תקן pci למומחי בסיסי נתונים-PCI DSS for Database Professionals

The Payment Card Industry Data Security Standard (PCI DSS) sets forththe security requirements for organizations that store, process and/ortransmit credit or debit card transactions.These requirements stemfrom a series of significant security incidents affecting databases of consumer credit information over the past decade.

What does PCI DSS mean to you as a database professional?If you review the PCI DSS standard,you’ll find seventeen pages packed with detailed requirements forsecuring cardholder information.If your organization processestransactions, it’s a good idea to review the entire standard and ensureyou’re meeting all of those requirements.That said, I’ll highlight afew salient points that pertain directly to database professionals.

• Place the database in an internal network zone, segregated from the DMZ.PCI requires that you place your database server on your internalnetwork and that you deny attempts to directly access the database fromuntrusted networks.Additionally, you must use private IP addressesfor the database server.
• Change vendor-supplied default passwords. You must ensurethat your database uses strong passwords for all user accounts and thatyou change the passwords for any default accounts supplied by yourdatabase vendor.
• Encrypt all non-console administrative access.You’rerequired to use encryption technology (e.g. VPN, SSL, ssh) to encryptany administrative connections to the database.This reduces the riskof an eavesdropper obtaining administrative credentials to the database.
• Keep cardholder data storage to a minimum.You should neverstore cardholder data that you no longer need.If you don’t need tostore it, don’t.If you’re finished with it, purge it from yourdatabase.In all cases, you may never store data from the card’s magnetic stripe or the three digit security code on the back of the card.
• Encrypt card numbers that you do store.If your businessrequirements dictate that you store card numbers, you must encrypt themusing a strong encryption algorithm.Furthermore, you must use soundkey management practices to limit access to the encryption keys.
• Ensure that you patch your database regularly. A recent study revealed that many DBAs seldom, if ever apply security patches.PCI requires that you apply security updates within one month of their release.
• Develop web applications securely.Granted, DBAs seldom havecontrol over the code written by developers, but it's important that weact as security evangelists, educating developers about the risk posedby database attacks such as SQL injection.
• Practice secure user management.In addition to the controlsyou'd expect, such as requiring individual user accounts with strongpasswords, you also need tomanage database roles and rights in a fashion that limits access to those with a need to know.
• Log everything.PCI requires that you record the name of theuser, type of event, timestamp, and other technical information aboutany individual user access to cardholder data, administrator actions andfailed authentication attempts.

This article provides only a high-level overview of the PCI DSSrequirements most applicable to database administrators.I encourageyou to review the entire standard and discuss it with other IT and business professionals in your organization.