Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have been hearing a lot of good things about EventStore 3 and am looking to upgrade my server event forwarding systems for PCI compliance next year and was wondering if anyone had looked at the possible uses of EventStore in a PCI logging scenario.

Any feed back would be greatly appreciated.

(repost from http://stackoverflow.com/questions/8246223/using-eventstore-for-pci-compliance)

share|improve this question
    
Can you provide a link or describe what EventStore 3 is? –  Steve Nov 23 '11 at 22:03
2  
Can you provide any of your selection criteria, or identify which specific sections of PCI-DSS you need to be audited on. –  david6 Nov 24 '11 at 8:32
    
I need to be compliant with SAQ D –  MvcCmsJon Dec 13 '11 at 22:54
1  
The audit requirements are not onerous: you merely have to maintain integrity through any/some of several means. If you can produce evidence to show that EventStore maintains integrity of the logging information while it is being transmitted, then it shouldn't be a problem. If you log sensitive information, do review section 3.4. If you are a service provider, then review section A.1. If in doubt, check with your QSA. –  logicalscope Dec 14 '11 at 18:18
add comment

1 Answer

If you thinking about PCI compliancy, you should take note of Section 6.6; at it widely considered to be one of the hardest (if not THE hardest) term for the compliancy.
The section calls for one of the following:

  • Reviewing public-facing web applications via manual or automated application vulnerability security assessment tools or methods, at least annually and after any changes
  • Installing a web-application firewall in front of public-facing web applications

(for more info on 6.6 read this : http://www.scmagazine.com/deconstructing-pci-66/article/110013/)

EvenStore by itself can not fill this requirement. Having said that, I`ve yet to see one application/service to provide full PCI compliancy - this is just not possible.

What you need is to combine several solutions to answer several sets of requirements.

For 6.6 I would suggest Imperva Cloud WAF as, currently, it's the only one that comes with full PCI DDS compliancy.

(for more info visit: http://www.businesswire.com/news/home/20120216005411/en/Incapsula-Teams-PCI-Compliance-Security-Service-Providers)

Why choose Cloud?

Well, because this is a "plug-and-play" solution that can be added to any platform. More over, due to "economy of scale" effect made possible with Cloud technology, the price tag drops from several thousands (setup fees) to several dozen dollars a month.

As my first link explains, this not the only way to deal with 6.6 but I think it`s the best one.

share|improve this answer
    
Any idea how much Imperva Cloud WAF could cost? what range are we looking at? –  Nimbuz Dec 10 '12 at 16:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.