I've been searching for an answer to this question. According to PCI DSS Requirement 10.5.3, it asks for sending logs to a centralized secure internal log server.

Would we need to enable multi-factor auth into the internal log server if it is secured and segregated? Specially if we have firewalls only allowing CDE pushes into the log server but no backward traffic (in other direction) is allowed from the log server into CDE via FW rules.

Basically locking it down so you can't get into any part of CDE from that Log server. Thanks for any help or guidance on this.

When looking at the potential importance of those log servers to the security of the organization, I wouldn't even hesitate to implement multi-factor authentication on them. PCI DSS primarily requires the audit trail for reporting the aftermath of a breach, and that means money. If breached, you can use that data to say "the attacker hit payment system X from January 3-10, but never entered the database", which can limit your liability to the seven days of data that flowed through system X. Without trustworthy logging, the investigators could claim "it's unsure, so we're finding all data from October through January is at risk." That could be the difference between thousands of accounts vs millions; which could be the difference between sending a few notification letters vs ending up on the nightly news. Both are bad, but trust me, one is much worse.

Those are just the worst-case costs. Architecturally, that log data is the ideal place to plug in analytic engines to help you detect anomalous activity early, and can help you identify an intrusion long before the attacker makes off with your data. So while many intruders are of the snatch-and-grab type, some of the more serious APT threat agents try to cover their tracks, and look for ways to disable logging and analytics so they can remain hidden for a long time. Don't make it easy for them.

And if you have a 2FA system in place already for accessing the rest of your in-scope machines, it shouldn't be too much harder to extend that capability to your log server as well.

However, the official answer is going to be "whatever your QSA decides is secure." Multi-factor authentication will certainly make it that much easier for her to sign-off on that requirement. But really, you should want those servers to be secure, even more so than the auditor.

  • What about Read access only and not Administrative access for someone with root access? There is some discussion and disagreement here about READ acess only based on 8.3.1 guidance for administrative access. – Scott Jan 24 '17 at 20:24
  • I can't answer definitively for PCI DSS, but think about it: if an attacker can read the logs, he knows when he's successfully hidden his tracks. That's why we chose to lock down read-only access as well. – John Deters Jan 24 '17 at 21:06

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.