file-integrity monitoring tools for PCI compliance

Question

A former employer of mine has reached out to me to assist them with PCI certification (I guess I'll be getting a 1099-NEC from them next year as a result). Here's the point I'm at in the questionnaire:

File-integrity monitoring tools are deployed within the cardholder data environment to detect unauthorized modification of critical system files, configuration files, or content files.

This is a Yes / No / Not Applicable question.

The next question is as follows:

The file-integrity monitoring tools are configured to alert personnel to unauthorized modification of critical system files, configuration files or content files, and the tools perform critical file comparisons at least weekly.

This is another Yes / No / Not Applicable question.

I'm not sure how to answer this or what could be done to put this company into compliance.

Credit card info is stored in the DB, encrypted with AES-128-CBC. Customers are charged monthly and every day an employee goes to a website that was built in-house by this company where the charges can be reviewed and then processed. The website is hosted on a Docker container that's managed through Amazon ECS. Git is used to manage the source code. When a deployment through Bamboo is made the Docker container gets destroyed and relaunched.

Between deployments I suppose some third party tool could be utilized to check the Docker containers for "unauthorized modification of critical system files" but idk what third party tools could be used to do that.

I guess the Git repo could be compromised, as well. If someone got my credentials they could make a commit to the repo and make an "unauthorized modification". idk how I'm supposed to protect against that...

Anyway, like I said, idk how to answer these questions. Any ideas?

(and yes, I'm aware that having a recurring payment through stripe.com or authorize.net would probably be better as it wouldn't require payment information be stored but I'm not being paid to do a complete rewrite of their system either; if a rewrite is the only way to for sure do this then I'll propose that but I'll have to make a very strong case that there exists no other viable option)

Answer 1

An important part of the considerations for this, will be whether the Docker container is running in ECS "classic" or in Fargate. If you're using Fargate then there's no possibility (AFAIK) of deploying file monitoring tools outside the container itself, as you have no access to the underlying VM.

With ECS Classic, you could use something like falco on the host and it would provide alerts on events on the host. I'm not sure if there's pre-built rules for this but it would be possible to write them.

Another option (which may allow you to check the "not applicable" piece) would be to set the container root filesystem as read-only. At that point it wouldn't be possible for the attacker to change files in the container, and you could just do VM level FIM for the underlying EC2 instances (assuming you're not doing Fargate)

For the git piece, if that's in-scope, you could perhaps look at using signed commits which would essentially stop someone from modifying the contents of the repository, unless they've also compromised the signing keys.