Security Compliance

Common SEM reports recommended for PCI compliance

This article provides information about the most common reports SolarWinds thinks you may need for PCI auditing and compliance.

First published date

8/29/2019 5:02 PM

Last published date

8/29/2019 5:02 PM

Overview

Often, we hear customers asking which SEM reports you should focus on for PCI auditing out of 300+ built in reports templates. This article intends to answer some of these questions and help you focus on specific reports.

Product section

Security Event Manager

Cause

N/A

Resolution

PCI Goals - Please note your goals might differ based on what industry and compliance level your organization falls under for PCI compliance. This information is provided on a best effort basis.

GOAL: Build and Maintain a Secure Network (focused on perimeter defences):
- Install and maintain a firewall config to protect cardholder data
  - Auditors will want a copy of the firewall config.
  - You can usually also give them a copy of the "Network Traffic Audit - Configuration Traffic" report to show that you are tracking firewall changes and when they occur. (Recommended: Daily)
- Do not use vendor-supplied defaults for system passwords and other security parameters.
  - Auditors will usually want proof of password testing or will perform testing themselves. Make sure you change default passwords on all systems semi-regularly (also to protect against sysAdmins going rogue).
  - A "Change Management - General Authentication: User Account Events - User Modify Attributes" report will show that you regularly update passwords. (Recommend: Weekly)
GOAL: Protect Cardholder Data
- Protect stored cardholder data.
  - Auditors will usually want you to show your access controls (permissions on the files and system that contain the cardholder information). Make sure your permissions are set to least-privilege best practices and you have file auditing, database monitoring, and/or USB defender enabled where appropriate.
  - Showing you can easily produce access logs can alleviate some of their concerns.
    - For File Auditing: The "File Audit Events" set of reports can give you a lot of valuable information.
    - For DB Monitoring: <tbd>
    - For USB monitoring: The "Machine Audit - USB Defender" report can show useful information to show that you are watching USB activity for suspicious filenames.
- Encrypt transmission of cardholder data across open, public networks.
  - This will usually be shown on your firewalls or switch configurations (whichever devices are between your network and any shared networks)
GOAL: Maintain a Vulnerability Management Program
- Use and regularly update anti-virus software or programs
  - The "Malicious Code - Virus Attack" report can be useful in showing that you are monitoring virus activity on your network. (Recommended: Daily reports + real-time alerting)
  - Additionally, copies of past email alerts from virus detection can be useful as well. If no alerts are found in the past week, I recommend testing EICAR to ensure virus detection is operating as expected on a sample machine.
  - Reports on how "up to date" your virus scan systems can usually be produced by your central AV management solution.
- Develop and maintain secure systems and applications.
  - This can only really be confirmed through semi-regular penetration testing on your applications and network (Vulnerability management can sometimes be enough for auditors)
GOAL: Implement Strong Access Control Measures
- Restrict access to cardholder data by business need to know.
  - A copy of current access controls is usually enough for auditors. (Remember to practice "least-privilege")
  - Additionally, you may want both targeted "File Audit Events" reports (to track when changes are made to permissions on the files/folders) and "Change Management - General Authentication: Group Events" reports (to track changes made to groups likely in the permissions set on the files/folders)
- Assign a unique ID to each person with computer access
  - Limiting shared accounts is the only way to pass this portion of the compliance test.
  - In some situations, running regular password audits and forcing people with the same password to change it can show that you are serious about cracking down on people sharing passwords.
- Restrict physical access to cardholder data.
  - Make sure to lock the doors around your sensitive systems and have access logs, if you have a dedicated server room (or have camera monitoring).
GOAL: Regularly Monitor and Test Networks
- Track and monitor all access to network resources and cardholder data
  - Network resource access should be shown by filtered "Authentication" reports.
  - Filtered "File Audit Events" reports will show access to cardholder data specifically.
- Regularly test security systems and processes.
  - Third-party penetration testing and internal testing is what will get you past this. (Social Engineering tests are becoming popular as well)
GOAL: Maintain an Information Security Policy
- Maintain a policy that addresses information security for all personnel.
  - Logon banners stating the policy and implied acceptance, signed "computer usage agreements", and policies that state what is acceptable and not are needed for this.

Please refer to Default reports included with SEM for complete list with description and summary of what each report contains.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.