PCI DSS Quick Reference - Revision history

Ledhed at 21:11, 27 August 2014

2014-08-27T21:11:57Z

Ledhed at 21:08, 27 August 2014

2014-08-27T21:08:31Z

Ledhed at 22:30, 13 March 2014

2014-03-13T22:30:33Z

Ledhed at 22:29, 13 March 2014

2014-03-13T22:29:59Z

Ledhed at 22:29, 13 March 2014

2014-03-13T22:29:34Z

Ledhed at 22:28, 13 March 2014

2014-03-13T22:28:54Z

Ledhed at 22:28, 13 March 2014

2014-03-13T22:28:26Z

Ledhed: Created page with "== Overview == This article acts as a quick reference to PCI DSS requirements and how they relate to Information Technology.
The below PCI DSS sections refer to PCI DSS ve..."

2014-03-13T21:04:05Z

Created page with "== Overview == This article acts as a quick reference to PCI DSS requirements and how they relate to Information Technology. The below PCI DSS sections refer to PCI DSS ve..."

New page

== Overview ==
This article acts as a quick reference to PCI DSS requirements and how they relate to Information Technology. 
The below PCI DSS sections refer to PCI DSS version 3.0 dated November 2013.

== 8.1 User Accounts ==
8.1.1 - Assign all users a unique ID. 
8.1.2 - Control: addition, deletion, modification of unique ID. 
8.1.3 - Immediately revoke access for any terminated users. 
8.1.4 - Remove/disable inactive user accounts at least every 90 days. 
8.1.5 - Manage vendor ID's, monitor when in use, enabled only when neeeded. 
8.1.6 - Lockout user accounts after no more than 6 failed attempts. 
8.1.7 - Lockout duration is a minimum of 30 min. 
8.1.8 - Require user to re-authenticate after 15 minutes of inactivity. 

== 8.2 Passwords/Authentication ==
8.2.0 - Require at least one of the following authentication mechanisms: Something you know (Password), Something you have (Token), Something you are (Biometrics). 
8.2.1 - Encrypt all authentication in transmission and storage. 
8.2.2 - Verify user identity before making modifications (such as password resets). 
8.2.3 - Password must meed complexity requirements (minimums, Password Length: 7, Characters: Alphabetic AND Numeric). 
8.2.4 - Passwords expire every 90 days. 
8.2.5 - Password History, Do not allow a user to reuse one of their previous 4 passwords. 

== 8.3 Remove Access ==
8.3.0 - Require Two-Factor authentication for remote network access. Require at least 2 authentication mechanisms listed in section [[#Action Points|8.2 Passwords/Authentication]] 

== 8.4 Documentation ==
8.4.0 - Communicate authentication procedures to all users. 

== 8.5 Generic Accounts ==

== 8.6 Access Control ==

== 8.7 Databases ==

== 8.8 Documentation ==

== Reference ==
https://www.pcisecuritystandards.org

https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pdf

[[Category:PCI_DSS]]

@@ Line 25: / Line 25: @@
 == 8.3 Remove Access ==
-.3.0 - Require Two-Factor authentication for remote network access. Require at least 2 authentication mechanisms listed in section [[PCI DSS 8.2 Group Policy]]<br>
+.3.0 - Require Two-Factor authentication for remote network access. Require at least 2 authentication mechanisms listed in section [[PCI DSS Quick Reference#8.2 Passwords/Authentication|8.2 Passwords/Authentication]]<br>
 == 8.4 Documentation ==

@@ Line 25: / Line 25: @@
 == 8.3 Remove Access ==
-.3.0 - Require Two-Factor authentication for remote network access. Require at least 2 authentication mechanisms listed in section [[#Action Points|8.2 Passwords/Authentication]]<br>
+.3.0 - Require Two-Factor authentication for remote network access. Require at least 2 authentication mechanisms listed in section [[PCI DSS 8.2 Group Policy]]<br>
 == 8.4 Documentation ==

@@ Line 5: / Line 5: @@
 == 8.1 User Accounts ==
-For details on how to implement these requirements in a Microsoft Active Directory environment see: [[PCI_DSS 8.1 Group Policy]]<br>
+For details on how to implement these requirements in a Microsoft Active Directory environment see: [[PCI DSS 8.1 Group Policy]]<br>
 .1.1 - Assign all users a unique ID.<br>

@@ Line 12: / Line 12: @@
 .1.4 - Remove/disable inactive user accounts at least every 90 days.<br>
 .1.5 - Manage vendor ID's, monitor when in use, enabled only when neeeded.<br>
-''8.1.6 - Lockout user accounts after no more than 6 failed attempts.''<br>
+.1.6 - Lockout user accounts after no more than 6 failed attempts. *<br>
-''8.1.7 - Lockout duration is a minimum of 30 min.''<br>
+.1.7 - Lockout duration is a minimum of 30 min. *<br>
 .1.8 - Require user to re-authenticate after 15 minutes of inactivity.<br>

@@ Line 12: / Line 12: @@
 .1.4 - Remove/disable inactive user accounts at least every 90 days.<br>
 .1.5 - Manage vendor ID's, monitor when in use, enabled only when neeeded.<br>
-.1.6 - Lockout user accounts after no more than 6 failed attempts.<br>
+''8.1.6 - Lockout user accounts after no more than 6 failed attempts.''<br>
-.1.7 - Lockout duration is a minimum of 30 min.<br>
+''8.1.7 - Lockout duration is a minimum of 30 min.''<br>
 .1.8 - Require user to re-authenticate after 15 minutes of inactivity.<br>

PCI DSS Quick Reference - Revision history

Ledhed at 21:11, 27 August 2014

Ledhed at 21:08, 27 August 2014

Ledhed at 22:30, 13 March 2014

Ledhed at 22:29, 13 March 2014

Ledhed at 22:29, 13 March 2014

Ledhed at 22:28, 13 March 2014

Ledhed at 22:28, 13 March 2014

Ledhed: Created page with "== Overview == This article acts as a quick reference to PCI DSS requirements and how they relate to Information Technology. The below PCI DSS sections refer to PCI DSS ve..."

Ledhed: Created page with "== Overview == This article acts as a quick reference to PCI DSS requirements and how they relate to Information Technology.
The below PCI DSS sections refer to PCI DSS ve..."