4

I have been hearing a lot of good things about EventStore 3 and am looking to upgrade my server event forwarding systems for PCI compliance next year and was wondering if anyone had looked at the possible uses of EventStore in a PCI logging scenario.

Any feed back would be greatly appreciated.

(repost from https://stackoverflow.com/questions/8246223/using-eventstore-for-pci-compliance)

Improve this question
4
  • Can you provide a link or describe what EventStore 3 is?
    – Steve
    Nov 23, 2011 at 22:03
  • 2
    Can you provide any of your selection criteria, or identify which specific sections of PCI-DSS you need to be audited on.
    – david6
    Nov 24, 2011 at 8:32
  • I need to be compliant with SAQ D
    – MvcCmsJon
    Dec 13, 2011 at 22:54
  • 1
    The audit requirements are not onerous: you merely have to maintain integrity through any/some of several means. If you can produce evidence to show that EventStore maintains integrity of the logging information while it is being transmitted, then it shouldn't be a problem. If you log sensitive information, do review section 3.4. If you are a service provider, then review section A.1. If in doubt, check with your QSA.
    – logicalscope
    Dec 14, 2011 at 18:18

1 Answer 1

Reset to default
2

If you thinking about PCI compliancy, you should take note of Section 6.6; at it widely considered to be one of the hardest (if not THE hardest) term for the compliancy.
The section calls for one of the following:

  • Reviewing public-facing web applications via manual or automated application vulnerability security assessment tools or methods, at least annually and after any changes
  • Installing a web-application firewall in front of public-facing web applications

(for more info on 6.6 read this : http://www.scmagazine.com/deconstructing-pci-66/article/110013/)

EvenStore by itself can not fill this requirement. Having said that, I`ve yet to see one application/service to provide full PCI compliancy - this is just not possible.

What you need is to combine several solutions to answer several sets of requirements.

For 6.6 I would suggest Imperva Cloud WAF as, currently, it's the only one that comes with full PCI DDS compliancy.

(for more info visit: http://www.businesswire.com/news/home/20120216005411/en/Incapsula-Teams-PCI-Compliance-Security-Service-Providers)

Why choose Cloud?

Well, because this is a "plug-and-play" solution that can be added to any platform. More over, due to "economy of scale" effect made possible with Cloud technology, the price tag drops from several thousands (setup fees) to several dozen dollars a month.

As my first link explains, this not the only way to deal with 6.6 but I think it`s the best one.

Improve this answer
1
  • Any idea how much Imperva Cloud WAF could cost? what range are we looking at?
    – Nimbuz
    Dec 10, 2012 at 16:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .