One Identity Safeguard for Privileged Sessions 6.0.6 - Administration Guide

Requirement 1.1.6

Documentation and business justification for use of all services, protocols, and ports allowed, including documentation of security features implemented for those protocols considered to be insecure. Examples of insecure services, protocols, or ports include but are not limited to FTP, Telnet, POP3, IMAP, and SNMP v1 and v2.

Requirement 2.1

Always change vendor-supplied defaults and remove or disable unnecessary default accounts before installing a system on the network. This applies to ALL default passwords, including but not limited to those used by operating systems, software that provides security services, application and system accounts, point-of-sale (POS) terminals, Simple Network Management Protocol (SNMP)community strings, etc.).

Requirement 2.2.2

Enable only necessary services, protocols, daemons, etc., as required for the function of the system.

Requirement 2.2.3

Implement additional security features for any required services, protocols, or daemons that are considered to be insecure, for example, use secured technologies such as SSH, S-FTP, SSL, or IPSec VPN to protect insecure services such as NetBIOS, file-sharing, Telnet, FTP, etc.

Requirement 2.3

Encrypt all non-console administrative access using strong cryptography. Use technologies such as SSH, VPN, or SSL/TLS for web-based management and other non-console administrative access.

Requirement 3.5.2

Store secret and private keys used to encrypt/decrypt cardholder data in one (or more) of the following forms at all times:

• Encrypted with a key-encrypting key that is at least as strong as the dataencrypting key, and that is stored separately from the data-encrypting key

• Within a secure cryptographic device (such as a host security module (HSM) or PTS-approved point-of-interaction device)

• As at least two full-length key components or key shares, in accordance with an industry-accepted method

Note: It is not required that public keys be stored in one of these forms.

Requirement 5.1.2

For systems considered to be not commonly affected by malicious software, perform periodic evaluations to identify and evaluate evolving malware threats in order to confirm whether such systems continue to not require anti-virus software.

Requirement 6.2

Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches. Install critical security patches within one month of release.

Requirement 8.1.8

If a session has been idle for more than 15 minutes, require the user to reauthenticate to re-activate the terminal or session.

Requirement 8.2.1

Using strong cryptography, render all authentication credentials (such as passwords/phrases) unreadable during transmission and storage on all system components.

Requirement 8.2.4

Change user passwords/passphrases at least every 90 days.

Requirement 8.2.5

Do not allow an individual to submit a new password/phrase that is the same as any of the last four passwords/phrases he or she has used.

Requirement 10.5.3

Promptly back up audit trail files to a centralized log server or media that is difficult to alter.

Requirement 10.5.4

Write logs for external-facing technologies onto a secure, centralized, internal log server or media device.