[Autogenerated] the next requirement,
8.5 is another one that doesn't apply to users who
process a single card at times, such as in a retail store.
On this requirement is not to use generic or shared IEDs on again.
This is another one where it's really important to read the actual words
of the requirement because it's in three parts on.
Actually, there isn't a blanket restriction on shared IEDs.
So firstly, there's a demand not to use generic IEDs on this has to be disabled,
renamed or removed.
Secondly, there are no shared IEDs for administrator or privileged access.
Actually, these exact words error administration,
other critical functions and, finally,
that any shared or genetic user IDs that exist are not
used for administrative purposes.
So although you might think it poor security,
the center does allow for non admin shared I days.
To test this requirement, the QoS A will look at the directory service.
Another system components to see that such a county that don't exist or a
disabled they will look at any relevant policies and procedures,
and the QoS a will want to talk to system administrators to make sure
that they don't use shared or genetic ideas to log in.
There's one sub requirements at 8.5,
which just applies to service providers are not to individual merchants.
On this is to make sure that where the service provider has
access to different customer systems,
that they use unique credentials for each customer,
you know.
And if you look at the history of cardholder data breaches,
you could understand why.
This is because there are cases where one service provider was compromised and
then the criminals were able to compromise every single one.
The service providers customers because they reused ID's and passwords on.
Although this is a sub requirement of 8.5,
which deals with generic and shared accounts,
the requirement here is not just about having the same
user IDE on each customer system,
but also to make sure that a unique authentication credential such as passwords,
error in place and to test this because the USA won't be
able to see what passwords he used.
Well, we certainly hope that's the case anyway.
The look at the service providers,
policies and procedures and also talk to people who
may log in to their customers.
Networks