Tools to demonstrate NO storage of cardholder data

Question

Our organization has been asked to comply with PCI DSS.

As part of IT Department, we need to demonstrate that none of our IT infrastructure stores any carhdolder data nor sensitive authetication data. That is like 7 types of data (i.e PAN, cardholder name, service code, expiration date, full magnetic stripe, validation code, PIN) We have tried some tools that search files and helps us to identify PANs, but none of them identify patterns for the rest of the data types such as service code, full magnetic stripe or validation code which are sensitive data and according to PCI should not be stored whatsoever. How could we perform a similar scanning in a database?

What would be the best technical way to demonstrate we don't store any of that data?

Answer 1

As one comment above says, you're trying to prove a negative and that's quite difficult! Using tools which search for regular expressions are useful but they often return many false positives and are unable to search many file types. As a result, the use of a tool should be a single tool within your arsenal.

You can review what systems and application handle cardholder data and look at log files, error files, database tables and verify cardholder data is not present. If you used to have cardholder data, you could review the legacy storage locations and verify any purges have been successful and that backup media has been over-written or destroyed.

The PCI DSS scope states that the PAN is the defining factor for cardholder data. If you have a cardholder name or expiration date and no PAN, there's no issue.

Answer 2

The most common way to prove cardholder data isn't on a system is to use a tool to scan that system for cardholder data such as ccsrch.

Acording to the PCI DSS

Cardholder Data: At a minimum, cardholder data consists of the full PAN. 
Cardholder data may also appear in the form of the full PAN plus any of the following:
cardholder name, expiration date and/or service code See Sensitive Authentication Data
for additional data elements that may be transmitted or processed (but not stored) as
part of a payment transaction.

The key word here being PLUS any of the following: cardholder name, expiration date ect... If you can prove PANs don't exist then cardholder names and expiration dates aren't necessarily cardholder data. The CVV code should still never be stored ever, but proving that every 3 or 4 digit number is or isn't a CVV is impossible so this comes down to data flows and ensuring these things aren't stored. It would be best to ask your auditor how they'd like you to prove the non existence of cardholder data and on which systems they need proof for.

The Spider tool from Cornell used to be quite popular but I believe they charge for it now.

You can find a blog post with other options HERE (thanks google).

Answer 3

One of the items that the DSS requires is a diagram showing the flow of PCI data through the system and network. When I have been asked to prove this negative, I have shown the questioner the code architecture, which also shows the data objects, the paths they use, and where the data is stored/removed. I follow up with showing the systems that the data passes through and perform an examination for CC numbers on a statistically relevant sample (log files, both application and system).

As explained above, I am not proving a negative, but by going through these steps, and having the proper documentation available, the questioner seems to be more accepting of the fact that our processes do not require the storage of the PAN and that is implemented within code.