A former employer of mine has reached out to me to assist them with PCI certification (I guess I'll be getting a 1099-NEC from them next year as a result). Here's the point I'm at in the questionnaire:
File-integrity monitoring tools are deployed within the cardholder data environment to detect unauthorized modification of critical system files, configuration files, or content files.
This is a Yes / No / Not Applicable question.
The next question is as follows:
The file-integrity monitoring tools are configured to alert personnel to unauthorized modification of critical system files, configuration files or content files, and the tools perform critical file comparisons at least weekly.
This is another Yes / No / Not Applicable question.
I'm not sure how to answer this or what could be done to put this company into compliance.
Credit card info is stored in the DB, encrypted with AES-128-CBC. Customers are charged monthly and every day an employee goes to a website that was built in-house by this company where the charges can be reviewed and then processed. The website is hosted on a Docker container that's managed through Amazon ECS. Git is used to manage the source code. When a deployment through Bamboo is made the Docker container gets destroyed and relaunched.
Between deployments I suppose some third party tool could be utilized to check the Docker containers for "unauthorized modification of critical system files" but idk what third party tools could be used to do that.
I guess the Git repo could be compromised, as well. If someone got my credentials they could make a commit to the repo and make an "unauthorized modification". idk how I'm supposed to protect against that...
Anyway, like I said, idk how to answer these questions. Any ideas?
(and yes, I'm aware that having a recurring payment through stripe.com or authorize.net would probably be better as it wouldn't require payment information be stored but I'm not being paid to do a complete rewrite of their system either; if a rewrite is the only way to for sure do this then I'll propose that but I'll have to make a very strong case that there exists no other viable option)