WINDOWS XP: IMPLEMENTING COMPENSATING CONTROLS FOR PCI COMPLIANCE. Comprise Technologies, Inc Route 36, P O BOX 425 Navesink, NJ 07752

Transcription

1 WINDOWS XP: IMPLEMENTING COMPENSATING CONTROLS FOR PCI COMPLIANCE Cmprise Technlgies, Inc Rute 36, P O BOX 425 Navesink, NJ CSS_112 Technical Supprt: Sales:

2 TABLE OF CONTENTS Table f Cntents... 2 IMPORTANT NOTICES... 3 PCI Disclaimer... 3 Windws XP: End f Supprt... 3 Cmpensating Cntrls:... 4 Remve/Disable Unnecessary Services & Applicatins... 5 Hw t Disable a Service n Windws XP:... 5 Setup and Maintain McAfee Windws Embedded Cntrl... 8 Installing the McAfee Client... 8 Reviewing McAfee Slidifier Lgs Enable McAfee Slidifier Cnfigure a Lcal Firewall (Windws Firewall) Enable Windws Firewall Cnfiguring Windws Firewall Manage/Review Firewall Lgs Cnfigure Firewall Lgging Dcumentatin Windws XP Security Lgging Setting up Security Lgging TIP: Reading the lg file Viewing the ICF lg file in Micrsft Excel Using Micrsft Excel t imprt the lg file ICMP Optins Overview f ICMP

3 IMPORTANT NOTICES This dcument is intended fr the use f Cmprise Technlgies, Inc. custmers. It is cnfidential and may nt be disclsed t ther than the intended party withut the written permissin f Cmprise. Cmprise pursues a plicy f nging prduct develpment. Release prduct may vary frm descriptin herein. Cmprise reserves the right t mdify and r discntinue prduct features at any time withut advanced ntice. PCI DISCLAIMER The PCI Cuncil has directed that nly a Qualified Security Assessr (QSA) can validate cmpliance with the PCI Data Security Standard. Cmprise is nt a QSA and therefre ffers n pinin, r makes any assurance, that the infrmatin in this guide satisfies PCI requirements. Similarly, n emplyee f Cmprise is authrized t express any pinin r make any assurance that yur implementatin f cmpensating cntrls is sufficient t satisfy PCI requirements. Check with yur QSA if yu have any questins; Cmprise will prvide access t a QSA at yur request. WINDOWS XP: END OF SUPPORT As f 8 April 2014, Micrsft will stp prviding supprt fr its Windws XP perating system (OS). Security updates and patches will n lnger be available, s sme actin must be taken in rder t meet the PCI requirements fr an unsupprted perating system. PCI DSS Requirements 6.1 and 6.2 address the need t keep systems up t date with vendr supplied security patches in rder t prtect systems frm knwn vulnerabilities. Where perating systems are n lnger supprted by the vendr, OEM r develper, security patches might nt be available t prtect the systems frm knwn explits, and these requirements wuld nt be able t be met. Hwever, it is pssible t implement cmpensating cntrls t address risks psed by using unsupprted perating systems in rder t meet the intent f the requirements. T be effective, the cmpensating cntrls must prtect the system frm vulnerabilities that may lead t explit f the unsupprted cde. After numerus discussins invlving ur Internal Security Assessr, Diva Wicks, and the independent Qualified Security Assessr that validated ur PA DSS, Calfire Systems, Cmprise has prepared a set f Cmpensating Cntrls which will assist in maintaining PCI cmpliance. But mre imprtantly, these cntrls will help secure credit card hlder data. This is accmplished by handling tw main aspects f securing card hlder data. 1. Prtect the device frm unwanted entities which can attempt t steal card hlder data. 2. Prtect card hlder data during transmissin Cmprise has prepared a list f cmpensating cntrls which address the abve tw aspects f securing card hlder data. It is imprtant t fllw these guidelines t Maintain PCI cmpliance and secure credit card hlder data, during the absence f supprt fr Windws XP. 3

4 COMPENSATING CONTROLS: 1. Cnfigure XP such that the OS is lcked dwn remving r disabling unnecessary service, applicatins, etc. 2. Install and maintain Anti virus n the Kisk. 3. Cnfigure Lcal Firewall n Kisk t allw nly prts necessary fr the functinality n the Kisk. 4. Setup and maintain McAfee Applicatin cntrl. 5. Rutinely review Lgs available n the Kisk fr questinable behavir. i.e. antivirus turned ff, firewall turned ff, etc. The use f cmpensating cntrls shuld be cnsidered a temprary slutin nly, as the eventual slutin is t migrate t a supprted system, and the entity shuld have an active migratin plan fr ding s. Fr assistance with cmpensating cntrls, and fr questins abut whether a specific implementatin meets PCI DSS requirements, please cntact a Qualified Security Assessr. 4

5 REMOVE/DISABLE UNNECESSARY SERVICES & APPLICATIONS Having unnecessary services running n yur cmputer can make yu vulnerable t attacks frm hackers, viruses, and all srts f malware. As a best practice, yu shuld disable any services that are nt required fr yur PC t functin. HOW TO DISABLE A SERVICE ON WINDOWS XP: 1) G t Start Cntrl Panel. 2) Select Administrative Tls. 3) Open Services. 5

6 4) Right click n a service that yu want t disable. 5) Select Prperties. 6) Stp the service. Then set it t Disabled. 6

7 7) Apply. Then OK. 8) Rebt the PC when yu are finished. Here is a list f knwn Windws XP services that can be safely disabled, withut affecting verall OS functinality: Alerter Applicatin Layer Gateway Service Autmatic Updates Backgrund Intelligent Transfer Service ClipBk Cmputer Brwser Distributed Transactin Crdinatr Errr Reprting Service Help and Supprt Indexing Service IMAPI CD Burning COM Service Messenger Net Lgn Net.Tcp Prt Sharing Service NetMeeting Remte Desktp Sharing Netwrk DDE Netwrk DDE DSDM Remte Desktp Help Sessin Manager Remte Registry Ruting and Remte Access Telnet Terminal Services Themes Uninterruptible Pwer Supply Universal Plug and Play Device Hst Wireless Zer Cnfiguratin IMPORTANT: This list is nt intended t be a defined set f services t be disabled in rder t meet PCI requirements. Yur equipment may have mre services that shuld be evaluated by yu based upn yur use f the equipment. Please cntact Cmprise t discuss any ther specific services that yu might want t disable; we will test them fr cnflict and advise yu f the results. 7

8 SETUP AND MAINTAIN MCAFEE WINDOWS EMBEDDED CONTROL Fr custmers pursuing cmpensating cntrls, Cmprise will be prviding a prduct called McAfee Embedded Cntrl. McAfee Embedded Cntrl maintains the integrity f yur system by nly allwing authrized cde t run and nly authrized changes t be made. It autmatically creates a dynamic whitelist f the authrized cde n the embedded system. Once the whitelist is created and enabled, the system is lcked dwn t the knwn gd baseline, n prgram r cde utside the authrized set can run, and n unauthrized changes can be made. INSTALLING THE MCAFEE CLIENT 1) Dwnlad the McAfee Slidifier fr Windws Installer t yur Windws XP cmputer. 2) Duble click the installer file t launch. setup win xp x exe 3) The Preparing t Install screen appears. After the installatin preparatin is ver, the Welcme screen appears: 8

9 Click Next > t cntinue. 4) The License Agreement screen appears: Click I accept the terms in the license agreement radi buttn t accept the terms f the license agreement. Click Next > t cntinue. 9

10 5) The Custmer Infrmatin screen appears: Prvide the User Name, Organizatin (Library) name, and Serial Number. Click Next > t cntinue. 6) The Destinatin Flder screen appears: By default, the installer installs Slidifier fr Windws in the C:\Prgram Files\McAfee\Slidcre flder. Yu can accept the default installatin flder and cntinue. T specify a different lcatin, click Change... In the dialg bx that appears, yu can specify a flder path name (up t 240 characters nly) in case Slidifier is t be installed at a lcatin ther than the default lcatin. A Desktp Shrtcut fr McAfee Slidifier Cmmand Line is created by default. Uncheck Create Desktp Shrtcut if yu d nt want the Installer t create this Desktp shrtcut. Click Next > t cntinue. 10

11 7) The Ready t Install the Prgram screen appears: Finally, click Install t begin the installatin. 11

12 8) After successful installatin, the fllwing screen appears infrming that the installatin is cmplete. 9) Click Finish t exit the wizard. McAfee Slidifier is nw successfully installed. REVIEWING MCAFEE SOLIDIFIER LOGS Slidifier generates its wn lg (slidicre.lg) and Slidifier specific event lgs are als written t the system lgs. T view the event lgs generated by Slidifier in the system lgs, click at Start > Prgrams > Administrative Tls > Event Viewer > Applicatin menu ptin. 12

13 ENABLE MCAFEE SOLIDIFIER On yur desktp, yu shuld see a shrtcut fr McAfee Slidifier Cmmand Line 1) Open the McAfee Slidifier Cmmand Line utility. 2) At the prmpt, enter sadmin slidify Press Enter. 3) Once the Slidifying vlume C: is cmplete, enter sadmin enable Press Enter. 4) Rebt PC. 13

14 CONFIGURE A LOCAL FIREWALL (WINDOWS FIREWALL) Windws Firewall must be cnfigured n the Windws XP Kisk t allw nly prts necessary fr the functinality f the Kisk. ENABLE WINDOWS FIREWALL 1) G t Start Cntrl Panel. 2) Duble click n Windws Firewall: 3) Select On 14

15 Click OK. CONFIGURING WINDOWS FIREWALL Add exceptins fr applicatins and prts required t run. 1) Open Windws Firewall and select the Exceptins tab. 15

16 2) Select Add Prgram 3) Brwse t C:\Sam and add the fllwing files: APMKisk.exe KiskStarter.exe 16

17 4) Highlight the file name n the Add a Prgram list and click OK t save the changes. (Yu must d this fr each prgram/file) 5) Yu must als add yur Anti Virus prduct as an exceptin. In this case, it is Micrsft Security Essentials: 17

18 6) Yu must als add the McAfee prduct as a firewall exceptin. The default installatin path wuld be: C:\Prgram Files\McAfee\Slidcre Add scsrvc.exe Add sadmin.exe 18

19 7) Click n Add a Prt. 8) We will need t add at least tw TCP prts: SSL / TCP prt 443 TCP prt 80 (r the HTTP prt specified in yur Clntinf.ini file. In this case, we use Prt 99) i. G t C:\Sam ii. Open Clntinf.ini iii. Under [WebServer] Lk fr Prt= iv. Add an exceptin fr that prt. If there is n prt specified, then it will be prt

20 20

21 9) Click OK t save all changes. MANAGE/REVIEW FIREWALL LOGS By default, Windws Firewall lgs are written t the lcal hard drive. By fllwing these steps, yu can specify the lcatin f where the lg file shuld be stred. The PCI DSS requires that yu review lgs n a daily basis. Cmprise will als prvide custmers with a Kisk sftware update, that will uplad the lcal firewall lgs t yur Smart Server s that yu can manage/review the lgs frm a centralized lcatin. A separate manual n Hw t Review Windws Firewall Lgs is als be included alng with this guide t help yu understand hw t read the lgs, what t lk fr, and hw ften. See Appendix A: Windws XP Security Lgging. It is the end user s respnsibility t manage and review lcal firewall lgs. 21

22 CONFIGURE FIREWALL LOGGING 1) Open Windws Firewall 2) Select the Advanced tab. 3) Click n Settings, under Security Lgging. 4) Check bth bxes fr Lg drpped packets and Lg successful cnnectins. 5) Specify the lg file lcatin, click Save As. This will be the firewall lg that yu will mnitr. 6) Click OK t save changes. 22

23 DOCUMENTATION As a best practice, any changes made t yur systems shuld be dcumented. The PCI DSS requires that yu have detailed dcumentatin n any cmpnents within yur cardhlder data envirnment. Yur card hlder data envirnment cnsists f all prcesses and technlgy as well as the peple that stre, prcess, r transmit custmer card hlder data, including cnnected system cmpnents and any virtualizatin cmpnents (i.e., servers, applicatins, etc.) Here are sme examples f dcumentatin yu shuld keep: Netwrk Cnfiguratin / Plicy Firewall Cnfiguratin / Plicy Netwrk Diagram(s) Security Plicies Change Cntrl; Change Requests and Apprvals Technical Supprt Cases 23

24 APPENDIX A: Windws XP Security Lgging SETTING UP SECURITY LOGGING Lgging is ne f the key parts f any secure system. Hwever, the ICF Security Lgging is disabled by default in Windws XP. The fllwing steps will enable it: 1) Right click n Netwrk Neighbrhd and click n Prperties 2) Right click the cnnectin using the ICF and select Prperties 3) Click n the Advanced tab and chse Settings 4) Click the Security Settings tab 5) Click the Lg drpped packets and the Lg successful cnnectins check bx 6) Change the lcatin and name f the firewall lg file under the Name text bx 7) Click OK, OK, and OK again. TIP: T disable the Security Lgging, simply ensure the Lg drpped packets and Lg successful cnnectins ptins are unchecked. READING THE LOG FILE A lg file can ffer a wealth f infrmatin. Hwever, the file is wrthless if yu cannt extract meaningful data. The fllwing sectin analyzes a sample frm an actual lg file and explains the varius parts. 1. #Versn: #Sftware: Micrsft Internet Cnnectin Firewall 3. #Time Frmat: Lcal 4. #Fields: date time actin prtcl src ip dst ip src prt dst prt size tcpflags tcpsyn tcpack tcpwin icmptype icmpcde inf :41:47 OPEN TCP :41:48 OPEN TCP :41:53 OPEN TCP :42:00 OPEN TCP :42:00 OPEN TCP :42:16 CLOSE TCP :43:16 CLOSE UDP

25 The abve is an excerpt f a lg file taken frm a dial up cmputer ver a perid f a few secnds. In this example, yu can see that the lg file is full f numbers and ther infrmatin. The key t understanding the data is fund in the header f the file. Line 4 cntains the field names f each clumn f data. This makes imprting the file int a spreadsheet applicatin very easy. The fllwing steps explain hw t extract the infrmatin and imprt it int MS Excel. VIEWING THE ICF LOG FILE IN MICROSOFT EXCEL 1) Make a cpy f the lg file frm its resident lcatin t a temprary lcatin 2) Open the file and remve lines 1 3 3) Remve the '#Fields: ' frm the left side f the new tp line (previusly line 4) 4) Open Micrsft Excel > Data > Imprt External Data > Imprt Data 5) Change Files f Type t All Files (*.*) and select the *.lg file previusly cpied 6) Chse Delimited and click Next 7) Check the Space ptin 8) Click Finish and OK t use the existing wrksheet The fllwing will explain each field and its meaning. USING MICROSOFT EXCEL TO IMPORT THE LOG FILE #Fields: date time actin prtcl src ip dst ip src prt dst prt size tcpflags tcpsyn tcpack tcpwin icmptype icmpcde inf Date: Lists the date n which the cnnectin attempt was made in YYYY MM DD frmat. (e.g ) Time: Lists the time that the cnnectin attempt was made in HH:MM:SS frmat (24 hur frmat; e.g. 19:41:52) Actin: Identifies the type f peratin recrded by the ICF. The pssible entries are, OPEN, CLOSE, DROP, INFO EVENTS LOST. INFO EVENTS LOST is used when a number f actins ccurred, but were nt entered int the security lg. Prtcl: Identifies the prtcl that was used fr the cnnectin attempt. While nrmally TCP, UDP, r ICMP will be entered, if an unknwn prtcl is used then a number representing the number f packets using the unknwn prtcl will be placed in this field instead. Src ip: Identifies the surce IP address frm which the cnnectin attempt riginated (e.g ) 25

26 Dst ip: Identifies the destinatin IP address t which the cnnectin attempt was made (e.g ) Src prt: Identifies the surce prt frm which the cnnectin attempt was made n the requesting cmputer. The entry will be an integer ranging frm 1 65,535. Only TCP and UDP will return a valid prt number. If anther prtcl is used, prt 4039 will be entered. (e.g. 3023) Dst prt: Identifies the lcal prt t which the cnnectin attempt was made. The entry will be an integer ranging frm 1 65,535. Only TCP and UDP will return a valid prt number. If anther prtcl is used, prt 53 will be entered (e.g. 80 is a cmmn entry if the request is made t retrieve a web page frm the lcal hst) Size: Identifies the size f the packet in Bytes (e.g. 60) Tcpflags: Identifies the TCP cntrl flag fund in the header f all TCP packets. The flags are written as uppercase letters (e.g. ACK). Begin indent Ack This flag says that the ack number is valid, which means that the sender is acknwledging the receipt f data. Fin This flag signifies that the sending end will nt be sending any mre data. Psh This flag tells the receiving end t push all buffered data t the destinatin applicatin. It essentially means there is n mre data. Rst This flag resets the receiving end f the TCP cnnectin. Packets in errr are replied t with this flag. Syn This flag is used t signify that bth ends have t synchrnize their TCP buffers. Urg This flag is used t signify that the urgent pinter is valid and the data it refers t shuld be prcessed immediately. End indent Tcpsyn: Identifies the sequence number used in a TCP sessin. This number is present when the tcpflag is set t SYN (e.g ) 26

27 Tcpack: Identifies the acknwledgement number used in a TCP sessin. This number is present when the tcpflag is set t ACK. This number will be the next sequence number the lcal cmputer shuld expect t receive (e.g. 0). Tcpwin: Identifies the TCP windw size in bytes f the packet. Icmptype: Identifies the number that represents the ICMP field Type (e.g. ICMP ech = 8) Icmpcde: Identifies the number that represents the ICMP field Cde. This number have varius meanings depending n the ICMP Type (e.g. Type=Desitnatin Unreachable (3), Cde=Hst Unreachable (1)). Inf: Used as an extra entry t clarify an actin that ccurred. Fr example, an INFO EVENTS LOST actin will recrd the number f events that happened but were nt placed in the lg since the last incidence f this type f event. As yu can see, the ICF Security lg ffers its user a wealth f infrmatin. Althugh it seems esteric t many end users, this lg will prvide netwrk administratrs substantial prf f a hack attempt and its rigin. Fr example, ne f the first things every hacker des against a target system is a prt scan. If this is perfrmed n a system with the ICF lgging enabled, the attackers IP address will shw up in multiple entries ver a brief perid f time. In additin, if the hacker used a scanner that sequentially prbes prts (e.g. 3045, 3046, 3047), the lg file will be full f entries where the dst prt field increases by ne. When used in cnjunctin with ther lgging ptins prvided by Windws XP, the ICF lg frm end user machines prvides useful clues. 27

28 ICMP OPTIONS OVERVIEW OF ICMP The Internet Cntrl Message Prtcl is ne f the mst cmmn prtcls used n the Internet. It is used fr trubleshting Internet cnnectins, maintaining cntrl, and gaining infrmatin abut ther cmputers. Defined in RFC 792, ICMP is the prtcl used when cmputers and ruters need t infrm and cntrl ther ruters and hsts n the Internet. Althugh a user r prgram usually generates the ICMP message, the respnse side is autmated. Fr example, the mst ppular usage f the ICMP prtcl can be fund in the prgram called PING. The Packet Internet Grper (PING) prgram is a very ppular utility that is mst cmmnly used t determine whether r nt an IP address is in use r is available n the Internet and in lcal netwrks. Althugh many ISPs are restricting the use f the ICMP, and therefre PING, this prgram is still used by netwrk technicians, hbbyists, Internet based prgrams, and thers wh need t determine the status f thers n the Internet. Hwever, this grup als includes hackers and ther n line criminals. Hackers ften use the ICMP prtcl t determine whether r nt targets are nline and are even finding ways t abuse the prtcl t crash cmputer systems. T prevent this frm happening t hme users, Micrsft has included an ICMP filter as part f the ICF. While a user can enable selected ptins f the ICMP filter, nce the ICF is enabled all cnnectin attempts using the ICMP will be drpped. If Security Lgging is in use, the packets will be lgged and flagged as drpped. 28