3

I am in the process of getting PCI. I am in the last step in which I would need a secure PC on my internal network. All the scans I must run are only available through a plugin in browsers for Windows & Mac OS X (not for available for Linux which is the most secured). Anyway, I was trying almost all the Windows versions and I couldn't get PCI. Can Windows 8 get all the requirements to be PCI?

  • Which plugin are you trying to run? – SilverlightFox Jun 30 '15 at 14:28
  • It is a plugin called "iScan Online Browser Plugin" – ackuser Jul 1 '15 at 9:32
  • Yes, but sadly you have to breach PCI compliance to be secure because you cannot get a list of updates that could possibly be applied anymore. – Joshua Nov 4 '15 at 22:55
  • @Joshua you need to maintain a "software repository" host and configure your network to use that for system updates instead of whatever internet source they would normally use. – bbozo Jan 19 '17 at 12:55
2

If desktop computers are within scope of your PCI boundary then they will have to be subject to the same controls as any other device in scope. This means a number of controls on the configuration, AV and malware protection, security policy (password management controls), etc. as well as processes around usage need to be considered. There is nothing specific that I have found about Windows 8 that means it can't form part of a PCI compliant solution.

Are you concerned about any specific control or process or any specific scanner result?

Remember that if a specific scan plugin fails against a device there is also opportunity to put in place compensating controls (though this is normally a last resort).

  • Thanks for the comments. Well, in last step "PCI DSS Internal Scan" it is required between others ...Checks including: Verification of inactive accounts Account lock out Screen saver grace period checks Time limit for active but idle terminal services sessions Time limit for disconnected sessions Minimum password length Password complexity Passwords are not older than 90 days Password History Check And honestly, I have been trying in versions older than 8 and I would say is almost impossible to solve due to the scan or bugs on Windows, I don't know. But, I cannot get success at al – ackuser Jul 1 '15 at 10:32
0

Do not include desktop machines in your PCI DSS scope any way you can avoid it. If the desktop machine is within scope, then the place it is in is also within scope, keep your offices out of scope any way you can.

Use a jump host with 2 factor authentication to connect to you PCI scope, it should keep any desktop boxes out of your scope.

Another thing is, if you are certain your system is up to date with latest CVE patches, go through the scan results and see if you can dispute the findings one by one. Typically the scans just check the software version numbers (they don't really try to perform the exploit) and CVE fixes are often backported when you use LTS OS distributions leading to quite a few false positives.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.