5

Can a Linux environment be PCI compliant if the swap partition/file is not encrypted and PANs are loaded into RAM by an application?

  • 2
    As with most PCI questions I end up seeing on here this seems to be in another gray area. Requirement 3.4 of the PCI-DSS states that the PAN must be rendered unreadable anywhere it is stored (which I interpret as at rest). If the data is in the swap file it may be "resting" but it's not really being "stored" because it's only there temporarily. I would still disable the swap partition/file just to make sure it's not an issue. – JekwA Jul 29 '14 at 16:26
2

PCI compliance covers a lot of ground - anything that "stores", "processes" or "transmits" cardholder data.

Different systems need to have different parts of the standard applied to them to maintain a cohesive whole. Your system would fall into the "processes" category. Your needs would be different for storage, etc.

In the case you have outlined you can accomplish the protection of cardholder data written to disk in two distinct fashions. Either locking the pages holding cardholder data in RAM, encrypting the swap file, or both.

A third less desirable option is totally disabling the swap file.

As true as all this is you seem to be missing the big picture - PCI compliance doesn't come from just keeping the credit card information in RAM.

There are a lot of other things that you need to consider, even if you are only handling cardholder data in RAM. Central logging, HIDS, NIDS, etc.

  • 3
    I know and agree that there are other things but my question is specific to this issue now. – mic.sca Jul 29 '14 at 23:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.