0

I had a software for firewall analyzer, it had an issue and stopped from working. The problem is I lost all the logs was collocated from this application, I contacted the support team but they couldn't do anything.

  • My question is: for PCI DSS compliance is it possible to have a business justification for this incident, as the logs are lost, or what to do in this case.

Please help.

Improve this question

1 Answer 1

Reset to default
1

My question is: for PCI DSS compliance is it possible to have a business justification for this incident, as the logs are lost, or what to do in this case.

You can try justifying why you lost the logs, but in all honesty if you can't maintain a suitable secure copy of them then its debatable whether you are (or even were) truely PCI-DSS compliant. (I don't know what levels you are intending to be compliant against)

That said: PCI DSS Requirement 10.5 and its sub-requirements describe the methods that must be employed to protect logs:

  • 10.5 Secure audit trails so they cannot be altered
  • 10.5.1 Limit viewing of audit trails to those with a job-related need
  • 10.5.2 Protect audit trails from unauthorized modifications
  • 10.5.3 Promptly back up audit trail files to a centralized log server or media that is difficult to alter
  • 10.5.4 Write logs for external-facing technologies onto a secure, centralized, internal log server or media device
  • 10.5.5 Use file-integrity monitoring or change-detection software on logs to ensure that existing log data cannot be changed without generating alerts (although new data being added should not cause an alert).

I have highlighted the ones that I believe you accidentally failed to comply with. Therefore I would make sure you update your policies and ensure that you have suitable controls in place to ensure it doesn't happen again. As long as you can demonstrate your corrective measures I think you will be fine.

Improve this answer
3
  • Thanks for your reply, do you have any sample justification form, it would be really helpful for me.
    – Petr
    Commented Jun 7, 2017 at 8:04
  • @Petr Afraid not a form. You need to make sure its documented and demonstrated as part of your next audit for any remedial issues you conducted to maintain compliance. That fact you demonstrating you are trying to comply is a lot more than some organisations I have come across recently!
    – ISMSDEV
    Commented Jun 7, 2017 at 8:16
  • does this mean in the next audit, will not be compliant. I think the required log that should be available is 3 months which I think I can achieve it .
    – Petr
    Commented Jun 7, 2017 at 8:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .