0

Is PCI DSS Require a dedicated syslog server - collecting only PCI systems logs, or centrally syslog server is OK for PCI dss?

2

The PCI Requirement 10 doesn't mention the need for a syslog server dedicated only to PCI systems. All the PCI_compliant companies that I've worked, they had only one syslog system (usually a SIEM solution).

If you had two or three log repositories it can become complicated to analyse and correlate events in case of an incident. For example, if someone attacks a non-PCI server and later escalate the attack to a PCI-scope server, it is better to have all the logs in one single repository.

Keep in mind that your syslog server will become on the PCI scope, so it will need to meet all the PCI requirements.

If you want to read more about the PCI Requirement 10 (which talks about monitoring), take a look on this blog: https://www.pcicomplianceguide.org/security-logging-and-monitoring-pci-dss-requirement-10-why-all-the-fuss/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.