Use a DMZ—The DMZ is part of perimeter network security in which servers that must be accessible by sources both outside and inside your network are placed outside the firewall. However, the DMZ is not connected directly to either network, and it must always be accessed through the firewall. This means that external users never gain access to the internal network.

Maintain network blueprints—Maintain a current network diagram, including all connections involving transmission of cardholder data. Include any wireless networks the organization uses. This helps track where security holes might be.

Block unused ports—Verify the firewall configuration includes a documented list of services and ports needed for business operations. Ports and services falling outside this list can be blocked.

Streamline protocol use—A network can use any number of protocols, many enabled by default. Ensure that all protocols in use have a legitimate purpose and are documented.

Review firewall configurations—Network security requirements change. Verifying firewall configuration requires periodic review of the firewall and router rules to ensure they still apply and protect the network.

Restrict cardholder database access—Examine the firewall to verify that there are indeed restrictions between publicly accessible servers and components storing cardholder data.

Verify wireless security—Verify that perimeter firewalls are installed between wireless networks and cardholder data.

Hide IP addresses—Implement IP masks. Hide IP addresses so they will not be translated and revealed on the Internet.

Use host-based firewalls—Ensure that firewalls are installed and correctly configured on mobile systems such as laptops. Employees should not be able to alter the firewall.

Change passwords—Change default vendor-supplied passwords on all equipment including routers, access points, and more.

Change default wireless configuration—Change the passwords and default security configurations on all wireless access points (APs). This includes changing the service set identifier (SSID) of each AP.

Develop security standards—Create configuration standards for all system components. Identify well-known security vulnerabilities and address them in configuration standards.

Streamline protocols and services—Disable all unnecessary, insecure services and protocols.

Disable unused elements—Remove all unnecessary functionality, for example, scripts, drivers, features, subsystems, file systems, and unnecessary Web servers.

Use encryption—Ensure that all passwords are encrypted when stored and in transit. Sending passwords over a network in clear text makes them vulnerable.

Store only necessary cardholder data—It is important to store only relevant and legally required cardholder data and destroy the rest. This approach limits the impact should cardholder data be compromised.

Develop a cardholder data retention policy—All organizations with cardholder data should have a retention policy that states how long data is kept and how it will be stored.

Develop disposal policies—Disposal policies highlight how data will be disposed of after it is no longer required. All data should be disposed of so that it cannot be recovered and stolen by a malicious user.

Do not store card validation codes—Code validation numbers are used to verify non-present transactions such as those conducted over the Internet. These are typically three- to four-digit numbers on the back of credit cards. These numbers should not be stored but simply used as a means of authentication.

Do not store PIN numbers—If personal identification numbers (PINs) are obtained, they should not be stored or used in any way other than for authentication.

Use encryption—All cardholder data should be encrypted both in transit and while stored.

Restrict access to cardholder data—Some form of access control, such as role-based access control, should be used to restrict access to cardholder data.

Use encryption protocols—Use strong cryptography and security protocols to protect data when being transmitted over open, public networks. This includes using Hypertext Transfer Protocol Secure (HTTPS) to secure online transactions.

Secure wireless communications—If transactions occur over a wireless link, use secure protocols to secure the transaction. For wireless, this may include Wi-Fi Protected Access (WPA) and WPA2. Do not use the Wired Equivalent Privacy (WEP) protocol to secure wireless connections—it is not considered secure.

Monitor communications and protocols—Periodically verify that the most current and up-to-date protocols are being used to secure the communication. Also, ensure that the security protocols are configured correctly. For instance, use a minimum 104-bit encryption key and 24-bit initialization value.

Keep patches up to date—Ensure all system components have the most recently released vendor-supplied patches installed. Patches should be installed soon after the release date.

Develop patching and update policies—Many organizations choose to develop firm update policies that administrators follow. Systems and applications that are patched and updated are far less likely to be vulnerable.

Monitor vigilantly—Administrators must spend time reviewing and monitoring for the latest threats and vulnerabilities. Chapter 15 covers some of the organizations that review latest threats and vulnerabilities.

Configure automatic updates—Many systems and applications can be configured to be updated automatically. This takes the human error out of the equation and helps ensure that applications are current.

Ensure development follows guidelines—Develop all Web applications based upon secure coding guidelines. Review custom application code to reveal security threats. Cover prevention of common coding vulnerabilities.

Enforce role-based access control—Limit access to cardholder information to those individuals whose job requires such access.

Create a "deny all" policy—Create a method for systems with many users to restrict access based upon users' need to know. The method must be set to "deny all" unless specifically allowed.

Develop access policies—Develop and publish guidelines outlining who can and cannot access specific information. Ensure these policies are reinforced with consequences if a breach occurs.

Develop a two-factor authentication scheme—A two-factor authentication scheme typically involves combining multiple authentication methods. This may be an ATM card and something only the user knows, such as the card's PIN number. Create a two-factor authentication for remote access to the network for employees, administrators, and third parties. Authentication methods include passwords, biometrics, and access tokens.

Require individual access—Some environments use group access to applications and systems, for example, administrators' groups or guest groups. It is more secure to identify all users with a unique username before allowing individuals access to system components or the cardholder data environment. To increase security, verify that a user has a unique username to access system components and cardholder data.

Encrypt passwords—Encrypt passwords during transmission and storage on all system components.

Develop strong password policies—Password policies may include: how often a password must change, the structure of passwords, enforce original passwords, password length, and account lockout policies in which the account is logged out after a few failed logon attempts.

Disable unused accounts—Accounts for terminated employees should be deactivated immediately and inactive accounts should be disabled after a set period of time.

Restrict access—Ensure that all access to the cardholder data environment is authenticated, including applications, administrators, and other users.

Restrict physical access to sensitive areas—Use facility access controls to monitor and limit physical access to systems that store, process, or transmit cardholder data. This may include verifying access control with badge readers, lock and key, or other devices.

Monitor the server room—Use cameras to monitor data sensitive areas. Store camera recordings for at least three months, unless restricted by the law.

Restrict access to networking hardware—Restrict physical access to wireless access points, gateways, hard drives, and handheld devices.

Secure backups—Secure access to backups that may control sensitive data. Many organizations use off-site backup measures as a precaution. Ensure offsite backups are secured during transit.

Create visitor policies—Develop procedures to help personnel easily distinguish between employees and visitors. This is essential in areas where cardholder data is accessible. All visitors must be authorized before entering areas where cardholder data is processed or maintained. All visitors must be given a physical token that indicates they are not employees, and this physical token must expire.

Maintain a cardholder paper trail—Physically secure all paper and electronic media that contain cardholder data. When no longer required, the paper should be disposed of in a secure fashion. This may include using a paper disposal company.

Maintain inventories and tracking mechanisms—Maintain strict control over the storage and accessibility of media that contains cardholder data. Ensure it is known where all sensitive data is stored and how it moves throughout the network, from gathering to storage, backups and disposal.

Dispose of electronic devices appropriately—Destroy electronic media by purging, demagnetizing, or shredding to eliminate the possibility that the media could be reconstructed. This includes the destruction of hard disks and not just formatting the disk.

Develop logging policies—Logging policies identify what should be logged, how long logs are retained, who has access to logs, and more.

Log access to cardholder data—To track security breaches, it is important to log all individual access to cardholder data. All accounts viewing cardholder data can then be traced.

Log failed logon attempts—To help identify if someone is trying to access cardholder data, log all invalid access attempts.

Restrict log access—Clearly identify who has access to logs and what can be done with that access.

Develop retention procedures—Determine how long logs should be kept and in what form.

Create and deploy policies—Establish, publish, maintain, and disseminate a security policy.

Update policies—Develop an annual process to identify new threats and vulnerabilities and include the results in a formal risk assessment. Incorporate this into the security policy.

Create usage policies—Develop usage policies for employee-used technologies. Ensuring that employees are aware of the policy and consequences for not following it.

Develop an employee education program—Implement a formal security awareness program to make all employees aware of the importance of cardholder data security. Educate new employees and current employees not once but as new security developments occur.