15

PCI DSS 2.0 Requirement 5.1 states:

5.1 Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers).

This requirement (although I'm not 100% positive it is the only one) caused IT security team in our company to request all the workstations able to connect somehow to the production environment (and probably all the CHD servers) to have antivirus and firewall installed.

In my opinion if the workstation's or server's only OS is GNU/Linux (Debian Wheezy in this case) this requirement is somewhat bonkers. As far as I know the main purpose of AV software running on Linux distros is to detect Windows malware, not to mention that none of those tools offers "live" protection. The best protection you can get is scheduled scan (and, since requirement 5.1.1 that is quite a problem).

Moreover Firewalls are required on all workstations too (PCI DSS 1.4). The funny part is that while virtually all Linux installations have firewalls (iptables), virtually none of them have any rules.

Can you pass PCI DSS without installing antivirus on all linux workstations and servers?

Can you pass PCI DSS without installing additional firewalls or configuring iptables on all linux workstations?

ADDED: If the AV is needed, what about requirement 5.1.1?

5.1.1 Ensure that all anti-virus programs are capable of detecting, removing, and protecting against all known types of malicious software.

I don't think there is Linux AV able to do "live protection", as in scanning everything the user runs or is about to run. At least not compatible with recent kernels.

POST-CERTIFICATION UPDATE: Our company is now PCI DSS 3.0 certified and we did not have to install antivirus on every computer running GNU/Linux. We did not have to argue with the assessor, as they said straight away that AV is not required on Linux workstation in their opinion.

  • 4
    "Systems commonly affected by malicious software" is a way of saying "Microsoft Windows" without appearing partial or getting sued by Microsoft. – Mike Scott Mar 25 '15 at 20:48
  • 1
    The PCI requirement does use the qualifier "commonly affected". One can make arguments about what that means. I'm not at all surprised to hear that one assessor said that excludes Linux workstations; I wouldn't be surprised to hear of another assessor who said it didn't. But anyone thinking about that question should keep in mind a steady increase in non-Windows malware--especially malware used in more sophisticated & targeted attacks--is definitely underway. For example: pcworld.com/article/2881152/… – mostlyinformed Oct 7 '15 at 22:19
14

Can you pass PCI DSS without installing antivirus on all linux workstations and servers?

Yes, absolutely.

Can you pass PCI DSS without installing additional firewalls or configuring iptables on all linux workstations?

Yes, absolutely.

In both cases the PCI-DSS contains statements that allow you to make reasonable arguments as to the applicability (or not) of the requirement to specific systems.

  1. You must put AV on all "systems commonly affected by malicious software". If you don't want to put it on Linux, then you must make the case that your systems aren't affected by anything an AV package detects. And, obviously, if that Linux server is a Samba file server for hundreds of Windows clients, that's specious and you should do it anyway.
  2. DSS 1.4 doesn't say you need firewalls on all workstations, it says you need firewalls on all "mobile and/or employee-owned computers with direct connectivity to the Internet".

Now, @graham-hill correctly points out you'll need to convince other people of the truth of these things. Maybe those other people are your auditors, maybe those other people are your own coworkers. Maybe they're reasonable, and maybe they're not. Maybe it's easy, maybe it's hard. Read the requirements, document your case, make the argument, try to win... and realize that it's an unjust world and you may lose anyway.

  • Thank you for your answer. Did you manage to pull that off yourself or know such a case by any chance? – OhJeez May 20 '14 at 16:56
  • 3
    It accurately describes my company and several others I know to be PCI compliant. In particular, our auditor tried to push the AV-on-Linux issue last year, and cited some web site about the number of viruses detected by different software where the Linux AV packages were pretty high on the list. I pointed out that was because mail gateway AV and file server AV have high detections but that it meant nothing about Linux systems not being used as servers for Windows files, and in the end he accepted our interpretation. – gowenfawr May 20 '14 at 17:00
  • Thank you for sharing your experience. We are kind of short on time here, but I will try to push it if auditor turns out to be reasonable. – OhJeez May 20 '14 at 17:05
  • 1
    As a QSA I wouldn't consider linux to fall into the commonly affected category (AV NOT required). But each QSA is different. You just need to make a decision and then be prepared to back it up with evidence. The firewall issue is for devices that don't constantly reside on the corp network and protected by its resources, so they get the extra layer by requiring a host firewall. – Timee May 22 '14 at 16:19
  • @gowenfawr - What do you mean by "that it meant nothing about Linux systems not being used as servers for Windows files"? – Motivated Jan 18 at 18:06
2

No-one cares what you think.

Sorry, know you're a lovely person and all. But I'm afraid they really don't care. Your organisation wants to be compliant with PCI-DSS; they have assigned the IT security team to implement this; that team has given you instructions. Follow them.

BTW, the IT team know that AV software on Linux will do very little for it. They don't care. Their job is to get the organisation compliant with PCI-DSS. They have interpreted that as meaning deploying AV on everything. There's maybe enough room in the standard to wriggle your computer out of the requirement, but that means documenting an exception, and being able to back it up in an audit, and getting sign-offs from senior management, and carrying the can if something goes wrong and PCI say you were not in compliance. Why should they do that for you? Your business case for not having it is "you're all bonkers".

BTBTW, PCI-DSS also know that AV software on Linux will do very little for it. They don't care either. PCI-DSS is long and involved as it is. If they put a big complicated matrix of exactly what machines need AV and what ones don't it will confuse people and break the minute it gets in the real world and someone turns up running BeOS. Besides, they don't know anything about your organisation. With all standards there is always conflict between precision and flexibility; you have to draw a line somewhere.

  • 2
    This is not answer to my question. I did not ask "how to submit to nonsense PCI requirements". To put some context: - we are a small company. - we are in process of getting ready for certification. - I'm myself partially responsible for getting DSS, only in the "programming" part, not the "IT". - I'm working with the IT team, not against them. - From my job title, I'm the senior management (not that there is a lot management lower, again small company) – OhJeez May 20 '14 at 15:59
  • The questions posed are not answered by this response. – Chris Betti Aug 4 '14 at 3:12
  • This is a woefully ineffective approach. Security that dictates to the business is an (deservedly) endangered species. – Alain O'Dea Jan 14 '16 at 19:27
  • AV has serious negative impact on production systems in my experience and deploying it to tick boxes is a terrible approach that destroys shareholder value. – Alain O'Dea Jan 14 '16 at 19:28
1

With regards to Anti Virus malware that effects Linux servers is more commonly rootkits. Therefore CHKRootkit and RKHunter should be deployed to fill this Anti Virus requirement I believe. This was accepted by our auditors.

Not having protection to detect changes for Netstat or Top and similar applications is ill advised. Not just from a PCI-DSS requirement but general best practice in systems security implementation. Something like the Samhain daemon can periodically notify you of changes in the hashes of such applications and you could create a script to have rkhunter run in the background if such a change was detected.

Another thing that has been mentioned already is that if the server is for file storage or e-mail then implementing ClamAV to scan the incoming mail or samba shares can also be used. Think you may have got lucky with that auditor I have worked in many companies that simply would not just let me dismiss this one. So that is how other members of the operations team and myself managed get around it.

Good Luck!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.