18

PCI DSS 2.0 Requirement 5.1 states:

5.1 Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers).

This requirement (although I'm not 100% positive it is the only one) caused IT security team in our company to request all the workstations able to connect somehow to the production environment (and probably all the CHD servers) to have antivirus and firewall installed.

In my opinion if the workstation's or server's only OS is GNU/Linux (Debian Wheezy in this case) this requirement is somewhat bonkers. As far as I know the main purpose of AV software running on Linux distros is to detect Windows malware, not to mention that none of those tools offers "live" protection. The best protection you can get is scheduled scan (and, since requirement 5.1.1 that is quite a problem).

Moreover Firewalls are required on all workstations too (PCI DSS 1.4). The funny part is that while virtually all Linux installations have firewalls (iptables), virtually none of them have any rules.

Can you pass PCI DSS without installing antivirus on all linux workstations and servers?

Can you pass PCI DSS without installing additional firewalls or configuring iptables on all linux workstations?

ADDED: If the AV is needed, what about requirement 5.1.1?

5.1.1 Ensure that all anti-virus programs are capable of detecting, removing, and protecting against all known types of malicious software.

I don't think there is Linux AV able to do "live protection", as in scanning everything the user runs or is about to run. At least not compatible with recent kernels.

POST-CERTIFICATION UPDATE: Our company is now PCI DSS 3.0 certified and we did not have to install antivirus on every computer running GNU/Linux. We did not have to argue with the assessor, as they said straight away that AV is not required on Linux workstation in their opinion.

Improve this question
3
  • 5
    "Systems commonly affected by malicious software" is a way of saying "Microsoft Windows" without appearing partial or getting sued by Microsoft.
    – Mike Scott
    Commented Mar 25, 2015 at 20:48
  • 1
    The PCI requirement does use the qualifier "commonly affected". One can make arguments about what that means. I'm not at all surprised to hear that one assessor said that excludes Linux workstations; I wouldn't be surprised to hear of another assessor who said it didn't. But anyone thinking about that question should keep in mind a steady increase in non-Windows malware--especially malware used in more sophisticated & targeted attacks--is definitely underway. For example: pcworld.com/article/2881152/…
    – mostlyinformed
    Commented Oct 7, 2015 at 22:19
  • It is mostly about paper. So give them... what they want. Give them the paper. Install any antivirus software, what you like, for example clamav. Fill out the formulas, and sign them. So will be everything ok... on the paper. In their heads, still nothing will be okay, but you can't fix that with papers. You can do that "live protection" by running it from a cron script, or from incron. Sense, that it won't have, but so is it. Btw, wheezy is f*g old! We are 3 releases later now! It doesn't even get security patches, that is the problem and not the lack of the AV!
    – peterh
    Commented Aug 10, 2019 at 1:01

2 Answers 2

Reset to default
15

Can you pass PCI DSS without installing antivirus on all linux workstations and servers?

Yes, absolutely.

Can you pass PCI DSS without installing additional firewalls or configuring iptables on all linux workstations?

Yes, absolutely.

In both cases the PCI-DSS contains statements that allow you to make reasonable arguments as to the applicability (or not) of the requirement to specific systems.

  1. You must put AV on all "systems commonly affected by malicious software". If you don't want to put it on Linux, then you must make the case that your systems aren't affected by anything an AV package detects. And, obviously, if that Linux server is a Samba file server for hundreds of Windows clients, that's specious and you should do it anyway.
  2. DSS 1.4 doesn't say you need firewalls on all workstations, it says you need firewalls on all "mobile and/or employee-owned computers with direct connectivity to the Internet".

Now, @graham-hill correctly points out you'll need to convince other people of the truth of these things. Maybe those other people are your auditors, maybe those other people are your own coworkers. Maybe they're reasonable, and maybe they're not. Maybe it's easy, maybe it's hard. Read the requirements, document your case, make the argument, try to win... and realize that it's an unjust world and you may lose anyway.

Improve this answer
11
  • Thank you for your answer. Did you manage to pull that off yourself or know such a case by any chance?
    – OhJeez
    Commented May 20, 2014 at 16:56
  • 3
    It accurately describes my company and several others I know to be PCI compliant. In particular, our auditor tried to push the AV-on-Linux issue last year, and cited some web site about the number of viruses detected by different software where the Linux AV packages were pretty high on the list. I pointed out that was because mail gateway AV and file server AV have high detections but that it meant nothing about Linux systems not being used as servers for Windows files, and in the end he accepted our interpretation.
    – gowenfawr
    Commented May 20, 2014 at 17:00
  • Thank you for sharing your experience. We are kind of short on time here, but I will try to push it if auditor turns out to be reasonable.
    – OhJeez
    Commented May 20, 2014 at 17:05
  • 1
    As a QSA I wouldn't consider linux to fall into the commonly affected category (AV NOT required). But each QSA is different. You just need to make a decision and then be prepared to back it up with evidence. The firewall issue is for devices that don't constantly reside on the corp network and protected by its resources, so they get the extra layer by requiring a host firewall.
    – Timee
    Commented May 22, 2014 at 16:19
  • @gowenfawr - What do you mean by "that it meant nothing about Linux systems not being used as servers for Windows files"?
    – Motivated
    Commented Jan 18, 2019 at 18:06
1

With regards to Anti Virus malware that effects Linux servers is more commonly rootkits. Therefore CHKRootkit and RKHunter should be deployed to fill this Anti Virus requirement I believe. This was accepted by our auditors.

Not having protection to detect changes for Netstat or Top and similar applications is ill advised. Not just from a PCI-DSS requirement but general best practice in systems security implementation. Something like the Samhain daemon can periodically notify you of changes in the hashes of such applications and you could create a script to have rkhunter run in the background if such a change was detected.

Another thing that has been mentioned already is that if the server is for file storage or e-mail then implementing ClamAV to scan the incoming mail or samba shares can also be used. Think you may have got lucky with that auditor I have worked in many companies that simply would not just let me dismiss this one. So that is how other members of the operations team and myself managed get around it.

Good Luck!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .