PCI Compliance & Centmin Mod

Vinayak · Jun 1, 2017

Was wondering whether Centmin Mod is PCI DSS compliant or will need extra patching and steps to pass the PCI DSS compliance scan.

eva2000 · Jun 1, 2017

Pretty sure Centmin Mod isn't PCI DSS compliant as I don't know the *exact* specifics for their requirements off the top of my head.

Payment Card Industry Data Security Standard - Wikipedia

The PCI Data Security Standard specifies twelve requirements for compliance, organized into six logically related groups called "control objectives".

Each version of PCI DSS has divided these twelve requirements into a number of sub-requirements differently, but the twelve high-level requirements have not changed since the inception of the standard.
Click to expand...

eva2000 · Jun 1, 2017

https://www.pcicomplianceguide.org/pci-faqs-2/

Q1: What is PCI?
A: The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to ensure that ALL companies that accept, process, store or transmit credit card information maintain a secure environment.

The Payment Card Industry Security Standards Council (PCI SSC) was launched on September 7, 2006 to manage the ongoing evolution of the Payment Card Industry (PCI) security standards with a focus on improving payment account security throughout the transaction process. The PCI DSS is administered and managed by the PCI SSC (www.pcisecuritystandards.org), an independent body that was created by the major payment card brands (Visa, MasterCard, American Express, Discover and JCB.). It is important to note that the payment brands and acquirers are responsible for enforcing compliance, not the PCI council. A copy of the PCI DSS is available here.
Click to expand...

Q2: To whom does the PCI DSS apply?
A: The PCI DSS applies to ANY organization, regardless of size or number of transactions, that accepts, transmits or stores any cardholder data.
Click to expand...

eva2000 · Jun 1, 2017

and https://www.pcicomplianceguide.org/pci-myths/

hmm eye opener

Myth: I’m a small merchant who only takes a handful of cards, so I don’t need PCI.
Fact: This is a common misunderstanding with the standard, that small merchants handling only one or a few credit cards a year are exempt from compliance. If you are a merchant and are set up to take credit cards by any mechanism – then you need to be complaint.
Click to expand...

Myth: Outsourcing card processing makes us compliant.
Fact: Outsourcing simplifies payment card processing but does not provide automatic compliance. Don’t forget to address policies and procedures for cardholder transactions and data processing. Your business must protect cardholder data when you receive it, and process charge backs and refunds. You must also ensure that providers’ applications and card payment terminals comply with respective PCI standards and do not store sensitive cardholder data. You should request a certificate of compliance annually from providers.
Click to expand...

eva2000 · Jun 1, 2017

PCI DSS: Make PCI Compliance a Priority- PayPal Australia

When you need to be PCI compliant.
If you manage transactions yourself and touch, store or transmit credit card details, you’ll need to obtain PCI compliance certification for your business. For many of our products, we handle this for you, but if you have one of our more customisable solutions, like Payflow Pro, you’re taking card information over the phone or by fax for Virtual Terminal payments, or you accept non-PayPal payments, you’ll need to be compliant. For help you can contact a certified security expert like Panoptic or Trustwave.
Click to expand...

eva2000 · Jun 1, 2017

12 Step PCI DSS Requirements Checklist

The 12 requirements outlined in the PCI DSS are considered data security best practice by all major credit card companies for processing sensitive payment information and are categorized into six sections.

Businesses are considered compliant with PCI DSS standards by implementing tight controls surrounding the storage, transmission and processing of cardholder data, and maintaining adequate monitoring, testing and reporting of yearly results.

12 Step PCI DSS Requirements Checklist
Goal: Build and Maintain a Secure Network and Systems

Install and maintain a firewall configuration to protect cardholder data.

Do not use vendor-supplied defaults for system passwords and other security parameters.

Goal: Protect Cardholder Data

Protect stored cardholder data.

Encrypt transmission of cardholder data across open, public networks.

Goal: Maintain a Vulnerability Management Program

Protect all systems against malware and regularly update anti-virus software or programs.

Develop and maintain secure systems and applications.

Goal: Implement Strong Access Control Measures

Restrict access to cardholder data by business justification (i.e., "need to know").

Identify and authenticate access to system components.

Restrict physical access to cardholder data.

Goal: Regularly Monitor and Test Networks

Track and monitor all access to network resources and cardholder data.

Regularly test security systems and processes.

Goal: Maintain an Information Security Policy

Maintain a policy that addresses information security for all personnel.

Click to expand...

eva2000 · Jun 1, 2017

For Centmin Mod

Firewall = CSF Firewall

Might need fail2ban + CSF https://community.centminmod.com/threads/fail2ban-for-centmin-mod-csf-firewall-cloudflare-api.11687/

Maldet malware detect + ClamAV via addons/maldet.sh https://community.centminmod.com/threads/maldet-linux-malware-detect-addon-discussion.846/

tools/auditd.sh https://community.centminmod.com/threads/tools-auditd-sh-discussion-thread-for-123-09beta01.9089/

Though installing isn't really enough, you need to understand CSF Firewall, fail2ban and maldet and auditd usage and logs etc.

12 Step PCI DSS Requirements Checklist

Examples of how to implement PCI DSS into your regular activities include:
1. Constant monitoring of all security controls to ensure they are operating effectively and as intended.

2. Make sure to identify and respond to all security control failures in a timely manner. The process around these failures should include:

Restoring the security control

Identifying the cause of failure

Identifying and remediating any security issues occurring during the control failure

Implementing mitigation to prevent the failure from recurring

Resuming to monitor the security control to verify the control is operating effectively

3. Determine if any changes have been made prior to completing the change. Ensure you perform the following tasks:

Identify any impact to PCI DSS scope that occurs as a result of a new or modified system introduced into your PCI DSS environment.

Identify PCI DSS requirements that are in scope for systems and networks that are affected by the change.

Update your PCI DSS scope and implement necessary security controls.

4. Review changes to the organizational structure resulting in a formal review of the impact to PCI DSS scope and requirements.

This can be done at the individual and group role levels to ensure that current access is commensurate with the employee's responsibilities and his or her job role.

5. Performing regular reviews and report findings to confirm that PCI DSS requirements are implemented and secure processes are in place as necessary.

These reviews should cover all company locations and include reviewing system components to verify that PCI DSS requirements have been adhered to and are implemented. The frequency of these reviews is determined by the business as appropriate for the size and complexity of their environment.

These reviews can be used to verify that appropriate evidence is being maintained for PCI DSS compliance efforts.

6. Document and review hardware and software technologies regularly.

You must verify that all equipment is supported by the vendor and can meet your client's PCI DSS security requirements. Take action if the equipment is not supported or compliance requirements are not met.

The cost of neglecting software currency is alarming. In 2015, 44% of breaches were the direct result of having two- to four-year-old unpatched software. Imagine how many of these situations could have been avoided by simply observing software currency.

It is important to assess. monitor, remediate and report on your PCI DSS security controls on a regular basis!
Click to expand...

eva2000 · Jun 1, 2017

no idea of validity of the PCI DSS scan at http://checkpcidss.com/centminmod.com/

PCI Scanning FAQs | 1 Stop PCI Scan

there's both internal and external scanning If I Get A Passing PCI Scan, Does That Mean I Am Compliant? | 1 Stop PCI Scan + penetration/intrusion testing

If I Get A Passing PCI Scan, Does That Mean I Am Compliant?
Answer: The PCI Data Security Standard uses a “defense-in-depth” approach to establishing PCI compliance. PCI compliance involves more than just quarterly external PCI scanning.

Listed here are some of the other required tasks that 1 Stop PCI Scan is qualified to perform.

Internal Vulnerability Scans – From item 11.2 of the PCI DSS: “Run internal and external network vulnerability scans at least quarterly and after any significant change in the network (such as new system component installations, changes in network topology, firewall rule modifications, product upgrades).” Quarterly internal vulnerability scans are required in addition to quarterly external PCI scanning. More Information >

Yearly Penetration Testing – From item 11.3 of the PCI DSS: “11.3 Perform external and internal penetration testing at least once a year and after any significant infrastructure or application upgrade or modification (such as an operating system upgrade, a sub-network added to the environment, or a web server added to the environment).” Penetration testing involves simulating a real world attack on a customer’s network to determine what a malicious user would be able to accomplish. More Information >

Click to expand...

Vinayak · Jun 1, 2017

Love your passion & dedication towards your work.

ljseals · Jun 2, 2017

While I have not totally implemented it another provider has used https://github.com/wazuh/wazuh which is the (OSSEC) + ELK 5.3.0 STACK for PCI DSS compliance. It is an open source host and endpoint security....

As I said I have not researched it yet as I am not at the point in my implementation but taking the script. Magento-Automated-Server-Configuration-from-MagenX/MASC-M-7-v2.sh at master · magenx/Magento-Automated-Server-Configuration-from-MagenX · GitHub This is there setup just taken the scripted part for there setup.

Code:

###################################################################################
#                          INSTALLING OSSEC ELK STACK                             #
###################################################################################
"ossec")
WHITETXT "============================================================================="
echo
GREENTXT "INSTALLATION OF WAZUH 2.0 (OSSEC) + ELK 5.3.0 STACK:"
echo
GREENTXT "INSTALLATION OF WAZUH MANAGER"
cat > /etc/yum.repos.d/wazuh.repo <<END
[wazuh_repo]
name=CentOS-$releasever - Wazuh
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
gpgcheck=1
baseurl=https://packages.wazuh.com/yum/el/7/x86_64
protect=1
END
yum -y -q install wazuh-manager
echo
GREENTXT "INSTALLATION OF WAZUH API + NODEJS"
curl --silent --location https://rpm.nodesource.com/setup_6.x | bash >/dev/null 2>&1
yum -y -q install nodejs
yum -y -q install wazuh-api
echo
GREENTXT "INSTALLATION OF JAVA 8 JDK RPM:"
cd /usr/local/src
wget --no-cookies --no-check-certificate --header "Cookie: gpw_e24=http%3A%2F%2Fwww.oracle.com%2F; oraclelicense=accept-securebackup-cookie" "http://download.oracle.com/otn-pub/java/jdk/8u121-b13/e9e7ea248e2c4826b92b3f075a80e441/jdk-8u121-linux-x64.rpm"
yum -y -q localinstall jdk-8u121-linux-x64.rpm
export JAVA_HOME=/usr/java/jdk1.8.0_121/jre
echo "export JAVA_HOME=/usr/java/jdk1.8.0_121/jre" > /etc/profile
echo
echo
GREENTXT "INSTALLATION OF ELASTCSEARCH:"
echo
cat > /etc/yum.repos.d/elasticsearch.repo <<END
[elastic-5.x]
name=Elastic repository for 5.x packages
baseurl=https://artifacts.elastic.co/packages/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
END
echo
yum -y -q install elasticsearch-5.3.0 >/dev/null 2>&1
echo
sed -i "s/.*cluster.name.*/cluster.name: wazuh/" /etc/elasticsearch/elasticsearch.yml
sed -i "s/.*node.name.*/node.name: wazuh-node1/" /etc/elasticsearch/elasticsearch.yml
sed -i "s/.*network.host.*/network.host: 127.0.0.1/" /etc/elasticsearch/elasticsearch.yml
sed -i "s/.*http.port.*/http.port: 9200/" /etc/elasticsearch/elasticsearch.yml
sed -i "s/-Xms2g/-Xms512m/" /etc/elasticsearch/jvm.options
sed -i "s/-Xmx2g/-Xmx512m/" /etc/elasticsearch/jvm.options
chown -R :elasticsearch /etc/elasticsearch/*
systemctl daemon-reload
systemctl enable elasticsearch.service
systemctl restart elasticsearch.service
echo
echo
sleep 15
GREENTXT "INSTALLATION OF PACKETBEAT:"
yum -y -q install packetbeat-5.3.0
chkconfig --add packetbeat
/etc/init.d/packetbeat restart
/usr/share/packetbeat/scripts/import_dashboards
echo
echo
GREENTXT "INSTALLATION OF LOGSTASH:"
yum -y -q install logstash-5.3.0
curl -so /etc/logstash/conf.d/01-wazuh.conf https://raw.githubusercontent.com/wazuh/wazuh/master/extensions/logstash/01-wazuh.conf
curl -so /etc/logstash/wazuh-elastic5-template.json https://raw.githubusercontent.com/wazuh/wazuh/master/extensions/elasticsearch/wazuh-elastic5-template.json
usermod -a -G ossec logstash
sed -i "1,11d" /etc/logstash/conf.d/01-wazuh.conf
sed -i "/elastic2/d" /etc/logstash/conf.d/01-wazuh.conf
sed -i "s/^#//g" /etc/logstash/conf.d/01-wazuh.conf
systemctl daemon-reload
systemctl enable logstash.service
systemctl start logstash.service
echo
echo
GREENTXT "INSTALLATION OF KIBANA:"
yum -y -q install kibana-5.3.0
/usr/share/kibana/bin/kibana-plugin install https://packages.wazuh.com/wazuhapp/wazuhapp-2.0_5.3.0.zip
echo
systemctl daemon-reload
systemctl enable kibana.service
systemctl restart kibana.service
echo
echo
yum versionlock elasticsearch logstash kibana packetbeat wazuh-manager wazuh-api
GREETXT "OSSEC WAZUH API SETTINGS"
sed -i 's/.*config.host.*/config.host = "127.0.0.1";/' /var/ossec/api/configuration/config.js
echo
MAGE_DOMAIN=$(awk '/webshop/ { print $2 }' /root/mascm/.mascm_index)
KIBANA_PORT=$(shuf -i 10322-10539 -n 1)
USER_IP=${SSH_CLIENT%% *}
KIBANA_PASSWD=$(head -c 500 /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 6 | head -n 1)
WAZUH_API_PASSWD=$(head -c 500 /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 6 | head -n 1)
htpasswd -b -c /etc/nginx/.wazuh wazuh-web ${KIBANA_PASSWD}  >/dev/null 2>&1
cd /var/ossec/api/configuration/auth
htpasswd -b -c user wazuh-api ${WAZUH_API_PASSWD}  >/dev/null 2>&1
systemctl restart wazuh-api
cat > /etc/nginx/sites-available/kibana.conf <<END
server {
  listen ${KIBANA_PORT} ssl http2;
  server_name           ${MAGE_DOMAIN};
  access_log            /var/log/nginx/access.log;
 
  ## SSL CONFIGURATION
    #ssl_certificate     /etc/letsencrypt/live/${MAGE_DOMAIN}/fullchain.pem;
    #ssl_certificate_key /etc/letsencrypt/live/${MAGE_DOMAIN}/privkey.pem;
   
    satisfy all;
    allow ${USER_IP}/32;
    deny  all;
    auth_basic  "blackhole";
    auth_basic_user_file .ossec;
     
       location / {
               proxy_pass http://127.0.0.1:5601;
       }
}
END
echo
cd /etc/nginx/sites-enabled/
ln -s /etc/nginx/sites-available/kibana.conf kibana.conf
service nginx reload
echo
YELLOWTXT "KIBANA WEB INTERFACE PORT: ${KIBANA_PORT}"
YELLOWTXT "KIBANA HTTP AUTH: wazuh-web ${KIBANA_PASSWD}"
echo
YELLOWTXT "WAZUH API AUTH: wazuh-api ${WAZUH_API_PASSWD}"
echo
pause '---> Press [Enter] key to show menu'
;;
"exit")
REDTXT "------> EXIT"
exit
;;

However, I do not know if there is an easier way and exactly what this accomplishes and why it is needed. Prayfully, I will implement something soon. God bless you!

ljseals · Jun 2, 2017

Actually they have a website. ELK Stack Integration or maybe from @eva2000 it is already compliant?

eva2000 · Jun 2, 2017

Thanks @ljseals that info is useful to read up on I have played with OSSEC briefly though installing the software and fully understanding how to use it and what it's messages/logs and alerts mean are two entirely different matters

https://wazuh.com/elastic-stack/ looks very interesting and has a docker container for it (CentOS 7+ needed) !

https://documentation.wazuh.com/current/pci-dss/index.html

Using Wazuh for PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard for organizations that handle branded credit cards from the major card companies including Visa, MasterCard, American Express, Discover, and JCB. The standard was created to increase controls around cardholder data to reduce credit card fraud.

Wazuh helps to implement PCI DSS by performing log analysis, file integrity checking, policy monitoring, intrusion detection, real-time alerting and active response. This guide explains how these capabilities help with each of the standard requirements:

Wazuh for PCI DSS Guide (PDF)

Wazuh for PCI DSS Guide (Excel)

Click to expand...

Log in / Register

Forums

Join the community today

PCI Compliance & Centmin Mod

Vinayak New Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Vinayak New Member

ljseals Member

ljseals Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Join the community today

PCI Compliance & Centmin Mod

Vinayak New Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Vinayak New Member

ljseals Member

ljseals Member

eva2000 Administrator Staff Member

.