[Autogenerated] PC IDE CSS Requirement eight is concerned with
identifying authenticating people with access to cardholder data on
the wider cardholder data environment.
It's quite a long on a times prescriptive
requirement that split into eight parts,
starting off with the need for users to be uniquely identified
and authenticated and if they're administrators or remote users
to have multi factor authentication.
There's also the need to teach users about the
authentication systems not to really use shared accounts to
properly manage any physical access tokens.
And then there's a weird,
out of place sub requirement about access to
databases containing cardholder data on.
Finally, the last requirement, as I'm sure you expect by now,
is to have policies and procedures.
And if we consider which systems this requirement applies to,
there's no straight answer.
Potentially, it could be any system in the cuddle data environment.
If you take a literal interpretation of the standard,
is just the systems that store process or transmit cardholder data.
But most QoS eyes, I know apply equally throughout the CD.
If you have systems in the CD that can't comply with these requirements,
point your QoS A.
To the note of the start of requirement eight,
because the standard is clear that the requirement
applies to all administrative accounts,
including admin accounts on point of sale systems,
all accounts that converge you or access cardholder data accounts that give
access to systems that store process or transmit cardholder data even if the
account itself has no access to cardholder.
Data on all accounts used by vendors and third parties,
typically for support on the standard,
makes it clear there's one set of accounts the standard does not
apply to on both of the accounts of customers or consumers or
cardholders who use their payment card, a merchant's website to buy goods.
Error services.
Look,
this is really important have highlighted it because it's a hidden in a
note at the start of Requirement A and Met QoS is we've wrongly tried
to apply the identification authentication requirements to a merchant's
customers They don't apply.
Also included in that same note.
It's a very important point that certain requirements
do not apply in some circumstances,
and I'm going to quote directly from the standard,
so there's no chance of confusion here.
User accounts within a point of sale payment application,
the only have access to one card number at a time in order
facilitate a single transaction such as cashier accounts.
Now will we come across those requirements that don't apply to
people taking payments using a point of sale system?
These will be indicated by an orange asterisk.
We've covered those very important notes about where these
requirements apply and where they don't apply.
Let's look at them all.
The first requirement 8.1 is concerned with user accounts,
and it wants to make sure that the organization manages
them properly and is far as piece GUID.
CSS is concerned properly is defining the next eight sub requirements.
And remember, this applies to users and administrators within the organization,
not to customers or consumers.
As this is a top level requirement,
it just wants policies and procedures and processes.
So the QoS is just going to review these documents
and the first sub requirement.
Once unique accounts error identifies for each user.
You'll notice by the orange asterisk that this is one of those
requirements that doesn't apply to point it cell users who just
process a single card at a time.
The requirement itself is pretty simple.
A unique user ideas needed and guidance explains that this is primary to allow
the organization to track who performed task on the system,
which is essential for order and for troubleshooting.
The QoS A is going to talk to system administrators to
make sure this is what actually happens.
The next two requirements are consumed with creating,
modifying and deleting or disabling user IEDs.
Or, as most of you know, this,
the joiners moves and levers process or some people I've
heard call it starters movement levers Requirement 8.1 point
two covers join us and movers,
ensuring that when people are given IEDs on the rights error assigned to those
IEDs that the grant of those rights has been authorized on.
The rights granted reflect their authorization requirement.
8.1 point three takes care of the final part of Join US Moves on levers process,
which is levers and it requires the access is revoked immediately.
When a user leaves the business.
It's useful to note that PC IDE CSS uses the term revoked,
meaning that the user no longer has access.
So it's completely up to the organization whether it disables or deletes
accounts for users who leave to test the join us and movers.
The QoS is going to look at records of approval on match
this to the actual settings in the access control system
to test the leaders processes.
Working the QoS a.
Well as for the ideas of people,
have left the business in the last six months on,
make sure that their accounts have been deleted or disabled.
Requirement 8.1 point four wants to make sure that in active user accounts
don't present a risk of system security by ensuring that any account that
hasn't been used for 90 days is removed or disabled on.
The reason for this is simple.
If an account isn't in use, the real user wouldn't know if it's being attacked.
So to check for this,
the QoS is going to look at the settings of your access control
system and try to find accounts that have been inactive for over
90 days that have not been disabled.
This next requirement often causes problems in companies.
It's one of the few requirements in PC, idea says.
But I think doesn't reflect the reality of how many
organizations work now and requirement concerns the management
of third-party service providers with access to system
components on the requirement is twofold.
Firstly, the third party's account is only enable to unnecessary and secondly,
that the account is monitored when it is in use.
These error pretty straightforward,
except when the third-party right-click provides first
line support to an organization.
In this case,
you need to make it really clear in the documentation for the nested.
The 24 hour access by the provided essential on then to make this
requirement to only enable access were necessary apply to any second line
support engaged by the first line service provider.
With this clarification in place,
it's easy to show the QoS a the evidence they require in the former
documented support agreements demonstrating where first line support
provided by an external party on beyond this third-party accounts error
disabled and only enabled when needed.
The U.
S A.
Is going to check such documentation on talk to the
relevant people in the organization.
The next two requirements 8.1 point six and 8.1 point seven A.
Concerned with protecting accounts where it appears that someone is trying
to guess the password using a password getting attack.
Both of these requirements have the orange asterisk,
and so this means they don't apply to those paws
accounts we talked about earlier.
The first part is to lock an account after six sequential
incorrect log in attempts on the second specifies that once
an account has been locked,
it can only be unlocked by administrator or automatically
unlocked after a minimum of 30 minutes has elapsed.
To validate these requirements, the QoS a will look at the system settings.
They may also ask you to make six incorrect logging
attempts in a row to proven account is locked.
Requirement 8.1 point eight is another one with the asterisk.
It doesn't apply to those one card at a time point
of sale users on the requirement.
It's to lock systems after a period of in activity.
It's a very simply written requirement.
Once a session has been idle for more than 15 minutes,
three user needs to re authenticate, for example,
by entering their password before they can use the system again.
And, as the guidance says,
this could be the operating system or an application level,
and this will be tested by the use A looking at the system or
application settings where this is configured on the patient.
Yusa may even sit and watch an Idol session for 16 minutes to see what happens.