In this article
Purpose
This document establishes a formal standard for management of default vendor settings and configurations of systems, firewalls, and routers within Cardholder Data Environments (CDE) and outlines the related requirements specified in the Payment Card Industry Data Security Standards (PCI DSS) that must be implemented into all UMD network infrastructures that are processing cardholder data.
Additional authority
The following standards help guide the content of this document: Payment Card Industry Data Security Standard - Requirement 2.
Scope
This standard applies to all UMD IT elements that are attached to a Cardholder Data Environment (CDE) network. All systems processing cardholder data full Primary Account Number (PAN) or full PAN plus any of the following: cardholder name, expiration date, service code, information from magnetic strip or card chip, and/or Personal Identification Number (PIN) must only be connected to a designated CDE network.
Standard
System components used in sensitive networks often will come with default vendor settings such as usernames, passwords, and configurations. Default parameters for many systems can be found with a web search. Always change vendor-supplied defaults for system passwords. Carefully consider each default parameter before systems are installed in the CDE.
NOTE: As a general rule, every PCI Standard should be reviewed annually and updated as needed to reflect changes to business objectives or the risk environment.
Requirements
- Always change vendor-supplied defaults and remove or disable unnecessary default accounts before installing a system (e.g. servers, desktops, point-of-sale devices, firewalls, and network devices) on the CDE network. Change default passwords adhering to the USM Security Standards.
- Develop secure configurations for the systems in the CDE that address known vulnerabilities. Update the configuration as new vulnerabilities are identified. Encrypt all non-console administrative access. Do not use deprecated protocols such as SSL or early versions of TLS.
- Build and maintain an inventory of system components that are in scope for PCI/DSS.
- Disseminate security standards and operational procedures to ensure vendor defaults and other security parameters are continuously managed to prevent insecure configurations.
- Shared hosting environments must protect each entity's hosted environment and data.