Transcription
October 26, 2009PCI X-Ray: File Integrity Monitoringby John Kindervagfor Security & Risk ProfessionalsMaking Leaders Successful Every Day
For Security & Risk ProfessionalsOctober 26, 2009PCI X-Ray: File Integrity MonitoringThis is the seventh document in the “PCI X-Ray” series.by John Kindervagwith Robert Whiteley and Margaret RyanExecut i v e S u mma ryTo effectively deal with the broad and complex requirements of Payment Card Industry (PCI) datasecurity, you need to break the elements apart to provide enhanced clarity. We’ve designed the PCIX-Ray series to provide actionable information to help Forrester Research clients become PCIcompliant. This document deals with file integrity monitoring (FIM) for PCI, while providing practicaltechnical guidance to help ensure PCI compliance before your auditor shows up to develop the Reporton Compliance (ROC).tabl e of Co n te nts2 Forrester’s PCI X-Ray Series2 Don’t Be A Statistic: FIM Helps DetectAttackers Using Custom Malware4 What The PCI DSS Says About File IntegrityMonitoringFile Integrity Monitoring Is A Function, Not AProductDefine: FIM Is Designed To Alert You ToUnauthorized ChangesDiagnose: How Would You Know If An AttackerHad Installed Malicious Software?Treat: Deploying FIM Is Critical In Today’s ThreatEnvironmentFollow Up: Diligence Is Demanded By ThisEver-Changing Threat Environmentrecommendations9 File Integrity Monitoring Is A Critical Last LineOf DefenseN OT E S & RE S O U RCE SIn developing this report, Forrester drewfrom a wealth of analyst experience, insight,and research through advisory and inquirydiscussions with end users, vendors, andregulators across industry sectors.Related Research Documents“PCI X-Ray: Network Segmentation”July 17, 2009“PCI X-Ray: IDS And IPS”April 8, 2009“PCI X-Ray: Firewalls”February 13, 2009“PCI X-Ray: What’s New in 1.2?”January 30, 2009“PCI X-Ray: Log Management”October 20, 2008“PCI X-Ray: Wireless Security”October 1, 2008“Confessions Of A QSA: The Inside Story Of PCICompliance”September 11, 2008 2009, Forrester Research, Inc. All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on best availableresources. Opinions reflect judgment at the time and are subject to change. Forrester , Technographics , Forrester Wave, RoleView, TechRadar,and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies. Topurchase reprints of this document, please email clientsupport@forrester.com. For additional information, go to www.forrester.com.
2PCI X-Ray: File Integrity MonitoringFor Security & Risk ProfessionalsForrester’s PCI X-ray seriesThis is the seventh in a series of reports that deal with specific requirements of the PCI DSS. Theyare designed to provide security and risk professionals with guidance and transparency within thePCI arena, allowing each part of the standard to be fully revealed. Just as an x-ray can see beneaththe skin to the underlying details of a medical issue, the PCI X-Ray series exposes PCI to the light.This series focuses on the individual elements of PCI to facilitate the compliance process.This PCI X-Ray is composed of two parts — an overview to provide a general summary of a specificpart of PCI and a reference architecture diagram that provides a visual representation about theissues raised. By dissecting PCI into its component pieces, we will make PCI more understandableand provide you with enhanced knowledge and insight into creating a compliant credit cardenvironment. To simplify PCI compliance, these X-Rays facilitate four proactive steps:· Define. Just as each disease must be defined to be understood, this series will define the parts ofPCI in an understandable way to make PCI flow into the organization.· Diagnose. Once diseases have been defined and documented, physicians can look at a patientand diagnose the disease. PCI is similar in that you can’t find a problem without understandingit first; only then can you look at the cardholder environment, see where the problems are, anddecide what needs to be fixed.· Treat. When the disease is finally diagnosed, treatment can begin. A doctor doesn’t justindiscriminately inject medicines into a patient without a plan. PCI practitioners should use thediagnosis to define a treatment regimen that will effectively eliminate the problem.· Follow up. Medical professionals are very aware that a disease thought to be cured can oftenrecur without warning. In the PCI world, the practitioner must remain diligent to ensure thateach element within the PCI environment remains in compliance. New devices or applications,configuration changes, and industry developments can all conspire to take the network out ofcompliance. Regular checkups are encouraged.Don’t Be a Statistic: FIM helps detect Attackers using custom malwareWith the recent and highly publicized credit card breaches of companies such as HannafordSupermarkets and Heartland Payment Systems, the perils of custom malware have come to light. Asattackers become increasingly sophisticated, diligence and agility are the keys to staying ahead ofthreats. In an effort to bypass widely deployed controls such as antivirus, cybercriminals are creatingcustomized software for individual targets. As a result, we see three prevailing trends. Specifically,hackers are:· Bypassing basic antimalware controls successfully. Because this type of malware is soindividualized, it has not been seen by malware vendors. Antimalware still relies heavily onOctober 26, 2009 2009, Forrester Research, Inc. Reproduction Prohibited
PCI X-Ray: File Integrity MonitoringFor Security & Risk Professionalssignatures of known viruses, worms, and Trojans to be effective. By using custom-developedsoftware, attackers increase the likelihood of a successful implementation.· Stealing credit card data without enterprise detection. The result of this type of bespokemalware has been a spectacular series of credit card breaches. Because cybercriminals go toextreme efforts to ensure that their cooked-to-order code does not look malicious, it can be verydifficult to detect.· Getting detected, if at all, by back-end monitoring from credit card companies. Card brandsoften discover breaches by triangulating fraud using a technique known as Common Point ofPurchase (CPP).1 For example, it was the card brands that first notified Heartland PaymentsSystems that it had been breached.2The risk of suffering a breach from this type of attack vector can be reduced by deploying fileintegrity monitoring (FIM) tools within the cardholder data network (CHDN) to provideimmediate alerts if unauthorized software, such as custom malware, is being deployed. Shouldtraditional antimalware solutions fail to discover this covert malware, properly configured FIM toolswill alert you of an unauthorized installation of software (see Figure 1).Figure 1 Anatomy Of A Custom Malware Attack164HSM235MerchantVulnerableserverCredit carddatabase1. Hacker exploits a vulnerable server and installs custom-built stealth sniffer.2. Custom malware is not seen by antivirus software. Sniffer fires up.3. Store sends credit card information for processing to credit card switch.4. Credit card switch transfers credit card information to processor.5. Malware sniffs traffic destined for HSM (encryption appliance).6. Hacker receives packet captures from malware and retrieves credit card information.53859 2009, Forrester Research, Inc. Reproduction ProhibitedSource: Forrester Research, Inc.October 26, 20093
4PCI X-Ray: File Integrity MonitoringFor Security & Risk ProfessionalsWhat the PCI DSS says about File Integrity MonitoringThe PCI DSS specifies FIM primarily in Requirement 11.5:“Deploy file-integrity monitoring software to alert personnel to unauthorized modificationof critical system files, configuration files, or content files; and configure the software toperform critical file comparisons at least weekly.”Other requirements in the PCI DSS discuss how to monitor FIM tools and mandate inclusion ofFIM alerts into policy. The intent of Requirement 11.5 is to provide organizations with a last lineof defense against the exploitation of critical resources within the CHDN, primarily servers. Bydeploying FIM solutions, organizations gain the ability to catch the installation of malware in the actand prevent an embarrassing and costly data breach.File Integrity Monitoring Is A Function, Not A ProductThe PCI DSS calls for the deployment of “file-integrity monitoring software.” While single-purposeFIM software exists and can meet this compliance obligation, there are other tools that may meetthe intent of 11.5 in your organization. For example, we’ve seen compliant organizations use:· Log management and SIM solutions. Many log management solutions use agents on serversto collect server logs and meet the logging requirements specified in Requirement 10.3 Theseagents often have the ability to provide change detection and FIM capabilities. The upside hereis that these agents will then automatically pull this data into the log or security informationmanagement (SIM) tool, which is specified in Requirement 10.6.4· Configuration and patch management tools. Many organizations use automated tools toprovide configuration and patch management capabilities on an enterprisewide basis. Thesetypes of tools may have FIM built in, although it is often not publicized by the vendor.· Host IPS and whitelisting software. It’s common for companies to deploy host IPS (HIPS) orwhitelisting software to critical servers. By definition, this type of software functions as a FIMtool in that it will not allow unauthorized software to be deployed. Using these tools for FIM isan excellent way to leverage existing security investments to meet PCI compliance obligations.Define: FIM Is Designed To Alert You To Unauthorized ChangesTo increase the security on your CHDN resources, FIM should be deployed where possible toprotect your servers from unauthorized changes, especially the installation of illicit and potentiallymalicious software (see Figure 2). There are three fundamental metrics tracked by FIM:October 26, 2009 2009, Forrester Research, Inc. Reproduction Prohibited
PCI X-Ray: File Integrity MonitoringFor Security & Risk ProfessionalsFigure 2 PCI X-Ray File Integrity Monitoring Checklist: Defining PCI CompliancePCI requirementDefine10.5.5 Use file-integrity monitoring orchange-detection software on logs toensure that existing log data cannot bechanged without generating alerts(although new data being added shouldnot cause an alert).This requirement ensures that the logs specified in Requirement10 are not changeable. Logs are used for alerting and forensicinvestigations and must, therefore, be accurate.10.6 Review logs for all systemcomponents at least daily. Log reviewsmust include those servers that performsecurity functions like intrusion-detectionsystem (IDS) and authentication,authorization, and accounting protocol(AAA) servers (for example, RADIUS).Note: Log harvesting, parsing, and alertingtools may be used to meet compliancewith Requirement 10.6.Because Requirement 12.9.5 specifies that by policy, file integritymonitoring is grouped together with IDS and IPS solutions, it isa best practice that FIM tools be sent to the log server andreviewed daily.11.5 Deploy file-integrity monitoringsoftware to alert personnel to unauthorizedmodification of critical system files,configuration files, or content files; andconfigure the software to perform criticalfile comparisons at least weekly.Note: For file-integrity monitoring purposes,critical files are usually those that do notregularly change, but the modification ofwhich could indicate a system compromise orrisk of compromise. File-integrity monitoringproducts usually come pre-configured withcritical files for the related operating system.Other critical files, such as those for customapplications, must be evaluated and definedby the entity (that is, the merchant or serviceprovider).File integrity monitoring tools should be deployed on resources,typically servers, within the cardholder data network to monitorvarious files for unauthorized changes. The intent is to providean alerting mechanism if files are changed by malicious insidersor outsiders.12.9.5 Include alerts from intrusiondetection, intrusion-prevention, and fileintegrity monitoring systems.Incident response policy must include a provision to monitorand respond to alerts from FIM tools.53859Source: Forrester Research, Inc.· Policy: Does the proposed system change fall within written policy? This policy must also becompliant with the PCI DSS. Any out-of-policy changes should trigger an alert and be denied, ifpossible.· Authorization: Is the proposed system change authorized? Answering this question mayrequire information from your help desk or change management systems. Alerts from FIMmust tie into a global view of the proposed change so that it can be stopped or investigatedif needed, although purpose-built FIM software may have integrated this functionality into 2009, Forrester Research, Inc. Reproduction ProhibitedOctober 26, 20095
6PCI X-Ray: File Integrity MonitoringFor Security & Risk Professionalsits management console. Additionally, some tools with FIM functionality such as HIPS orwhitelisting software may, by default, deny changes that have not been pre-authorized.· Compliance: Is the proposed change compliant with PCI or other compliance obligations?You’ll need to deploy a system capable of cross-referencing PCI and other compliance initiativesto automatically determine if a proposed state change is compliant. This may be built into theFIM tool or may require feeding FIM data into a SIM or governance, risk, and compliance(GRC) tool.FIM allows enterprises to track deviations from their “golden image.” This is the initial, approvedsoftware build that has been approved for deployment within an organization. By using FIM,you will always be able to know the state of the deployed software and be able to ensure that it iscompliant with PCI at all times. Should an unauthorized attempt to deviate from this compliantstate be made, the organization can quickly identify the attempt and remediate against it.Diagnose: How Would You Know If An Attacker Had Installed Malicious Software?The landmark Heartland Payment Systems breach begs the question, “Would you know if custommalware had been installed in your organization?” (see Figure 3). According to the Department ofJustice indictment of the Heartland hacker Albert Gonzalez:“On or about November 6, 2007, GONZALEZ transferred a computer file to the UkrainianServer named ‘injector.exe’ that matched malware placed on both Heartland and CompanyA’s servers during the hacks of those companies.”5Based on information from Heartland Payment, it was not aware of the breach until the week ofJanuary 12, 2009.6 Heartland Payment was in a breach condition for at least 18 months and did notdiscover the breach on its own. This underscores the criticality of FIM tools deployed within theCHDN.Treat: Deploying FIM Is Critical In Today’s Threat EnvironmentSince PCI requires FIM deployment, companies falling under PCI have no choice but to complyand install some type of solution to ensure the integrity of their CHDN resources (see Figure 4).Unfortunately, many companies don’t understand FIM and think that this functionality is built intotheir antivirus (AV) software. Avoid the most common pitfalls of:· Overreacting and replacing your AV vendor. When a client is hit with a custom softwareattack, their first reaction is to be angry with their antivirus provider. Forrester recently spokewith an organization that suffered this type of malware attack. They reacted predictably, blamingtheir AV vendor and threatening to replace that vendor’s software with a competitor’s. They gavethe offending malware to the AV vendor and were shocked that the vendor had not seen thatparticular strain of malware before this attack. Custom malware writers are often subscribers toOctober 26, 2009 2009, Forrester Research, Inc. Reproduction Prohibited
PCI X-Ray: File Integrity MonitoringFor Security & Risk Professionalsmany AV vendors’ solutions so they can test their malware against known antimalware agents.FIM is frequently the only way to detect this type of sophisticated attack.· Failing to look at currently deployed technologies to see if they support FIM. Companieswithout any type of FIM capability should immediately deploy a PCI compliant FIM tool. Ifyou’re unsure if you have FIM capability in your environment, you should inventory anycontrol that may potentially have this function, such as patch management or configurationmanagement systems, and check with the vendor to see if the existing solution can supportFIM for PCI. If so, make certain this feature is enabled and configured to meet all of the PCIrequirements regarding FIM for PCI.Figure 3 PCI X-Ray File Integrity Monitoring Checklist: Diagnosing PCI CompliancePCI requirementDiagnose10.5.5 Use file-integrity monitoring orchange-detection software on logs toensure that existing log data cannot bechanged without generating alerts(although new data being added shouldnot cause an alert).This requirement should not demand a separate product butshould be built into any PCI compliant log managementsolution deployed in your organization. Review productinformation from your chosen log management solution todetermine if it meets this requirement.10.6 Review logs for all systemcomponents at least daily. Log reviewsmust include those servers that performsecurity functions like intrusion-detectionsystem (IDS) and authentication,authorization, and accounting protocol(AAA) servers (for example, RADIUS).Note: Log harvesting, parsing, and alertingtools may be used to meet compliancewith Requirement 10.6.Review FIM configurations to determine if alerts from thesystems are being forwarded to log management tools.11.5 Deploy file-integrity monitoringsoftware to alert personnel to unauthorizedmodification of critical system files,configuration files, or content files; andconfigure the software to perform criticalfile comparisons at least weekly.Note: For file-integrity monitoring purposes,critical files are usually those that do notregularly change, but the modification ofwhich could indicate a system compromise orrisk of compromise. File-integrity monitoringproducts usually come pre-configured withcritical files for the related operating system.Other critical files, such as those for customapplications, must be evaluated and definedby the entity (that is, the merchant or serviceprovider).Determine if FIM tools have been deployed on resources withinthe cardholder data network. Ensure that these tools are set upto alert if unauthorized changes to files are made. FIM tools mayinclude specialized change detection software or othersolutions that have the ability to monitor for changes, such assome log management solutions, patch management solutions,or configuration management solutions.12.9.5 Include alerts from intrusiondetection, intrusion-prevention, and fileintegrity monitoring systems.Review incident response policy documentation to ensure thatfile integrity monitoring alerts are specified in the policy.53859 2009, Forrester Research, Inc. Reproduction ProhibitedSource: Forrester Research, Inc.October 26, 20097
8PCI X-Ray: File Integrity MonitoringFor Security & Risk ProfessionalsFigure 4 PCI X-Ray File Integrity Monitoring Checklist: Treating PCI CompliancePCI requirementTreat10.5.5 Use file-integrity monitoring orchange-detection software on logs toensure that existing log data cannot bechanged without generating alerts(although new data being added shouldnot cause an alert).The only treatment is to deploy a PCI compliant logmanagement solution.10.6 Review logs for all systemcomponents at least daily. Log reviewsmust include those servers that performsecurity functions like intrusion-detectionsystem (IDS) and authentication,authorization, and accounting protocol(AAA) servers (for example, RADIUS).Note: Log harvesting, parsing, and alertingtools may be used to meet compliancewith Requirement 10.6.Configure FIM tools to send alerts and other pertinentinformation to logging systems. Verify that the log managementsolution is correctly receiving and parsing the FIM log data.11.5 Deploy file-integrity monitoringDeploy appropriate FIM tools on resources that fall within thesoftware to alert personnel to unauthorized scope of your PCI obligation.modification of critical system files,configuration files, or content files; andconfigure the software to perform criticalfile comparisons at least weekly.Note: For file-integrity monitoring purposes,critical files are usually those that do notregularly change, but the modification ofwhich could indicate a system compromise orrisk of compromise. File-integrity monitoringproducts usually come pre-configured withcritical files for the related operating system.Other critical files, such as those for customapplications, must be evaluated and definedby the entity (that is, the merchant or serviceprovider).12.9.5 Include alerts from intrusiondetection, intrusion-prevention, and fileintegrity monitoring systems.53859Add the review of FIM alerts if it is not included in the policydocumentation.Source: Forrester Research, Inc.Follow Up: Diligence Is Demanded By This Ever-Changing Threat EnvironmentPCI requires constant vigilance. It’s easy to let compliance slip. One of the benefits of FIM is thatit helps maintain a constant state of compliance. One of the myths of PCI is that many of theorganizations that have suffered breaches were PCI-compliant and therefore there’s somethingwrong with PCI. The truth, however, is that no company that has ever been breached was compliantat the time of the breach. As part of the ongoing PCI hygiene, you should:October 26, 2009 2009, Forrester Research, Inc. Reproduction Prohibited
PCI X-Ray: File Integrity MonitoringFor Security & Risk Professionals· Ensure FIM is running, but don’t use it as a PCI crutch. Clearly, several breaches occurredbecause the company had not properly deployed FIM and was therefore unaware of theinstallation of malicious software. FIM could have foiled some of the most noteworthybreaches in recent memory. PCI is merely a minimum baseline, and companies should protectthemselves based upon current threats, which are ever-changing.· Don’t fall victim to the “checkbox” mentality; review and update FIM policy regularly. It’simportant to maintain your FIM solution. Too many organizations configure these tools onceand then never check up on them again. In their mind, they checked a box and it’s time to moveon. Don’t let this checkbox mentality invade your organization. Make sure you reassess yourFIM tool policies on a regular basis. Given the criticality of FIM in today’s threat environment,reviewing your FIM policy on a quarterly basis in conjunction with your approved scanningvendor (ASV) scans is a good idea.R ecomme n d a t io n sfile integrity monitoring is a critical last line of defenseThe companies breached in the Gonzalez attacks provide an object lesson to all organizations thatstore, process, or transmit credit card data. These threats are real, costly, and constantly evolving.FIM may well be your last line of defense. When attackers have bypassed other controls withinyour infrastructure, FIM can save you from a damaging data breach. Make your FIM investmentpay off by:· Leveraging existing controls to provide FIM functionality. You may already have a FIMtool in place. Look at solutions that handle configuration information to see if they mightmeet the FIM requirements stated in the PCI DSS. Patch management, HIPS, and whitelistingsoftware are the most logical starting points.· Taking FIM alerts seriously. It’s easy to ignore alerts. FIM alerts should be configured so thatthey only fire when something potentially dangerous is happening. Don’t leave the tool inits default configuration, but spend the requisite amount by allocating a security analyst toconsistently review the FIM configuration for at least the first six months of the deploymentto properly configure the tool. Nothing is more damaging than a breach alert that is ignored.· Remembering to include FIM in incident response. Many companies just assume (orhope) they will never be breached. But let’s be clear: You will not jinx yourself if you plan forresponding to a breach in advance. It should never be a surprise when a breach occurs. Planfor failure and have a worst-case scenario practiced and ready. If they aren’t already, makesure FIM alerts are part of your formal incident response policy documentation. Reviewthis annually with business, IT, compliance, legal, and PR executives so they understand thecorrect incident escalation steps. 2009, Forrester Research, Inc. Reproduction ProhibitedOctober 26, 20099
10PCI X-Ray: File Integrity MonitoringFor Security & Risk ProfessionalsEndnotes1Source: Visa (http://usa.visa.com/download/merchants/cpp fraud overview.pdf).2According to Heartland Payment Systems, it was unaware of the breach until notified by Visa andMasterCard that a breach had occurred. Source: “Heartland Payment Systems Uncovers MaliciousSoftware In Its Processing System,” Heartland Payment Systems press release, January 20, 2009 ).3In the early years of credit card security, the card brands put significant effort into determining the attackvectors of credit card breaches. There was very little log data available to use in reconstructing the crime.Therefore, the brands introduced requirements for logging in to their individual cardholder protectionefforts so that they could find out what happened if there was a breach. Eventually these requirementsfound their way into the PCI DSS. The logging requirements’ true purpose is to provide forensic data forbreach investigation. See the October 20, 2008, “PCI X-Ray: Log Management” report.4Requirement 10 of the PCI DSS mandates that all access to network resources and cardholder data mustbe tracked and monitored. According to the PCI DSS v1.2, “Logging mechanisms and the ability to trackuser activities are critical in preventing, detecting, or minimizing the impact of a data compromise.” See theApril 30, 2009, “Market Overview: Security Information Management (SIM)” report.5Source: US Department of Justice ffiles/GonzIndictment.pdf).6Source: Heartland Payment Systems er 26, 2009 2009, Forrester Research, Inc. Reproduction Prohibited
Making Leaders Successful Every DayHeadquartersResearch and Sales OfficesForrester Research, Inc.AustraliaIsrael400 Technology SquareBrazilJapanCambridge, MA 02139 USACanadaKoreaTel: 1 617.613.6000DenmarkThe NetherlandsFax: 1 617.613.5000FranceSwitzerlandEmail: forrester@forrester.comGermanyUnited KingdomNasdaq symbol: FORRHong KongUnited Stateswww.forrester.comIndiaFor a complete list of worldwide locations,visit www.forrester.com/about.For information on hard-copy or electronic reprints, please contact Client Supportat 1 866.367.7378, 1 617.613.5730, or clientsupport@forrester.com.We offer quantity discounts and special pricing for academic and nonprofit institutions.Forrester Research, Inc. (Nasdaq: FORR)is an independent research companythat provides pragmatic and forwardthinking advice to global leaders inbusiness and technology. Forresterworks with professionals in 20 key rolesat major companies providingproprietary research, customer insight,consulting, events, and peer-to-peerexecutive programs. For more than 26years, Forrester has been making IT,marketing, and technology industryleaders successful every day. For moreinformation, visit www.forrester.com.53859
PCI X-Ray: File Integrity Monitoring For Security & Risk Professionals 5 Figure 2 PCI X-Ray File Integrity Monitoring Checklist: Defining PCI Compliance · Policy: Does the proposed system change fall within written policy? This policy must also be compliant with the PCI DSS. Any out-of-policy changes should trigger an alert and be denied, if .
![PCI Compliant - but are we secure -- FOR PRINTING IN GRAYSCALE [Read-Only]](/img/14/303-pci-3.jpg)
