PCI COMPLIANCE ON AWS: HOW TREND MICRO CAN HELP

SOLUTION BRIEF PCI COMPLIANCE ON AWS: HOW TREND MICRO CAN HELP The benefits of cloud computing are clear and compelling: no upfront investment, low ongoing costs, flexible capacity and fast application deployment. However, merchants and service providers that process credit card payments must comply with the Payment Card Industry Data Security Standard (PCI DSS), regardless of whether the transaction occurs in a store or in the cloud. Ultimately, these organizations are responsible for the security of their customer s cardholder data. AWS AND PCI DSS COMPLIANCE Perhaps the largest point of confusion with regards to the PCI DSS and cloud computing is the question of upon whose shoulders does compliance fall? Andrew Hay, Wired Magazine To ensure an end-to-end secure computing environment, Amazon Web Services (AWS) employs a shared security responsibility model with its customers. While AWS provides secure facilities and processes, it is up to its customers to protect their operating systems, applications and data running on AWS. It is important to understand the division of shared responsibilities between AWS and the client, and the security solutions organizations need to meet PCI DSS requirements. If payment card data is stored, processed or transmitted in a cloud environment, PCI DSS will apply to that environment, and will typically involve validation of both the AWS infrastructure and the client s usage of that environment. Ultimately however, the responsibility to ensure cardholder data is secure rests with the client. Although AWS satisfies all of the requirements under PCI DSS for shared hosting providers and has been successfully validated against standards applicable to a Level 1 service provider under PCI DSS Version 2.0. it s important to note that AWS customers are responsible for their own PCI DSS compliance. And while some DSS requirements may be satisfied by the customer s use of AWS (for instance Requirement 9: Restrict physical access to cardholder data), most requirements are either shared responsibilities between the AWS customer and AWS, or entirely the customer s responsibility. Table 1 summarizes the party responsible for ensuring compliance with each of the PCI DSS requirements. TABLE 1: DIVISION OF PCI DSS RESPONSIBILITIES Both = Client & AWS PCI DSS REQUIREMENT RESPONSIBILITY 1. Install and maintain firewall configuration to protect cardholder data Both 2. Do not use vendor-supplied defaults for system passwords and other security parameters Both 3. Protect stored cardholder data Both 4. Encrypt transmission of cardholder data across open, public networks Client 5. Use and regularly update anti-virus software or programs Client 6. Develop and maintain secure systems and applications Both 7. Restrict access to cardholder data by business need to know Both 8. Assign a unique ID to each person with computer access Both 9. Restrict physical access to cardholder data AWS 10. Track and monitor all access to network resources and cardholder data Both 11. Regularly test security systems and processes Both 12. Maintain a policy that addresses information security for personnel Both Source: Information supplement: PCI DSS Cloud Computing Guidelines www.pcisecuritystandards.org/pdfs/pci_dss_v2_cloud_guidelines.pdf Page 1 of 8 SOLUTION BRIEF PCI Compliance on AWS: How Trend Micro Can Help

As you can see in the table above, many of the items require both parties to implement security controls. Outsourcing daily management of a subset of PCI DSS requirements to AWS does not remove the client s responsibility to ensure cardholder data is properly secured and that PCI DSS controls are met. The client therefore must work with AWS to provide evidence only, whereas compliance verifies PCI DSS controls are maintained on an ongoing basis an Attestation of Compliance (AOC) reflects a single point in time only; compliance requires ongoing monitoring and validation that controls are in place and working effectively. Even where a cloud service is validated for certain PCI DSS requirements, this validation does not automatically transfer to the client environments within that cloud service. For example, AWS will have validation there is up-to-date anti-virus software on AWS systems; however, this validation might not extend to the individual client OS or VMs (such as in an IaaS service on an instance). Additionally, clients must maintain compliance for all of their own operations for example, ensuring anti-virus is installed and updated on all client-side systems used to connect into the cloud environment. TREND MICRO CLOUD & DATA CENTER SECURITY SOLUTION As a part of the broad cloud and data center solution, Trend Micro has three security offerings that complement the security provided by AWS and help achieve PCI DSS compliance. Trend Micro Deep Security is a comprehensive server security platform that protects AWS instances from data breaches and business disruptions while enabling compliance. This solution simplifies security operations while accelerating the ROI of virtualization and cloud projects. Tightly integrated modules easily expand the platform to ensure server, application, and data security across physical, virtual, and cloud servers, as well as virtual desktops. The Deep Security platform is powerful and optimized for all physical, virtual, and cloud environments. With Deep Security, customers can employ any combination of agent-based protection, including anti-malware, web reputation, firewall, intrusion prevention, integrity monitoring, and log inspection. Agentless protection is also available for on premise applications running VMware. The result is an adaptive and efficient server security platform that protects mission-critical enterprise applications and data from breaches and business disruptions without expensive emergency patching. Deep Security Key Benefits Single solution with broadest set of recommended security capabilities for AWS instances Reduces set up time with flexible deployment options (software or SaaS) Supports leading cloud deployment tools (Chef, Puppet, OpsWorks) Automatically recognizes and secures new instances and sets security policy without admin intervention Eases management with an integrated console including customizable policy rules and templates Trend Micro SecureCloud provides distinctive data protection for cloud and virtual environments using encryption with policy-based key management and unique server validation. This protection safely and easily secures sensitive data stored with leading cloud service providers, including Amazon EC2, and allows businesses to control their own keys, ensuring they aren t tied to one provider s encryption system. SecureCloud provides a patent-pending, key management system that enables users to set policies that determine where and when encrypted data can be accessed. In addition, server validation applies identity and integrity rules when servers request access to secure storage volumes. SecureCloud s simple approach safely delivers encryption keys to valid devices without the need to deploy an entire file system and management infrastructure. Continued on next page. Page 2 of 8 SOLUTION BRIEF PCI Compliance on AWS: How Trend Micro Can Help

SecureCloud provides protection of sensitive information in cloud and virtual environments from theft, unauthorized exposure, or unapproved geographic migration to other data centers. This protection helps support internal governance and ensure compliance with regulations like HIPAA, HITECH, Sarbanes-Oxley, GLB and PCI DSS. SecureCloud also features FIPS 140-2 certification to support government agencies and companies that mandate high security standards. SecureCloud Key Benefits Prevents data loss by encrypting both data and boot volume Segregates and protects sensitive information in private cloud and virtual environments Promotes safe storage recycling by rendering any data remnants indecipherable Allows businesses to choose when and where information is accessed Supports all cloud providers and leading cloud OS including AWS Linux Avoids cloud vendor lock in by enabling business ownership of encryption keys Trend Micro Web App Security is a comprehensive application security solution that delivers continuous vulnerability detection with automated scanning, expert business logic testing and comprehensive reporting. It also protects applications with unlimited SSL certificates and speeds mitigation of discovered vulnerabilities through native web application firewall rule integration and intrusion prevention (IPS). Web App Security Key Benefits Continuously scans web applications for vulnerabilities and removes distracting false positives Finds application logic flaws with hands on expert testing Indentifies security vulnerabilities at the platform layer Integrates with leading WAF vendors and provides customized rules to protect applications without patching or updates Table 2 outlines the responsibilities of AWS and clients for each PCI DSS requirement and how Trend Micro offerings can help clients achieve compliance. Comprehensive Application Vulnerability Detection and Protection Page 3 of 8 SOLUTION BRIEF PCI Compliance on AWS: How Trend Micro Can Help

Requirement 1: Install and maintain a firewall configuration to protect cardholder data. maintains instance isolation for host operating systems and the AWS Management Environment including host operating system, hypervisor, firewall configuration and baseline firewall rules. Testing and approving network connectivity and configuration for storing cardholder data in AWS services. AWS maintains the firewalls and network management for these services. Developing appropriate firewall rules or using additional firewall technologies to develop appropriate DMZ and internal networks. Reviewing the connectivity models and exposure of their instances to these data stores, for ensuring that appropriate zones are created, and for determining that access to the data stores that have cardholder data are not directly exposed to the Internet. AWS Security Groups provide a simple yet powerful mechanism for meeting the principal segmentation objectives of Section 1 between various server instances and to the Internet. Trend Micro Deep Security has advanced firewall capabilities that can complement and extend the built-in AWS Security Group capabilities when finer granularity or control of the segmented traffic is desired or required, such as with full bidirectional stateful inspection or application layer rules. Implementing perimeter firewalls and configuring security groups and ACLs through the AWS API and other user interfaces for their in-scope services. Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters All In-Scope Services: AWS develops and maintains configuration and hardening standards for the AWS Management Environment that provides the virtualization technologies and applications for providing the cloud services. AWS maintains configuration and hardening standards for the underlying operating systems and platforms for these services. Documenting, developing and implementing configuration standards for the instances of EC2 and VPC that are within the CDE. Documenting the functional and security configuration standards of AWS services used within the CDE to ensure that the secure state designed for the service can be maintained. Maintaining configurations and updating them as new vulnerabilities and configuration changes are identified. Remaining up-to-date on AWS service information and changes to configurable items with new releases and updating their configuration settings accordingly. Applying the appropriate configuration to all EC2 and VPC server instances as well as the configuration of other AWS services that are used for storing, transmitting or processing cardholder data. Ensuring that only one primary function is implemented per server instance. Ensuring secure communication for administrative access to the server instances such as Windows Remote Desktop (RDP) using High Encryption or FIPS compatible encryption settings or SSH v2 or above and appropriate SSH keys. Ensuring that access to APIs are only allowed over Direct Connect or SSL connections to protect the confidentiality and integrity of the transmission of configuration information. Configuring the services to limit access to data stores and servers as outlined throughout the document. Trend Micro Deep Security has configurable security profiles that can be defined and customized for each type of server role, to ensure that each server instance meets the one function-per-server requirement and that only the necessary services are accessible. Security profiles can include a variety of proactive rules to lock down each server s role ranging from firewall rules to block access to service ports, to configuration and integrity monitoring of application and service configuration files and registry, to auditing of service and administrative log events for unauthorized changes. Security policies enable consistent configurations to be applied to common groups of servers, simplifying the audit process and ensuring that changes made to the group policy are automatically inherited and applied to all instances/servers assigned that policy. Deep Security does also support local overrides so that additional policy assignments and configurations can be made to further secure particular servers and account for different configuration requirements. Deep Security s Recommendation Scan feature profiles each server instance being protected and ensures that each server instance is running the necessary security policy rules (Intrusion Prevention, Integrity Monitoring, and Log Inspection) are applied throughout the lifecycle of server instance/ application. The Recommendation Scan feature can be considered the equivalent of auto-tuning the security policies of the server instance to ensure optimum protection. Page 4 of 8 SOLUTION BRIEF PCI Compliance on AWS: How Trend Micro Can Help

Requirement 3: Protected stored cardholder data does not manage cardholder data or encryption technologies and keys for the customers specific cardholder environment. Maintaining appropriate data retention policies and procedures, encryption technologies and key management processes for maintaining PCI Data Security Standard requirements. SecureCloud provides AES-256 full disk encryption for AWS instances and supports both EBS boot volume and data volume encryption. In addition, SecureCloud encryption is performed independent of the AWS infrastructure, ensuring that customers have full control over encryption keys and the encryption key release policies. SecureCloud encryption policies enable customers to control the conditions under which encryption keys are released to requesting SecureCloud Agents (i.e. location of the server instance, IP address, OS type, Deep Security status, custom AWS metadata, etc.) SecureCloud implements a FIPS 140-2 Level 1 certified cryptographic library to perform the full disk encryption. Requirement 4: Encrypt transmission of cardholder data across open, public networks. encrypts access and manages encryption within the AWS Management Environment. Configuring web servers or the ELB load balancers with appropriate certificates to protect cardholder data transmission over public networks. Cryptography and security protocols for connections to any storage system that is transmitting cardholder data. Trend Micro Web App Security includes unlimited SSL certificates to protect cardholder data during transfer by creating a uniquely encrypted channel for communication. There is also a management console and certificate health checks to reduce configuration issues and expiry risk. Ensuring the data is encrypted in transit as well as in storage. The policies and use of any end-user messaging technologies for transmitting PAN. The transmission of data can additionally be protected with Deep Security s firewall which can be configured to block HTTP traffic (port 80) ensuring that all traffic occurs over HTTPS ports (443). Requirement 5: Use and regularly update antivirus software or programs manages anti-virus software for the AWS Management Environment and, where appropriate, for the identified services. Managing anti-virus to PCI requirements, as applicable to Requirement 5, for any EC2 and VPC instances. Trend Micro Deep Security includes an antimalware module to protect server instances. This protection is powered by Trend Micro s Smart Protection Network which analyzes over 6TB of data daily to identify and correlate new threats. This insight is immediately shared through the proven cloud infrastructure. Continued on next page. Page 5 of 8 SOLUTION BRIEF PCI Compliance on AWS: How Trend Micro Can Help

Requirement 6: Develop and maintain secure systems and applications maintains security patching, development and change control of the applications that support the services included in the assessment including web interfaces, APIs, access controls, provisioning and deployment mechanisms. AWS develops and manages changes to the applications that support the services included in the assessment including web interfaces, APIs, access controls, provisioning and deployment mechanisms. Managing the security patches of their EC2 and VPC server instances. Reviewing all AWS Security Bulletins http://aws.amazon.com/security/security-bulletins and ensuring that any recommendations that are applicable to the customer s environment are reviewed and implemented as necessary. Maintaining software development standards, change control, and vulnerability management programs to align with PCI requirements for applications developed and deployed into EC2 or VPC. Any custom configurations that may be created using development criteria that are allowed by the APIs for EBS, S3, RDS, DynamoDB, SimpleDB, ELB, IAM, EMR, Direct Connect and Glacier. This development should utilize the same processes as other applications that are developed by the customer and be compliant with the PCI requirements for development standards. Trend Micro Deep Security provides virtual patching to protect unpatched vulnerabilities, and can serve as an effective compensating control and risk management strategy for the patching requirements of Section 6.1 until the appropriate patches can be applied. Trend Micro Web App Security provides continuous, automated vulnerability scanning of applications and platforms to help you meet Section 6.6 requirements. It also protects your applications with custom generated rules for major WAF providers (Citrix, imperva, ModSecurity, ALERTLOGIC) so discovered vulnerabilities can be immediately blocked from potential exploitation. Changes to configurations for EBS, S3, RDS, DynamoDB, SimpleDB, ELB, IAM, EMR, Direct Connect and Glacier services. AWS customers should have processes developed for managing and controlling changes to these configurations. change control procedures related to the EC2 and VPC server instances and EC2 and VPC configuration through APIs and other user interfaces. Requirement 7: Restrict access to cardholder data by business need-toknow All In-Scope Services: AWS maintains the access controls related to underlying infrastructure systems and the AWS Management Environment. Managing access to all AWS services that are included in their CDE. AWS provides various mechanisms for controlling access to the services including IAM for integration with corporate directories and granular access controls to the AWS Management Console. Deep Security maintains a full audit trail of all system and Administrative operations/events which can be forwarded to a centralized SIEM or Syslog server for further correlation and archival. Continued on next page. Page 6 of 8 SOLUTION BRIEF PCI Compliance on AWS: How Trend Micro Can Help

Requirement 8: Assign a unique ID to each person with computer access. provides each user in the AWS Management Environment a unique ID. AWS provides additional security options that enable AWS customers to further protect their AWS Account and control access: AWS Identity and Access Management (AWS IAM), Multi- Factor Authentication (MFA) and Key Rotation. Controlling the creation of user accounts. This includes access controls to all AWS Services included in scope as well as to the server instances and applications that customers may be hosting in EC2 and VPC Control over the authentication mechanisms to the management consoles and APIs for managing their EC2 and VPC accounts. AWS provides an opt-in Multi-Factor Authentication (MFA) solution to support AWS customers in meeting the requirement for two-factor authentication Deep Security supports role-based access control ensuring that administrative privileges can be restricted on a per administrator basis. This is further supplemented by Deep Security s multi-tenant capability where different departments, business units can be created as separate tenants ensuring complete isolation from a security management perspective. The processes and creation of accounts and access controls using the various authentication mechanisms offered by AWS and IAM. This includes access controls to all AWS Services included in scope as well as to the server instances and applications that customers may be hosting in EC2 and VPC. Requirement 9: Restrict physical access to cardholder data maintains the physical security and media handling controls for the services included in the assessment. Backup and destruction of media outside of the AWS environment. Requirement 10: Track and monitor all access to network resources and cardholder data maintains the physical security and media handling controls for the services included in the assessment. Logging and monitoring their systems and EC2 and VPC server instances in alignment with PCI requirements. Obtaining and monitoring access to cardholder data. AWS provides customer accessible transaction logs. Trend Micro Deep Security has modules for monitoring operating system events, application events and the integrity of key files these can be used to monitor the target system for security related incidents, and forward on to a SIEM or Syslog server for correlation in real time. Appropriately managing time service (NTP) configuration for customer EC2 and VPC server instances and applications. Continued on next page. Page 7 of 8 SOLUTION BRIEF PCI Compliance on AWS: How Trend Micro Can Help

Requirement 11: Regularly test security systems and processes. conducts wireless rogue access point detection, vulnerability and penetration testing, intrusion detection and file integrity monitoring for the AWS Management Environment and the identified services. All scanning, penetration testing, file integrity monitoring and intrusion detection for their EC2 and VPC server instances and applications. Trend Micro Deep Security provides file integrity monitoring of critical OS, application and configuration files and registry to meet Sections 11.4 and 11.5. Both AWS-supplied AMI s as well as custom AMI s can be conveniently used as reference baselines for integrity scans. In addition, Deep Security s Recommendation Scan feature profiles each server instance being protected and ensures that each server instance is running the necessary security policy rules (Intrusion Prevention, Integrity Monitoring, and Log Inspection) are applied throughout the lifecycle of server instance/application. The Recommendation Scan feature can be considered the equivalent of auto-tuning the security policies of the server instance to ensure optimum protection. Trend Micro Web App Security provides continuous, automated scanning of both application and platform and vulnerabilities that affect PCI compliance are flagged in the results. Expert hands-on business logic testing is also available to catch vulnerabilities that may be missed in automated tools. Requirement 12: Maintain a policy that addresses information security for all personnel. maintains security policies and procedures, security awareness training, security incident response plan, and human resource processes that align with PCI requirements. Maintaining appropriate policies and processes applicable to their cardholder data environment and align with the PCI Requirement 12 to maintain their compliance with the PCI Data Security Standards. Trend Micro Deep Security provides alerts that are integral to a security incident response plan. And because it can prevent attacks as well, Deep Security reduces the number of incidents requiring a response. Deep Security s integration with leading SIEM vendors enables a consolidated view of security incidents. ABOUT TREND MICRO As a global leader in cloud security, Trend Micro develops security solutions that make the world safe for businesses and consumers to exchange digital information. With more than 25 years of experience, Trend Micro delivers top-ranked security that fits customers needs, stops new threats faster, and protects data in physical, virtualized, and cloud environments. For more information watch a webinar on PCI cloud compliance at - www.trendmicro.com/cloudpci Visit Trend Micro Alliance Partner page at: www.trendmicro.com/us/business/strategic-alliances for more information on the AWS-Trend Micro alliance. Page 8 of 8 SOLUTION BRIEF PCI Compliance on AWS: How Trend Micro Can Help