2

I administer a few hundred servers and am going through a yearly PCI audit. This time around we need to prove that we've got anti-virus protection on our "systems commonly affected by malicious software (particularly personal computers and servers)"

The systems I work on consist of several intermediate hosts (all in PCI scope) and far-end servers (also in PCI scope) that function as glorified VPNs.

So I'd say I have 3 classes of Linux servers and 2 classes of Windows servers

  • Linux Servers used as bastions
  • Linux Servers deployed from proprietary companies as appliances
  • Linux Servers used purely for routing traffic
  • Windows Servers used as bastions
  • Windows Servers with proprietary software on them used as appliances

Of the five classes of servers, what arguments can I make (or steps can I take) to say that some (particularly the Linux Servers used as appliances and used for routing traffic) don't fit the requirement for being ones that require anti-virus installed on them.

Note, I'm not trying to skirt the security, some of these hosts are very lightweight (1 cpu, 192 MB RAM) and buckle under virus scanning and they're not all managed in the same platform to benefit from hypervisor level scanning and they're already locked down to prohibit outbound connections to all but a handful of Internet sites. I deployed a Clam AV server as a good faith attempt to meet the requirement, but found the machines ran out of gas very quickly.

Improve this question

1 Answer 1

Reset to default
1

Being very general here, a server is generally where you install an OS on commodity hardware (or as a Virtual Machine) whereas an appliance is on proprietary hardware (e.g. physical switch etc).

While you're using each of the systems to mimic what an appliance would do, all five would be considered servers.

In terms of 'commonly affected by malicious software', Windows must have AV installed. You can consider going risk based on the Linux systems using controls such as : minimal system install, extensive hardening, file integrity monitoring (to identify newly introduced software), logging, host-based IDS (such as OSSEC) with alerting, increasing internal vulnerability scan frequency etc.

Improve this answer
1
  • That's sensible from a security perspective, but for PCI DSS compliance you have to decide whether you're: a) Claiming Linux is not 'commonly affected', so no need for AV but that decision needs annual reevaluation per req. 5.1.2, OR b) It is commonly affected but you're not installing AV because of a legitimate technical constraint so will adopt documented compensating controls. Given recent reports, I suspect b) would be the prudent choice.
    – withoutfire
    Commented Apr 20, 2020 at 8:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .