Does Apache Tomcat 9 meet PCI compliance?
From where I should start reading and gather some information about that topic?
-
2Does it fulfill all the PCI DSS requirements for building and maintaining a secure network and systems? No, because the requirements are not software features, but practices. Can you fulfill the requirements while using Tomcat 9? That's possible.– Esa JokinenCommented Apr 4, 2020 at 5:01
Add a comment
|
2 Answers
Individual software packages are not judged compliant or non-compliant by PCI. Rather, the organization using them is required to attest that they are following PCI-approved practices where they apply to that software. A limited subset of examples:
6.1 Establish a process to identify security vulnerabilities, using reputable outside sources for security vulnerability information, and assign a risk ranking (for example, as “high,” “medium,” or “low”) to newly discovered security vulnerabilities.
This requires that the merchant track vulnerabilities (for example by reviewing the list here) and patch or apply compensating controls to ensure the merchant's installation of Tomcat 9 is not vulnerable to attack.
6.2 Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor supplied security patches. Install critical security patches within one month of release.
Keeping Tomcat 9 patched is another requirement imposed by PCI.
6.4.1 Separate development/test environments from production environments, and enforce the separation with access controls.
This is an excellent example of how your practices matter; this is not anything intrinsic to Tomcat 9, but rather a constraint upon how you choose to use it.
As always, the best source to learn more about PCI DSS is the document itself, available from the PCI Security Standards document library.
answered Apr 4, 2020 at 15:38
PCI compliance is not for individual software or a webserver. PCI-compliance frameworks offer a collection of best practices to ensure the security and privacy of the Card Holder Data (CHD) environment, where the card data is stored, processed or transmitted. The complete system, which includes the web application (assuming) hosted over Apache Tomcat must be PCI compliant. Different domains within PCI help the institution in implementing the practices required by PCI, e.g. PCI-DSS.
