Solved

Need help in system hardening/configuration for Windows OS for compliance (PCI DSS).

Posted on 2010-09-23
5
1,954 Views
Last Modified: 2012-05-10

PCI DSS requirement is...have configuration standards that...   must be consistent with industry-accepted hardening standards as defined, for example, by  (SANS), (NIST), and (CIS)


(SMB, we haven't had to do this for any other regulatory compliance before.)

Types of tools I have been looking at are products that can scan a system and show what configuration changes need to made, (some can remedy some of the settings so the system is compliant).

So far I found NetIQ, Ionix (VMware) SCM, and Tripwire.

How are you going about or gone about solving this, making configuration changes that meet your compliance requirements, what products tools are you using if any?





0
Comment
Question by:UDF
5 Comments
 
LVL 15

Assisted Solution

by:mcp_jon
mcp_jon earned 100 total points
ID: 33754842
Have you considered SCOM ?

Kind regards.
0
 
LVL 38

Accepted Solution

by:
Rich Rumble earned 150 total points
ID: 33754964
OSSEC. Requires a linux central server, but has agents for all the other OS's including windows. Hardening can be done in a variety of ways, I recommend you start here:
http://www.nsa.gov/ia/guidance/security_configuration_guides/operating_systems.shtml (scroll down for various windows hardening guides and tips)
-rich
0
 
LVL 61

Assisted Solution

by:gheist
gheist earned 25 total points
ID: 33768540
1) Download PCI DSS pdf
2) Check if you formally have firewall, SSL secured admin interfaces, encrypted database and no extra services running
3) Make sure you have latest OS patches (track record of a critical/security patches installed)

It is more like baseline/checklist, very practical to have a staging server to approve production changes (easy with vmware)
0
 

Author Closing Comment

by:UDF
ID: 33831526
I just wanted to see how others were approaching the problem.  At this point I think anyone who is going to comment has.

OSSEC looks like option to check out, not sure if how complicated is is to setup, but I will play around with it.  Looks like it also may help in other requirements

I did look at SCOM at one point, but I didn't see anything allowing for PCI DSS or SOX type configurations you could load. It look like it was MS security guidelines that you could load similar to using the security baseline analyzer, but centralized.

Gheist.  Not sure, but from our auditors that we have talked to, there is a bit more to it  for the system configuration requirement.  Since it based off of NIST and CIST guidelines there are several changes that need to be made to say a Windows 2003 server.  I wish this was case for us, PCI is really up to the QSA or your level (I would hold onto the one you have). You did answer with your approach.

Thanks
0
 
LVL 61

Expert Comment

by:gheist
ID: 33831625
Requirements are quite blurry....
Formally they are satisfied easily, but there is a lot of room for interpretation after.
0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Join & Write a Comment

New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now