have an automated or procedural access control process. The process requires the following:

 

­   Generic user IDs or passwords are disabled or removed.

­   User ID’s shall consist of at least 7 characters.

­   User ID’s will be unique for each user.

­   Authenticate every system account and application account with a password.

­   Require all passwords/passphrases to be at least 7 characters in length.

­   Require complex passwords, consisting of both numeric and alphabetic characters.

­   Require that new passwords cannot be the same as the four previously used passwords.

­   Lock out user ID after not more than six invalid logon attempts.

­   Require that once a user ID is locked out, it remains locked for at least 30 minutes or until the System Administrator enables the user ID.

­   Require system/session idle time out of 15 minutes.

­   Require passwords to be reset at least every ninety (90) days.

­   Remove/disable inactive user accounts at least every ninety (90) days.

The requirements above are for authenticating all system users.

 

4.6   Account and Access Management

4.6.1  Information Security Team Responsibilities

The Information Security Team will approve access authorization according to the role and responsibilities of information system users. Each request for access must contain written and/or electronic evidence of approval by the Information Security Team.

 

Information Security, in conjunction with business unit management, will determine the default access levels that will be granted per a user’s role (see section 2.6). The Information Security Team will perform a bi-annual audit of computer resource authorizations to confirm that access privileges are appropriate. The audit will consist of validating access rights for sample user populations.

The Information Security Team must collect additional approvals for all access that is not associated with a defined access role. Extension authorizations for contractor accounts must go through the Information Security Team to provide an audit trail. An Emergency ID will be established when access is needed to diagnose and/or correct a problem.

 

­   The request to create the Emergency ID must be made via the Information Security Team, which will notify the appropriate system administration team.

­   The requestor must inform the Information Security Team upon completion of the work so that the ID can be disabled.

­   The Information Security Team will ensure that the Emergency ID Request Form is completed as soon as practical (the completion of this form should NOT delay providing access). The completed form must be filed by the Information Security Team

 

4.6.2  System Administrator Responsibilities

Account creation requests must specify access either explicitly or via a “role” that has been mapped to the required access. New accounts created by mirroring existing user accounts must be audited against the explicit request or roles for appropriate access rights. If a user requests a password reset via phone, email, web or other non-face-to-face method, that user’s identity must be verified before the password is reset.

 

Access should be removed immediately upon notification that access is no longer required. Written procedures must be in place to ensure that access privileges of terminated or transferred users are revoked as soon as possible. Whenever possible users who are on leave-of-absence or extended disability should be suspended from the system.

 

User IDs shall be disabled after sixty (60) days of inactivity. After an additional thirty (30) days, disabled user IDs must be purged. These requirements may not apply to certain specialized accounts (e.g., NT Admin, root). In those instances, the System Administrator must provide a written waiver to the Information Security Team and document the compensating controls around access to the accounts.

 

All computer resources capable of displaying a custom sign-on or similar message must display the following message as part of the login process:

This system is for the use of authorized users only. Individuals using this computer system without authority, or in excess of their authority, are subject to having all of their activities on this system monitored and recorded by system personnel. In the course of monitoring individuals improperly using this system, or in the course of system maintenance, the activities of authorized users may also be monitored.

 

Anyone using this system expressly consents to such monitoring and is advised that if such monitoring reveals possible criminal activity, system personnel may provide the evidence of such monitoring to law enforcement officials.

 

­   System Administrators must enable audit logs to record user and administrative activities. Audit logs must be archived for a minimum of one year with (90) days available for on-line viewing.

­   Passwords set by System Administrators must be changed by the user immediately upon the user’s next login. System Administrators must set initial passwords that are unique and compliant with the password rules.

­   System Administrators must validate the identity of the user before performing a password reset. Business units must create local policies for positively validating user identities.

­   Contractor accounts must have Information Security Team approval and must automatically expire at the end of the contract date. Extensions must be requested through the Information Security Team. System Administrators must monitor these accounts carefully while they are in use.

­   Access must be immediately revoked for terminated users and for user access that is no longer required.

­   Vendor accounts used for remote maintenance must only be enabled during the time that access is needed.

­   Ensure that all systems and especially access to any databases containing cardholder information is authenticated (e.g., users, applications, administrators, etc.).

 

5    DATA RETENTION AND DISPOSAL POLICY

5.1   Policy Applicability

All data deemed sensitive or confidential by the Information Security Team, which is stored on Grant’s Septic Techs networks and systems must follow this policy. Exemptions from this policy will be permitted only if approved in advance and in writing by the Chief Technical Officer.

 

5.2   Retention Requirements

All sensitive and confidential data, regardless of storage location, will be retained only as long as required for legal, regulatory and business requirements. The specific retention length will be established by the Data Owner under advisement form the General Counsel.

 

5.2.1  Sample Data Types and Data Retention

 

Data Type	Data Retention Period
Confidential	10 years
Sensitive	7 years
Private	5 years
Public	3 years
PCI Data (Card Holder Data)	18 months
PCI Data (Sensitive Authentication Data)*	Never stored beyond authorization of payment transaction

*As a special case, cardholder data used for single transactions may be kept for up to 120 days. Cardholder data utilized for recurring transactions will be retained for the lifetime of the customer’s account with Grant’s Septic Techs. Once a customer’s account is disabled or terminated, all of the cardholder data for that merchant must be purged within 120 days of the termination using an approved destruction method. Sensitive Authentication Data, including track, CVV2, and PIN information, will be retained only until completion of the authorization of a transaction. Storage of cardholder authorization data post-authorization is forbidden. Business units will create local policies for retention of all other company information. All system and network audit logs must be retained for one year with 90 days minimum kept available for online use.

 

5.3   Disposal Requirements

All confidential or sensitive electronic data, when no longer needed for legal, regulatory or business requirements must be removed from Grant’s Septic Techs systems using an approved method documented in this policy. This requirement includes all data stored in systems, temporary files or contained on storage media.

 

5.4   Disposal Process

A programmatic (automatic) process will be executed on cardholder information systems nightly to remove all sensitive and confidential data that exceeds business retention requirements. Other applicable data stored in files and directories where the containing media will be reused must be deleted securely by a “wiping” utility approved by the Information Security Department.

 

Media containing confidential or sensitive data that should no longer be retained must be disposed of in a secure and safe manner as noted below:

 

­   Hard disks: sanitize (7-pass binary wipe), degauss or shred platter.

­   Floppy disks: disintegrate, incinerate, pulverize, shred or melt.

­   Tape media: degauss, shred, incinerate, pulverize or melt.

­   USB “thumb” drives, smart cards, and digital media: incinerate, pulverize or melt.

­   Optical disks (CDs and DVDs): destroy optical surface, incinerate, pulverize, shred or melt.

­   RSA Encryption Keys: keys must be revoked and the revoked key published to any online key repositories where the previously valid key is stored.

­   Before computer or communications equipment can be sent to a vendor for trade-in, servicing or disposal, all confidential or sensitive information must be destroyed or concealed according to the approved methods in this policy.

­   Removable computer storage media such as floppy, optical disks or magnetic tapes may not be donated to charity or otherwise recycled.

­   Outsourced destruction of media containing confidential or sensitive information must use a bonded Disposal Vendor that provides a “Certificate of Destruction”.

­   Storage containers used for materials that are to be destroyed must be secured. For example, “to-be-shredded” containers could have a lock preventing access to their content, or physically prevent access to the inside of the container by following the measures in section 6.2.

 

6    PAPER AND ELECTRONIC MEDIA POLICIES

6.1   Policy Applicability

All employees handling hardcopy or electronic media must follow this policy. Exemptions from this policy will be permitted only if approved in advance and in writing by the Chief Operating Officer.

 

6.2   Storage

6.2.1  Physical Security

Hard copy materials and electronic media containing sensitive or confidential information must be protected by appropriate physical access controls.

­   Camera must be used to monitor sensitive areas. The data collected must be stored for at least 3 months unless otherwise restricted by law.

­   Appropriate facility controls must be used to limit and monitor physical access to systems that store confidential or sensitive data.

­   Visitor logs and physical audit trails of access to these systems must be collected and kept at least 3 months unless otherwise restricted by law.

 

6.2.2  Hardcopy Media

Hard copy materials containing sensitive or confidential information (e.g., paper receipts, paper reports, faxes, etc.) are subject to the following storage guidelines:

 

­   At no time are printed reports containing confidential or sensitive information to be removed from any Grant’s Septic Techs secure office environment.

­   At no time is printed material containing confidential or sensitive information to be removed from any Grant’s Septic Techs data center or computer room without prior authorization from the Information Security Team.

­   Printed reports containing consumer confidential or sensitive data are to be physically retained, stored or archived only within secure Grant’s Septic Techs office environments, and only for the minimum time deemed necessary for their use.

­   All hardcopy material containing confidential or sensitive information should be clearly labeled as such.

­   All confidential or sensitive hardcopy media must be stored in a secure and locked container (e.g. locker, cabinet, desk, storage bin) which has been approved by the Information Security Team.

­   Confidential or sensitive hardcopy material is never to be stored in unlocked or insecure containers or open workspaces.

 

6.2.3  Electronic Media

Electronic media containing sensitive or confidential information (e.g., CD, DVD, floppy disk, hard disk, tape, etc.) is subject to the following storage guidelines:

 

­   Confidential or sensitive information must never be copied onto removable media without authorization from the Information Security Team.

­   At no time is electronic media containing confidential or sensitive information to be removed from any Grant’s Septic Techs secure office environment with the exception of computer system backups.

­   At no time is electronic media containing confidential or sensitive information to be removed from any Grant’s Septic Techs data center or computer room without prior authorization from the Information Security Team.

­   Electronic media containing consumer confidential or sensitive data are to be physically retained, stored or archived only within secure Grant’s Septic Techs office environments, and only for the minimum time deemed necessary for their use.

­   All electronic media containing confidential or sensitive information should be clearly labeled as such.

­   All removable, confidential or sensitive electronic media must be stored securely.

­   All media must be sent or delivered by a secured courier or other delivery methods that that can be accurately tracked and that have been approved by the Information Security Team.

 

6.3   Inventory

A Media Inventory Log (Appendix D A model form is shown illustrating the minimum data to be captured electronically or on hard copy). All stored electronic and hardcopy media containing confidential or sensitive information must be inventoried at least annually by the Information Security Team. At this time, the security controls on the storage mechanism will be checked. Upon completion of the inventory the log will be updated.

 

6.4   Destruction

All hardcopy shred bins must remain locked at all times (until shredding). Employees should make every effort to immediately cross-cut shred any printed material containing confidential or sensitive information.

 

Electronic media must be destroyed as outlined in the Data Retention and Disposal Policy.

 

7    FIREWALL AND ROUTER SECURITY ADMINISTRATION POLICY

7.1   Policy Applicability

All firewalls and routers on Grant’s Septic Techs networks, whether managed by employees or by third parties, must follow this policy. Exemptions from this policy will be permitted only if approved in advance and in writing by the Chief Technical Officer.

 

7.2   Device Management Responsibilities

Management of all Grant’s Septic Techs firewalls and routers shall be a combined effort of the System Administrator, the Network Operations Center and the Information Security Team. The following subsections detail the responsibilities for these groups.

 

7.2.1  System Administrator

­   Assure that changes to firewall hardware or software or security rules are approved by the Information Security Team and follow all change control policies and procedures.

­   Document all firewall security rule changes utilizing Appendix E, Permitted Network Services and Protocols (A model form is shown illustrating the minimum data to be captured electronically or on hard copy).

­   Following every change, review and update network diagrams to assure they accurately describe all connections to confidential or sensitive information and critical network protection mechanisms (e.g., firewalls, IDS/IPS, Anti-virus systems, access control systems, etc.).

­   Enable appropriate logging on all security systems and perform active daily monitoring of the logs that report security events.

­   Provide the Network Operations Center with read-only access to logs related to the critical systems health and performance.

­   Provide the Network Operations Center and Information Security Team with read-only access to security event logs.

­   Report network security incidents to the Information Security Team immediately upon discovery.

­   Coordinate an appropriate response with the Information Security Team to mitigate security events.

­   Ensure that router configuration files are secures and synchronized properly.

 

7.2.2  Network Operations Center

­   Monitor system and application specific alerts on critical systems (e.g., interface up/down, firewall daemon failing, system reboots, etc.)

­   Notify the appropriate parties in the event of a security system failure or security event.

 

7.2.3  Information Security Team

­   Assure that security rules applied to the firewalls are sufficient to protect Grant’s Septic Techs networks and corporate assets from external attacks and unauthorized access.

­   Assure that security rules applied to the firewalls are sufficient to prevent internal security events from leaving the Grant’s Septic Techs network.

­   Review all firewall and router security rule change requests for policy compliance prior to submission through the change management process.

­   Ensure that all protocols/services allowed through the firewalls are properly documented

­   Ensure risky protocols have undergone a risk assessment and have a current documented business need.

­   Actively monitor firewall security events to identify internal or external security incidents.

­   Coordinate an appropriate response with the System Administrator to mitigate security events.

7.3   Firewall and Router Configuration Changes

Because firewalls and routers support critical Grant’s Septic Techs information systems activities they are considered to be production systems.

All firewall and router changes must be approved by the Information Security Team and must be adequately tested following production standards as defined in the Change Control Policy. These changes include, but are not limited to:

 

­   Rule additions, deletions, and modifications.

­   Software or system modifications.

­   Software or system upgrades, patches, or hot-fixes.

 

7.4   Allowed Services

Every port, protocol and service that is not specifically permitted by this policy, with supporting documents issued by the Information Security Team, must be blocked by Grant’s Septic Techs firewalls. The list of currently approved ports, protocols and services, with justifications, is listed in Appendix E, Permitted Network Services and Protocols.

 

For guidance on services, protocols, or ports considered to be insecure, refer to industry standards and guidance (e.g., NIST, ENISA, OWASP, etc.).

 

7.5   Allowed Network Connection Paths and Configuration Requirements

All Internet-based inbound traffic is only permitted into a firewall segmented demilitarized zone (DMZ) network. In all cases, this traffic should be limited to only ports necessary for Grant’s Septic Techs’ business requirements. Perimeter routers should not be configured with a route to internal address space with the exception of the DMZ. Internal IP addresses must be hidden utilizing Network Address Translation (NAT) or Port Address Translation (PAT). Anti-spoofing technologies must be configured on perimeter devices, denying or rejecting all traffic with a:

 

­   Source IP address matching internally allocated or Grant’s Septic Techs owned address space.

­   Source IP address matching RFC 1918 address space.

­   Destination IP address matching RFC 1918 address space.

 

Outbound traffic from internal production systems must only be allowed to the Grant’s Septic Techs DMZ network. Additionally, this traffic should be restricted to only required protocols and services.

 

Databases must be located on an internal network, which is segmented from the Grant’s Septic Techs DMZ network. Inbound connections to internal production payment systems, and originating from Grant’s Septic Techs wireless networks, are not permitted. The use of a stateful packet inspection firewall must be utilized for Internet and wireless segmentation to only allow established connections into or out of each particular network segment. VLAN's with compliant ACL’s may be used for cardholder environment segmentation so long as the VLAN switch is compliant with PCI and hardened to prevent all currently identified switch exploits (e.g. ARP cache flood). If VLAN’s are used for segmenting all requirements for firewalls apply (e.g. deny all but business necessary traffic, change control, etc).

 

7.6   Configuration Review

At least every six months, the Information Security Team must thoroughly review each firewall rule set and record results of the review. The review must include the removal, when merited, of unused or unnecessary access paths. All proposed changes identified as a result of this review must go through the current change control process prior to implementation.

 

7.7   Personal Firewalls

All mobile and/or employee-owned computers with direct connectivity to the Internet (e.g., laptops used by employees) that are used to access the Grant’s Septic Techs network must have personal firewall software (or equivalent functionality) installed and activated. All such software must be configured to actively run and have a non-user alterable configuration as dictated by the Information Security Team.

 

8    SYSTEM CONFIGURATION POLICY

8.1   Policy Applicability

All servers and network devices on Grant’s Septic Techs networks, whether managed by employees or by third parties, must be built and deployed in accordance with this policy. Exemptions from this policy will be permitted only if approved in advance and in writing by the Chief Technical Officer.

 

8.2   System Build and Deployment

8.2.1  System Purpose

All computing systems should be designated for a single primary purpose where possible (e.g., web servers, database servers, and DNS should be implemented on separate servers). No multi-purpose systems may, under any circumstances, store, transmit, or process confidential or sensitive data unless required by vendor documentation (e.g., SAP, Peoplesoft, ipAngel, Cisco Pix with add-ons, etc).

 

8.2.2  System Configuration Standards

All systems, prior to deployment in the production environment must conform to the

System Configuration Standards (Appendix G- a model form is shown illustrating the minimum data to be captured electronically or on hard copy). A valid business justification and risk assessment must exist for all deviations from Grant’s Septic Techs published configuration standards. Deviations require written approval by the Information Security Team and must be noted on the System Configuration Record for the system.

 

8.2.3  System Configuration Records

A System Configuration Record (Appendix G - a model form is shown illustrating the minimum data to be captured electronically or on hard copy. This form must be updated with any future modifications to system configurations.

 

8.2.4  System Configuration Process

All new system deployments will follow the following high level procedure:

1. Install operating system.
2. Update all operating system software per vendor recommendations.
3. Configure operating system parameters and secure the system according to the system configuration build documentation described in Appendix F (A model form is shown illustrating the minimum data to be captured electronically or on hard copy. Install applications and software:
   1. Install system specific applications and software according to System Configuration Record (if this is a replacement for an existing system).
   2. Install applications and software necessary for the systems purpose.
   3. Configure Network Time Protocol (NTP).
4. Update all application software per vendor recommendations.
5. Configure application parameters according to build document (application hardening).
6. Enable logging per Logging Controls (Section 16).
7. For systems containing confidential or sensitive information deploy file integrity monitoring (FIM) software to alert personnel to unauthorized modification of critical system or content files. Configure FIM to perform critical file comparisons at least weekly.
8. Complete system specific System Configuration Record and maintain on file.

 

8.2.5  Standard Software

The following list must be considered standard installed software on all applicable systems. A valid business justification and risk assessment must exist for all deviations from Grant’s Septic Techs published configuration standards. Any such deviations require written approval by the Information Security Team, and noted on the System Configuration Record for the system (see below).

 

­   File servers, mail servers, and Windows-based systems

­   Anti-Virus software

­   Critical production systems

­   File Integrity software

­   Notebooks/Laptops

­   Personal Firewall software

­   VPN Client software

­   PGP Desktop with Whole Disk Encryption enabled

 

8.2.6  Network Time Protocol (NTP)

With the exception of the internal Grant’s Septic Techs NTP server(s), all Grant’s Septic Techs production systems must be configured to use one of the internal NTP servers to maintain time synchronization with other systems in the environment. The internal Grant’s Septic Techs NTP server(s) will be configured to request time updates from the Internet site time.nist.gov. Client systems able to retrieve time settings from the NTP server will be limited through Access Control Lists (ACL). Access to time data is restricted to only personnel with a business need to access the data. The NTP system will at all times be running the latest available version of the software. Changes to time settings are logged, monitored, and reviewed.

 

8.2.7  Credit Card Information Processing Application

All Grant’s Septic Techs applications, dealing with the processing or retrieval of cardholder information, must be configured in a manner which masks or truncates displayed PAN so that the first six and last four digits are the maximum number of digits to be displayed. If the application is designed for a specific purpose in which the full PAN must be displayed, approval must be given by the Information Security Team during the Requirements Phase as described in Section 13 Software Development Policy. In all cases displaying full or masked PANs must be limited to the fewest number of users possible and only personnel with a legitimate business need can see more than first six/last four digits of the PAN. 

 

8.2.8  Credit Card Storage Applications

All Grant’s Septic Techs applications, dealing with the storage of cardholder information, must be configured in a manner which does not retain prohibited cardholder data, such as full track data, card-validation codes, card not present values, pins or pin blocks. Storage devices on a network must be on an internal network segregated from the DMZ. All access to networked storage devices must have its authentication and communication encrypted. The PAN must be rendered unreadable through one of the following:

­   Strong one-way hash functions (hashed indexes) with salts

­   Truncation

­   Index tokens and pads (pads must be securely stored)

­   Strong cryptography with associated key management processes and procedures

 

8.2.9  Change Detection

Change-detection solutions such as file-integrity monitoring (FIM) software are installed on all critical systems that contain sensitive data. The Change-detection solution must monitor all user activity on critical systems. Reporting and alerting tools are enabled in order to automatically alert key personnel when changes to critical files have been made (ex. System executables, application executables, configuration files, content files, log and audit files). The software is configured to perform critical file comparisons at least weekly. Alarms from the Change-detection solution are continuously reviewed to determine if incident response actions need to be taken. If unauthorized changes have been done to systems containing confidential or sensitive information, the security team is immediately notified and the incident response measures in section 14 are performed.

 

8.3   Vulnerability Identification and System Updates

8.3.1  Vulnerability Identification

Members of the Information Security Team must be informed of information security issues and vulnerabilities applicable to Grant’s Septic Techs’ computing systems. When security issues are identified, the Information Security Team is responsible for notifying appropriate personnel, including system and network administrators and assigning a risk ranking (for example, as “high,” “medium,” or “low”) to newly discovered security vulnerabilities.

 

The primary method for identifying new threats as they arise will be through vendor and security specific Internet mailing lists. Although not complete, the following lists should be subscribed to as well as other vendor lists applicable to Grant’s Septic Techs specific software packages and systems:

­   CERT

­   NT BUGTRAQ

­   SANS

 

Grant’s Septic Techs System Configuration Standards (Appendix F - a model form is shown illustrating the minimum data to be captured electronically or on hard copy) must be updated to reflect measures required for protection from any newly discovered vulnerability.

 

8.3.2  Vulnerability Testing

The Information Security Team is responsible for conducting internal and external network vulnerability scans at least quarterly and after any significant change in the network (e.g., new system component installations, changes in network topology, firewall rule modifications, product upgrades). This process includes identifying any unauthorized wireless devices on the network. Internal vulnerability scans are performed by qualified personnel. Additional external vulnerability scans must be performed at least quarterly by a scan vendor qualified by the payment card industry.

 

Internal and external penetration tests at both the application and network layer must be performed annually or after any significant change in the network. Grant’s Septic Techs ‘s penetration tests are based on industry-accepted penetration testing approaches (for example, NIST SP800-115) and Includes coverage for the entire CDE perimeter and critical systems. Application layer penetration tests must cover all the vulnerabilities in section 13.2.2. Any segmentation controls and scope reduction controls must be tested to ensure that the CDE is isolated from the rest of the network. A penetration test always follows any changes to segmentation controls/methods isolating the CDE, otherwise it is done annually. A review and special consideration will be taken for vulnerabilities and threats experienced in the last 12 months. All potential vulnerabilities identified through vulnerability scans and penetration tests will be communicated to appropriate personnel within Grant’s Septic Techs for assessment and remediation. All high-risk vulnerabilities must be corrected utilizing the Change Control Grant’s Septic Techs Policy. Follow up scans must be performed to verify all “high-risk” vulnerabilities are resolved in accordance with the entity’s vulnerability ranking (per PCI DSS Requirement 6.1)

 

The Chief Technical Officer must coordinate an annual formal risk assessment process that identifies any existing or new threats and vulnerabilities to ensure Grant’s Septic Techs assets are adequately protected.

 

8.3.3  Security Patch Deployment

All security patches, hot-fixes and service packs identified by the Information Security

Team or system administrators must be applied to applicable systems within (30) days of vendor release. As with any change to the environment the change management process must be followed.

 

9    ANTI-VIRUS POLICY

9.1   Software Configuration

All applicable systems must be configured with Information Security Team approved anti-virus/anti-spyware/anti-adware software. The software must be configured to be actively running, perform periodic scans, log anti-virus events with routing to a central logging solution, and end users must not be able to configure or disable the software.

 

9.2   Signature Updates

All systems with anti-virus software must be configured to update virus signatures on at least a daily basis.

 

9.3   Software Logging

Anti-virus software must alert the Information Security Team in real-time of the detection of a virus. The Information Security Team will determine what steps to take based on the Incident Response Policy. Retention of Anti-Virus software logs will be in accordance with the Data Retention and Disposal Policy.

 

9.4   Systems not commonly affected by malware

All Grant’s Septic Techs’ systems that is not commonly targeted by malware (ex. mainframes, mid-range computers (such as AS/400) and similar systems) are annually evaluated to confirm if any anti-virus software implementation is necessary. This is done by monitoring vendor security notices and anti-virus news groups (for example) to learn about evolving malware that is relevant to Grant’s Septic Techs’ systems.

 

10 BACKUP POLICY

10.1 Location

The backup media for each system is relocated to a secure off-site storage area.

The off-site storage location must be visited annually by management or a member of the Information Security Team to confirm that it is physically secure and fireproof.

 

10.2 Transport

Offline storage media utilized for archival or back-up purposes must be handled and retained in a secured environment such that only Grant’s Septic Techs personnel and contracted storage facility personnel have access to the archival media. All media couriers and transport mechanisms must be certified by the Information Security Team.

 

Positive log-out and log-in of archive media will take place during all archive media transfers. All media that is transferred from one location to another should be logged as being transferred, by whom, where, and was it properly received, with signature from management. The Backup Media Transfer Log is located in Appendix H (A model form is shown illustrating the minimum data to be captured electronically or on hard copy. All media containing confidential or sensitive data must be classified and identifiable as such prior to transfer as detailed in the Data Classification and Control Policy.

 

10.3 Audit

All media used will be classified as confidential or sensitive and assigned a unique tracking number or similar feature that uniquely identifies the media. All media must be registered with the Information Security Team for tracking prior to use. Quarterly inventories of all stored media will take place. The Information Security Team will compare their list of in-use media with records at the storage facility using the Media Inventory Log (Appendix D A model form is shown illustrating the minimum data to be captured electronically or on hard copy.

 

10.4 Media Destruction

All media that is no longer needed or has reached end-of-life must be destroyed or rendered unreadable so that no data may be extracted. Information on acceptable destruction techniques is detailed in the Data Retention and Disposal policy.

 

11 ENCRYPTION POLICY

11.1 Policy Applicability

This policy documents encryption standards that must be applied to all applicable mechanisms and systems on Grant’s Septic Techs networks, whether managed by employees or by third parties. This policy also applies to the management of encryption keys, which may be shared with customers to exchange confidential information. Documentation provided to customers who have a need to exchange encryption keys with Grant’s Septic Techs must include these guidelines. Exemptions from this policy will be permitted only if approved in advance and in writing by the Chief Technical Officer.

 

11.2 Encryption Key Management

Keys must be generated, accessed, distributed and stored in a controlled and secured manner.

 

11.2.1   Key Access

Access to encryption key components will only be granted to those custodians specifically requiring access due to job function. All access may only be granted by the Chief Technical Officer and those requiring access must have so noted on their Authorization Request Form (Appendix B - A model form is shown illustrating the minimum data to be captured electronically or on hard copy. Additionally, these users must sign the Encryption Key Custodianship Form (Appendix I) A model form is shown illustrating the minimum data to be captured electronically or on hard copy. These forms will be held in the employee’s Human Resources file.

 

11.2.2    Split Knowledge and Dual Control

Two custodians authorized by the Information Security Team, are required to collaborate to perform any symmetric key action (such as key generation or loading the key). Additionally, no single custodian may know or have access to all pieces of a symmetric data encryption key. The separation of public and private encryption keys satisfies the concept of split knowledge and dual control.

 

11.2.3    Key Generation

­   Only strong encryption keys are to be used. Creation of encryption keys must be accomplished using a random or pseudo-random number generation algorithm.

 

Generating encryption keys must be accomplished by two custodians authorized by the Information Security Team. Each custodian will generate one clear text piece that will be used to create the encryption key. To prevent unauthorized substitution of keys physical and logical access to the key generating procedures and mechanisms must be secured.

 

11.2.4    Key Distribution

Only custodians authorized by the Information Security Team are allowed to retrieve key components from secure storage or distribute keys. Custodians must document all such actions in the Encryption Key Management Log (Appendix J) A model form is shown illustrating the minimum data to be captured electronically or on hard copy. The encryption keys must be placed in secure packaging prior to being returned to storage.

 

11.2.5    Key Storage

All secret and private keys used to encrypt/decrypt cardholder data must be stored encrypted and in the fewest possible locations. Secret and private keys must be stored in one (or more) of the following three ways:

1. Encrypted with a key-encrypting key that is at least as strong as the data-encrypting key, and that is stored separately from the data-encrypting key within applicable applications.
2. Within a secure cryptographic device such as a HSM.
3. As at least two full-length key components or key shares, in accordance with an industry-accepted method. 

Clear-text backups of encryption key components must be stored separately in tamper-evident packaging in a secure location.

 

11.2.6    Key Changes and Destruction

An encryption key change is the process of generating a new key, decrypting the current production data and re-encrypting the confidential data with the new key. All data encryption keys must be changed after reaching the end of their cryptoperiod or when circumstances dictate a change to maintain encryption or key integrity. The following dictates when a key change is required:

 

­   End of cryptoperiod: Keys must be changed after having reached the end of their respective cryptoperiod. Considerations for defining the cryptoperiod include the strength of the underlying algorithm, size or length of the key, risk of key compromise, sensitivity of the data being encrypted and industry best practices and guidelines (for example, NIST Special Publication 800-57).

­   Suspicious Activity: This change is driven by any activity related to the key process, which raises concern regarding the security of the existing key.

­   Resource Change: Keys must be changed if a resource with knowledge of the keys terminates employment or assumes a new job role that no longer requires access to an encryption process.

­   Technical Requirement: Keys must be changed if the key in place has become questionable due to a technical issue such as corruption or instability.

­   Encryption keys no longer in service are to be disposed of in accordance with the process outlined in the Data Retention and Disposal Policy.

 

 

11.3 Transmission over Un-Trusted Networks

Confidential and sensitive information must be encrypted during transmission over networks in which is it easy and common for the data to be intercepted, modified or diverted. Examples of strong encryption that is acceptable are:

⮚  Transport Layer Security (TLS version 1.2)

⮚  Internet Protocol Security (IPSec)

Examples of insecure protocols are FTP, Telnet, POP3, IMAP, and SNMP v1 and v2.

 

Where SSL and early TLS (version 1.0 and sometimes 1.1, depending on use and implementation) is used, Grant’s Septic Techs will need to comply with the additional requirements in Appendix A2 in the PCI DSS.

 

11.3.1   Email Transmission of Confidential Information

Confidential and sensitive information is never to be sent unencrypted through email. Employees, with a valid business justification, must be issued email encryption software by the Information Security Team.

 

11.3.2    Encryption of Wireless Networks

All wireless networks in use at Grant’s Septic Techs facilities must be protected through secure data encryption by industry best practice; minimum standards are WPA or WPA2. Wired Equivalent Privacy (WEP) is expressly prohibited. Under no circumstances should the encryption strength be configured to be less than 128 bits. Wireless encryption keys will be changed every ninety (90) days or whenever an administrator with knowledge of the keys is terminated.

 

11.4 Non-console and Remote Administrative Access

All non-console (including remote) administrative access is encrypted using strong cryptography as referred to in the PCI DSS, using industry-recognized protocols with appropriate key strengths and key management (clarified in section 11.3). Clear-text protocols such as HTTP and Telnet are not permitted to be used when encrypting non-console access. The system is configured to invoke strong cryptography before any administrator’s password is requested.

 

12 CRITICAL TECHNOLOGIES USAGE POLICY

12.1 Policy Applicability

All users of critical technologies deployed on Grant’s Septic Techs networks, whether employees or contractors, must follow this policy. Exemptions from this policy will be permitted only if approved in advance and in writing by the Chief Technical Officer. Currently, “critical technologies” include, but are not limited to, remote access and wireless technologies, laptops, tablets, removable electronic media, and Internet usage within the Grant’s Septic Techs computing environment. This policy will be modified in the future to include any new “critical technologies” used.

 

12.2 Approval

The Information Security Team must explicitly approve any use or deployment of critical technologies by job function role or on an individual basis. For general user application, this includes: dial-in modem access, personal modem deployment, and wireless network access. These approvals must be documented on the user’s Authorization Request Form (Appendix B - A model form is shown illustrating the minimum data to be captured electronically or on hard copy.

 

12.3 Authentication

User authentication mechanisms, where possible, must be integrated into the current Grant’s Septic Techs authentication systems. All device use must be authenticated at minimum with username and password or other authentication item (for example, token). Under no circumstances may the user authentication requirements be less strict than currently defined policies and procedures (e.g., complex passwords, password change interval, etc.).

All remote access (including general users, administrators, and vendors (for support or maintenance)) to the Grant’s Septic Techs network using these technologies must be authenticated via a strong multi-factor authentication scheme approved by the Information Security Team.

 

All non-console and remote administrative access to the Grant’s Septic Techs CDE must be authenticated via a strong multi-factor authentication scheme approved by the Information Security Team.

 

12.4 Device Inventory

All approved user devices (personal modems and wireless network interfaces) must be noted on the Critical Technologies Device Inventory (Appendix K A model form is shown illustrating the minimum data to be captured electronically or on hard copy. All approved users of these technologies must be noted on the Critical Technologies User List (Appendix L A model form is shown illustrating the minimum data to be captured electronically or on hard copy. Users that must be documented include:

 

­   Wireless network users

­   Personal modem possessors

­   Employees with dial-in access

­   Vendors with dial-in access

 

12.5 Device Identification

All personal modems and wireless access points must be labeled with the device owner, contact information and device purpose.

 

12.6 Acceptable Use

Acceptable use of Grant’s Septic Techs critical technologies are subject to the same guidelines and restrictions put forth in the Security Awareness and Acceptable Use Policy (Appendix A).

 

12.7 Permitted Locations

The Information Security Team must authorize the placement of any wireless access points and dial-in modems. Dial-in modems are typically limited to the data center. Wireless access points are normally placed in the ceiling plenum. The use of these devices must be logged according to the Critical Technologies Device Inventory (Appendix K A model form is shown illustrating the minimum data to be captured electronically or on hard copy) and Critical Technologies User List (Appendix L A model form is shown illustrating the minimum data to be captured electronically or on hard copy.

 

12.8 Approved Products

Only Information Security Team approved devices may be deployed into the Grant’s Septic Techs network. The use of these devices must be logged according to the Critical Technologies Device Inventory (Appendix K) and Critical Technologies User List (Appendix L A model form is shown illustrating the minimum data to be captured electronically or on hard copy)

 

12.9 Session Disconnect

All remote-access technologies must be configured to automatically disconnect sessions after thirty (30) minutes of inactivity.

 

12.10  Vendor Connections

Dial-in modems, systems and accounts used solely for the purpose of vendor maintenance and support must remain disconnected and/or disabled until required. Activating these remotes access paths requires approval from the Information Security Team or established problem management procedures and they must be disabled immediately after use.

 

12.11   Credit Card Data Access

If any credit card data is available through remote dial-in modem connections special precautions must be taken. The following are prohibited:

­   Storage of the company information onto local hard drives, floppy disks, and other media is prohibited.

­   Cut, paste, and print functions of remote PCs is prohibited for the duration of the connection.

 

13 SOFTWARE DEVELOPMENT POLICY

13.1 Development Environment

A test/development environment, separate from the production environment, must be used to test all new software. If the network has network connectivity with the production Grant’s Septic Techs network, access controls must be in place to enforce the separation.

 

Production cardholder data will not be used for testing and development purposes without being sanitized. Test personnel should make every effort to use mock data only for testing on non-production systems and software. If it is determined that production card holder data must be used in testing, the Security Council must review and approve the business justification, the testing window will have as short a duration as possible, all PCI controls must be enforced on the systems under test, and the Security Council must be notified of test results, and verification that production data has been scrubbed after close of testing window.

 

All test data, custom application accounts, usernames and passwords must be removed at the conclusion of testing, and in all cases before software becomes active. All code promotion to the production environment will be accomplished by the System Administrators. Under no circumstances will the Development Department have full time read/write access to production applications or data. Under emergency situations developers may assist in troubleshooting utilizing an Emergency ID described in section 2.3 Information Security Team Responsibilities.

 

13.2 Secure Software Development Procedures

13.2.1   Development Life-Cycle

Internal and 3rd party development of proprietary software must utilize industry recognized best practices for software development such as described at http://cwe.mitre.org/top25/ . Security checks and control measures must be considered throughout the development life-cycle.

 

The high level overview of the security measures taking place within each phase of the Grant’s Septic Techs development process are as follows:

 

­   Requirements Analysis – developers should determine whether application requirements are inherently insecure.

­   Design – application components must be planned in a manner consistent with data and network security.

­   Development – developers must consider all application vulnerabilities (i.e.: memory bound issues, privilege and access bypass, etc.).

­   QA Implementation - implementation must not compromise security controls already in place, or introduce new vulnerabilities.

­   QA Testing - in addition to functional and efficiency testing, all security features of the application must be tested.

­   Documentation – all application feature and implementation documentation must include direction on proper security configurations.

­   Production Implementation – implementation must not compromise security controls already in place, or introduce new vulnerabilities.

­   Production Testing – in addition to functional and efficiency testing, all security features of the application must be tested.

­   Maintenance – all future application maintenance should not compromise security controls already in place, or introduce new vulnerabilities.

­   Code changes – all future code changes must be reviewed by individuals other than the originating author. The reviewer must have adequate knowledge about code-review techniques and secure coding practices.

 

13.2.2    Web-based Applications

In addition to the Development Life-Cycle security measures that take place throughout the application development life-cycle, special care should be given to Grant’s Septic Techs’ applications that are web-based. All Grant’s Septic Techs’ developers will receive training on secure coding practices at least annually. All development must be done taking the OWASP guidelines into account, located at http://www.owasp.org. Specifically, the following vulnerabilities must be considered and checked for during the Code Review and Testing phases:

­   Unvalidated Input

­   Malicious Use of User IDs

­   Malicious Use of Account Credentials and Session Cookies

­   Broken authentication and session management

­   Cross-Site Request Forgery (CSRF)

­   Cross-Site Scripting

­   Buffer Overflows

­   SQL Injection and other Command Injection Flaws

­   Error Handling Flaws

­   Insecure cryptographic storage

­   Denial of Service

­   Insecure Configuration Management

­   Insecure Direct Object references

­   All “high risk” vulnerabilities identified in the vulnerability identification process (as defined in PCI DSS Requirement 6.1).

 

Annually, and whenever significant modifications have taken place, all web-based applications will be put through an application-specific penetration test. All custom code is to be reviewed by an organization that specializes in application security or an application layer firewall in front of web-facing applications.

 

13.2.3    Credit Card Informational and Processing Applications

All Grant’s Septic Techs proprietary or custom applications dealing with the processing or retrieval of cardholder information must be configured in a manner, which masks or truncates the displayed PAN. If the PAN is to be masked only the first 6 and last 4 digits may remain displayed. If the application is designed for a specific purpose in which the full PAN must be displayed, approval must be given by the Information Security Team. All the roles defined in Appendix Q2, that need access to displays of more than the first 6 and last 4 digits (includes full PAN), are listed in Appendix Q3 together with a business justification. All roles not specifically authorized in Appendix Q3 may only see masked PANs.

 

14 INCIDENT RESPONSE PLAN AND PROCEDURES

14.1 Incident Identification

Employees must be aware of their responsibilities in detecting security incidents to facilitate the incident response plan and procedures. All employees have the responsibility to assist in the incident response procedures within their particular areas of responsibility. Some examples of security incidents that an employee might recognize in their day-to-day activities include, but are not limited to:

­   Theft, damage, or unauthorized access (e.g., unauthorized logins, papers missing from their desk, broken locks, missing log files, alert from security guard, video evidence of a break-in or unscheduled/unauthorized physical entry)

­   Fraud – Inaccurate information within databases, logs, files or paper records

­   Abnormal system behavior (e.g., unscheduled system reboot, unexpected messages, abnormal errors in system log files or on terminals)

­   Security event notifications (e.g., file integrity alerts, intrusion detection alarms, physical security alarms such as fire alarms, environmental alarms, natural disaster alerts)

­   Addition of unauthorized devices (such as skimming devices, unauthorized wireless access points, unknown “free” USB-sticks)

 

All employees, regardless of job responsibilities, should be aware of the potential incident identifiers and who to notify in these situations. In all cases, every employee should report incidents per the instructions under 14.2 Incident Reporting unless they are assigned other activities within the incident response plan.

 

14.2 Reporting and Incident Declaration Procedures

The Information Security Team should be notified immediately of any suspected or real security incidents involving Grant’s Septic Techs computing assets, particularly any critical system. If it is unclear as to whether a situation should be considered a security incident, the Information Security Team should be contacted to evaluate the situation. With the exception of steps outlined below, it is imperative that any investigative or corrective action be taken only by Information Security Team personnel or under the oversight of Information Security Team personnel, to assure the integrity of the incident investigation and recovery process. When faced with a potential situation you should do the following:

 

­   If the incident involves a compromised computer system.

­   Do not alter the state of the computer system.

­   The computer system should remain on and all currently running computer programs left as is. Do not shutdown the computer or restart the computer.

­   Immediately disconnect the computer from the network by removing the network cable from the back of the computer.

­   Reporting the security incident.

­   Contact the Information Security Team to report any suspected or actual incidents.

­   No one should communicate with anyone outside of their supervisor(s) or the

­   Information Security Team about any details or generalities surrounding any suspected or actual incident. All communications with law enforcement or the public will be coordinated by the Information Security Team.

­   Document any information you know while waiting for the Information Security Team to respond to the incident. This must include date, time, and the nature of the incident, if known. Any information you can provide will aid in responding in an appropriate manner.

 

14.3 Incident Severity Classification

The Information Security Team will first attempt to determine if the security incident justifies a formal incident response.

 

In cases where a security incident does not require an incident response the situation will be forwarded to the appropriate area of IT to ensure that all technology support services required are rendered. The following descriptions should be used to determine what response the Information Security Department will take.

­   Level 1 - One instance of potentially unfriendly activity (e.g., finger, unauthorized telnet, port scan, corrected virus detection, unexpected performance peak, etc.).

­   Level 2 - One instance of a clear attempt to obtain unauthorized information or access (e.g., attempted download of secure password files, attempt to access restricted areas, single computer successful virus infection on a non-critical system, unauthorized vulnerability scan, etc.) or a second Level 1 attack.

­   Level 3 - Serious attempt or actual breach of security (e.g., multi-pronged attack, denial of service attempt, virus infection of a critical system or the network, successful buffer/stack overflow, successful unauthorized access to sensitive or critical data or systems, broken lock, stolen papers, etc.) or a second Level 2 attack.

­   Any Level 1 type incident occurring against systems storing sensitive or confidential data or originating from unauthorized internal systems is classified as a Level 2.

 

14.4 Incident Response

14.4.1   Typical Response

Responses can include or proceed through the following stages: identification, severity classification, containment, eradication, recovery and root cause analysis resulting in improvement of security controls. The following actions should be taken by the Information Security Department once an incident has been identified and classified.

 

14.4.1.1  Level 1

Contain and Monitor

1. If possible, record the user, IP address and domain of intruder.
2. Utilize approved technology controls to temporarily or permanently block the intruder’s access.
3. Maintain vigilance for future break-in attempts from this user or IP address.

 

14.4.1.2  Level 2

Contain, Monitor and Warn

1. Collect and protect information associated with the intrusion.
2. Utilize approved technology controls to temporarily or permanently block the intruder’s access.
3. Research the origin of the connection.
4. Contact ISP and ask for more information regarding the attempt and intruder.
5. Research potential risks related to intrusion method attempted and re-evaluate for higher classification and incident containment, eradication, and recovery as described for Level 3 incident classifications.
6. Upon identification, inform malicious user of our knowledge of their actions and warn of future recriminations if attempt is repeated. If an employee is the malicious user management should work with Human Resources to address the Acceptable Use violation appropriately.

 

14.4.1.3  Level 3

Contain, Eradicate, Recover and perform Root Cause Analysis

1. If the incident involved credit card systems, the Acquirer and applicable card associations must be notified. See section 14.4.2 for more details.
2. Contain the intrusion and decide what action to take. Consider unplugging the network cables, applying highly restrictive ACL’s, deactivating or isolating the switch port, deactivating the user ID, terminating the user’s session/change password etc.
3. Collect and protect information associated with the intrusion via offline methods. In the event that forensic investigation is required the Information Security Team will work with legal and management to identify appropriate forensic specialists.
4. Notify management of the situation and maintain notification of progress at each following step.
5. Eliminate the intruder's means of access and any related vulnerabilities.
6. Research the origin of the connection.
7. Contact ISP and ask for more information regarding attempt and intruder, reminding them of their responsibility to assist in this regard.
8. Research potential risks related to or damage caused by intrusion method used.

 

14.4.2   Credit Card Compromise – Special Response

For any incidents involving potential compromises of credit card information, the Information Security Team will use the following procedure:

1. Contain and limit the exposure. Conduct a thorough investigation of the suspected or confirmed loss or theft of account information within 24 hours of the compromise. To facilitate the investigation:
2. Log all actions taken (e.g., bound notebook, video camera, etc).
3. Utilize chain of custody techniques during all transfers of equipment and information related to the incident.
4. Do not access or alter compromised systems (e.g., do not log on or change passwords; do not log in as ROOT).
5. Do not turn off the compromised machine. Instead, isolate compromised systems from the network (e.g., unplug the network cable, deactivate switch port, isolate to contained environment e.g. isolated VLAN). Utilize Disaster Recovery / Business continuity procedures to recover business processes.
6. Preserve logs and electronic evidence.
7. If using a wireless network, change SSID on the AP and other machines that may be using this connection (with the exception of any systems believed to be compromised).
8. Be on high alert and monitor all cardholder information systems.
9. Alert all necessary parties. Be sure to notify:
10. Internal or External Incident Response or Forensics Team, if they are not already involved
11. Merchant bank
12. U.S. Secret Service (if PCI payment data is compromised)
13. Follow appropriate procedures for each card association which Grant’s Septic Techs utilizes for credit card services.

 

Visa

Provide the compromised Visa accounts to Visa Fraud Control Group within ten (10) business days. For assistance, contact (650) 432-2978. Account numbers must be securely sent to Visa as instructed by the Visa Fraud Control Group. It is critical that all potentially compromised accounts are provided. Visa will distribute the compromised Visa account numbers to issuers and ensure the confidentiality of entity and non-public information. See Visa’s “What to do if Compromised” documentation for additional activities that must be performed. That documentation can be found at https://usa.visa.com/dam/VCOM/download/merchants/cisp-what-to-do-if-compromised.pdf

 

MasterCard

Contact your merchant bank for specific details on what to do following a compromise. Details on the merchant bank (aka. the acquirer) can be found in the Merchant Manual at http://www.mastercard.com/us/wce/PDF/12999_MERC-Entire_Manual.pdf.

 

American Express

Contact your relationship manager or call the support line at 1-800-528-4800 for further guidance.

 

Discover Card

Contact your relationship manager or call the support line at 1-800-347-3083 for further guidance.

 

JCB

Contact your relationship manager or call the support line at 1-213-896-3718 for further guidance.

 

14.4.3   Root Cause Analysis and Lessons Learned

Not more than one week following the incident, members of the Information Security Team and all affected parties will meet to review the results of the investigation conducted under step 1, Section 14.4.3 of this document to determine the root cause of the compromise and evaluate the effectiveness of the Incident Response Plan. Review other security controls to determine their appropriateness for the current risks. Any identified areas in which the plan, policy or security control can be made more effective or efficient, must be updated accordingly.

 

14.5 Plan Testing and Training

At least once a year, a mock-incident will be initiated to facilitate testing of the current plan. The exact incident to be tested will be at the discretion of the Information Security Team. Once complete, a follow-up session, as detailed above, will be held. All Grant’s Septic Techs employees that could have an active role within incident response will be part of the test process. Training regarding incident response responsibilities should be performed regularly to ensure employee’s readiness for test and actual incidents.

 

14.6 Automated Security System Notifications

All automated intrusion detection systems within the Grant’s Septic Techs environment, including intrusion detection sensors and file integrity checking systems, will be configured to automatically notify the Information Security Team of any potential compromises or attacks. An engineer with the Information Security Team must be available on a 24/7 basis to initiate the incident response plan if warranted.

 

15 IDENTIFICATION AND PHYSICAL AUTHENTICATION POLICY

15.1 Employee and Visitor Requirements

All visitors are authorized before entering the office facility and provided with an ID badge that is clearly distinguishable from employee badges. Visitors to Grant’s Septic Techs’ shared office facility must, at all times, clearly display their ID badges. It is every employee’s responsibility to keep watch for unknown persons or employees not displaying badges. Employees must escort visitors at all times within the office facility. A visitor log is maintained to record visitor activity within the different facilities and this log is retained for at least 3 months. Visitors are asked to surrender ID badges before leaving the facility. Onsite personnel’s ID badges and access mechanisms to the facility will be revoked immediately upon termination.  

 

15.2 Other Authentication Mechanisms Usage

A case when an entity uses smart card authentication for physical access:

Grant’s Septic Techs uses smart cards to gain authorized physical access to the company’s premises. Each smart card is connected to individual accounts and never shared amongst multiple accounts. Employees must define their own four-digit string PIN-code when a smart card is issued to them the first time. The smart card does not gain access without the input of a PIN-code. Generic PIN-codes like 1111 and 1234 are not permitted. Some smart cards will gain employees access to all of the company’s premises, other smart cards cannot gain access to sensitive areas. This separation of access scope is determined by the employee’s role. All employees will have their smart cards either removed or disabled immediately following termination.

16 LOGGING CONTROLS POLICY

16.1 Events Logged

Automated audit trails must be implemented for all system components to reconstruct the following events:

­   All user access to company information.

­   All administrative actions utilizing userID’s with significant privileges above a general user (e.g. root, userID’s with Administrator group privilege, oracle, etc)

­   Access, initialization, stopping, or pausing of audit log files

­   Any user or administrator authentication attempts (both valid and invalid)

­   Creation of new accounts and elevation of privileges—and all changes, additions, or deletions to accounts with root or administrative privileges

­   Creation or deletion of system-level objects

­   Invalid logical access attempts

 

16.2 Event Log Structure

All system access event logs must contain at least the following information.

­   User Identification

­   Type of event

­   Date and time of event

­   Result of the event

­   Originating location of the event

­   The name of the affected data, system component or resource

 

16.3 Log Security

All event logs must be collected in a centralized location or media that is difficult to alter and protected from unauthorized access. The viewing of such logs is to occur on a need only basis. The logs will be further protected by a file integrity monitoring system that alerts the Information Security Team upon unauthorized access.

 

 

The following section 17 only applies to entities that use card-reading devices used in card-present transactions (that is, card swipe or dip) at the point of sale.

17 Protection of card-reading devices at point of sale

The company trains newly employed sales clerks to protect and inspect all card-reading devices. Sales clerks are asked to be on the lookout for suspicious behavior near point of sale terminals and report such behavior to management that will in turn contact the information security team. Inspections are made on a monthly basis or after any report of suspicious behavior.

 

17.1 Training of Sales Clerks

Newly hired sales clerks are trained by senior sales clerks during the first 5 days of hire. The training contains the following:

⮚  Be on the look-out for any suspicious behavior around card-reading devices. Suspicious behavior includes, but not limited to, unknown persons trying to open, attach devices or unplug card-reading devices.

⮚  Report any suspicious behavior to management, that will in turn report to the security team.

⮚  Verify the identity of any third-party persons claiming to be repair or maintenance personnel, prior to granting them access to modify or troubleshoot devices. The verification includes asking the person for job credentials and asking management for any scheduled maintenance. Calling the POS company is necessary if the two former actions did not provide adequate result.

⮚  How to inspect card reading devices, which is defined in Section 17.2.

⮚  Not to install, replace or return devices without verification from the security team.

 

17.2 Periodic Inspections of Card-Reading Devices

Card-reading devices should be periodically inspected by sales clerks once every 30 days or immediately after any report of suspicious behavior (The frequency of inspections will depend on factors such as location of the devices and whether the devices are attended or unattended). The inspection contains the following steps:

⮚  The card-reading devices are compared to the list of point of sale devices in Appendix S, comparing the serial number of each device to make sure the device has not been stolen or substituted.

⮚  The card-reading devices are also checked to see if the outer casing has been opened by checking if any of the stickers on the device openings have been broken.

⮚  The devices are inspected to see if any attached components are present, like skimming devices.

 

18 Risk-assessment process

A risk-assessment is performed annually or after any significant changes to the organizations environment. The Chief Technical Officer is responsible for the risk-assessment process and uses the ISO 27005 risk assessment methodology (other examples of risk-assessment methodologies include but are not limited to OCTAVE and NIST SP 800-30).

 

 

The following section 19 only applies to entities that are categorized as service providers. See PCI Security Standards Council (SSC) definition of a service provider and if it relates to the entity at (www.pcisecuritystandards.org).

19 Additional PCI DSS service provider responsibilities

19.1 Written Acknowledgment of Responsibility from the Entity

The Grant’s Septic Techs (being a service provider) must acknowledge in writing that they are responsible for the security of cardholder data that they store, process or transmits on behalf of the customer, or to the extent that they could impact the security of the customer’s CDE.

 

19.2 Remote Access to Customers

Remote access to customer premises is authenticated using unique passwords for each customer. The passwords follow the same standard as defined in section 4.5.

 

 

The following section 20 applies only to entities who make use of external service providers.

20 Service Provider management

20.1 Responsibility Allocation and Compliance Monitoring

Grant’s Septic Techs withholds documented information about which requirements are management by the entity and which requirements are managed by external service providers. (24 Solutions provides a matrix for this purpose). The entity must also monitor the PCI DSS compliance status of the service provider at least annually and will document the current status in Appendix T – List of Service Providers. 

 

20.2   Written Acknowledgment of Responsibility from the Service Provider

A written acknowledgement must exist between the entity and the service provider that states the responsibilities of the service provider. The service provider is responsible for all the requirements defined in the section above, as well as the security of cardholder data the service providers possess or otherwise store, process or transmit on behalf of the entity, or to the extent that they could impact the security of the entities’ CDE.

 

20.3   Service Provider and Entity Engagement and Compliance Monitoring

The entity must establish a process prior to engaging with a service provider and must perform due diligence in this process, meaning that the entity has exercised an appropriate level of caution or investigation prior to acting or making the decision to engage with a service provider. The process should first include a risk analysis from the Chief Technical Officer. Examples of considerations that the entity should investigate include the provider’s reporting practices, breach-notification and incident response procedures, details of how PCI DSS responsibilities are assigned between each party, how the provider validates their PCI DSS compliance and what evidence they provide, etc.

 

21 Inventory of system components

Grant’s Septic Techs maintains an inventory of system components in scope for PCI DSS. Any network component, server, or application included in or connected to the cardholder data environment is listed in Appendix R.

For more information, the Appendix, or any questions you may have reach out to us at: [email protected]