Scribd Logo
Upload

Welcome to Scribd!

  • PCI Compliance Requirement 7

    Uploaded by

    Sushil Verma
    10 views7 pages
    This document discusses PCI compliance requirement 7 which states that access to cardholder data should be restricted based on business need-to-know. It outlines that only authorized personnel whose job requires access should be granted access to computing resources and cardholder data to reduce risk. Organizations should create a clear policy to define how and to whom access is granted and establish a mechanism, like role-based access control, to restrict access based on a user's need to know and deny all unless specifically allowed.

    Original Description:

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    This document discusses PCI compliance requirement 7 which states that access to cardholder data should be restricted based on business need-to-know. It outlines that only authorized personnel whose job requires access should be granted access to computing resources and cardholder data to reduce risk. Organizations should create a clear policy to define how and to whom access is granted and establish a mechanism, like role-based access control, to restrict access based on a user's need to know and deny all unless specifically allowed.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPTX, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    10 views7 pages

    PCI Compliance Requirement 7

    Uploaded by

    Sushil Verma
    This document discusses PCI compliance requirement 7 which states that access to cardholder data should be restricted based on business need-to-know. It outlines that only authorized personnel whose job requires access should be granted access to computing resources and cardholder data to reduce risk. Organizations should create a clear policy to define how and to whom access is granted and establish a mechanism, like role-based access control, to restrict access based on a user's need to know and deny all unless specifically allowed.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPTX, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    of 7

    PCI compliance requirement 7

    Restrict access to cardholder data by business need-to-know.

    Objective:
    This requirement ensures critical data can only be accessed by authorized personnel.

    Requirement
    7.1 Limit access to computing resources and cardholder information only to those individuals whose job requires such access.
    The more people who have access to cardholder data, the more risk there is that a users account will be used maliciously. Limiting access to those with a strong business reason for the access helps your organization prevent mishandling of cardholder data through inexperience or malice. Your organization should create a clear policy for data access control to define how, and to whom, access is granted.

    7.2 Establish a mechanism for systems with multiple


    users that restricts access based on a users need to know and is set to deny all unless specifically allowed.
    Without a mechanism to restrict access based on users need to know, a user may unknowingly be granted access to cardholder data.

    How to implement requirement 7?


    Implement a access control model
    Attribute-based access control Discretionary access control Mandatory access control Role-based access control
    Role-based access control model is the best for PCIDSS

    Access control list


    Filesystem ACLs
    A File system ACL is a data structure (usually a table) containing entries that specify individual user or group rights to specific system objects such as programs, processes, or files.

    Networking ACLs
    An Access Control List refers to rules that are applied to port numbers or network daemon names that are available on a host or other layer 3, each with a list of hosts and/or networks permitted to use the service.

    You might also like