How to satisfy requirement 10.6 of PCI DSS?

Question

The company I'm working for is applying for PCI compliance and I'm in charge of writing most of the required procedures and policies. The problem is that I don't have any experience with IT security, so most of what's written on the PCI DSS doesn't make much sense to me. To keep the scope of this question small enough, let's focus on the requirement 10.6:

Review logs for all system components at least daily. Log reviews must include those servers that perform security functions like intrusion-detection system (IDS) and authentication, authorization, and accounting protocol (AAA) servers (for example, RADIUS).

And the corresponding testing procedures:

10.6.a Obtain and examine security policies and procedures to verify that they include procedures to review security logs at least daily and that follow-up to exceptions is required. 

10.6.b Through observation and interviews, verify that regular log reviews are performed for all system components.

• What does it mean, exactly, to review logs?
• What constitutes an exception?
• What do companies usually do in case of exceptions?

Answer 1

First, it's best to install a utility like splunk that brings all your logs together in one place fort review. Your system logs, your error logs, your application logs, your W3 logs, your AV logs, your firewall logs, etc. You would also be well-advised to start a new type of log of all your daily log reviews where you log each day's log review to its own log. You need proof that you are doing a daily review of all your logs.

Look for events like software install failure or successes (yikes!) that you did not initiate. Attacks revealed by your AV or firewall logs that show you what areas you need to strengthen your security. If you have a log entry of a successful software install or update, you need to note in your own log that the event was authorized and occurred under your supervision (so your PCI-DSS QA is reassured that you noted the event and that it occurred under your control).

Start thinking along those lines (and many others) and you have the right idea.

Answer 2

Reviewing logs essentially means to read through them and look for anything that might constitute an attack or security risk. In general you're looking for anything unusual. You might use various log filtering tools to aid you in this activity, or prioritise your events by severity if you're looking at IDS logs.

An exception, in this context, is any log that falls outside the normal pattern of activity. What they're saying is that you can't just review logs and then do nothing about your findings - you must follow up on any unusual traffic, and do some investigation into the source and cause. If your investigation into an exception turns up something meaningful, you also need to act on it. Normally this involves documenting the event and proposing a mitigation.

Essentially the point of this is to ensure that you are actively monitoring any potential intrusion attempts.

As an example, let's say you've got an IDS that sits on the perimiter of your DMZ. In order to comply with PCI-DSS 10.6.a, you must read through any logs and alerts at least daily, and investigate the source of them. You might find that a device performed a port scan, which you would have to document, and do some research into where it came from. If you identify that the device is not on your assets list, you might decide to add a firewall rule to block it. Keep in mind, though, that this is just one example - PCI DSS leaves this intentionally vague in order to cover all kinds of events and logs.