Welcome to Requirement 2, the excitingly named,
Do Not Use Vendor-supplied Defaults.
I actually think this requirement should've been called something like,
Let's Make Things Hard to Break Into by Making Some
Sensible Configuration Choices, but hey,
I wasn't in charge of creating the names of the requirements.
There are five sub-requirements in requirement 2.
Firstly, to remove default parameters,
to make sure that everything we put in our cardholder's
data environment is built securely,
to encrypt our administration sessions across the network,
to make sure we keep an inventory of everything in
the cardholder data environment, and then finally,
as you probably guessed, to have policies and procedures to support these goals.
Because requirement 2 is about the configuration and security of servers,
workstations, and networking devices, it applies to everything within the CDE.
Requirement 2.1 is pretty simple,
which is to get rid of the default passwords and
accounts that come with new systems.
Now you might think this is common sense and that no one would make a system
live when it's got a default password known to the world,
but having seen so many data compromise reports when I
worked for one of the major card brands,
I can say for certain there's a real lack of common sense in this respect.
It was one of the top four reasons people got compromised,
was they'd left default accounts enabled with default passwords.
The requirement itself has got two distinct parts.
Firstly, default passwords.
It's dead simple here.
Just change them.
Secondly, default accounts.
Rename them or disable them.
And if you think this is overboard,
just search the internet for files for default accounts and credentials.
It's not rocket science to break into a system using a
default account or default credentials.
But if you look at the words carefully,
the hardest part of this requirement is the word before.
It says you need to change these settings before a
device is connected to the network.
Because the theory is that as soon as they're connected,
a criminal will be able to use those default accounts or
credentials to compromise the system.
So you might need to build a special isolated build network
outside of your CDE to meet this requirement.
So you build the server or the networking device not connected to the CDE,
you remove the default accounts and credentials,
and then you plug it into the CDE.
To test this requirement,
the QSA is actually going to try to log into systems on
the network using default accounts.
They're probably actually going to run a tool like Nessus to do that.
There have been some really famous historical attacks on
payment card data through wireless, through default configurations,
or because they used W-E-P, or WEP.
This requirement aims to stop that happening.
The requirement is to remove default accounts,
credentials, and configurations from wireless networking equipment.
If you can't, rename or disable them.
And if it's not possible, give them an enormous password.
And if you're tempted to use the beautifully misnamed Wired Equivalent Privacy,
or WEP, just don't do it.
It's not secure and provides no privacy.
The QSA is going to check your policies,
the settings on wireless devices,
and interview the people who have or know they should have changed the defaults.