[Autogenerated] just like the previous requirement,
8.7 seems a bit out of place,
and it is also probably related to the findings of a forensic
investigation following a breach of cardholder data.
It's simply this that users don't have direct access to
databases containing cardholder data.
What standards says is that user access must be via programmatic methods.
In other words, users can't just as you queries directly to the database,
so users must be restricted to interacting with the database by
using a separate application or by calling pre defined store
procedures obviously privileged users.
So database administrators, D.
B A s still allowed to full access to the database.
Additionally,
where accounts have been created for applications to access information,
the database these accounts need to be prohibited from use
by users or from interactive sessions.
So if you've got a database account that's just
designed for an application to use it,
the only thing that can use it is the application to test this requirement.
The QoS A is going to look at all the database in scope to make
sure there's no anonymous access to make sure that non
privileged uses have to interact with the database TIFF I
applications or stored procedures,
and that any accounts used by applications are
restricted to application access only.