{"id":2045,"date":"2017-10-28T12:10:44","date_gmt":"2017-10-28T09:10:44","guid":{"rendered":"http:\/\/www.profelis.com.tr\/tr\/blog\/?p=2045"},"modified":"2023-02-01T10:58:00","modified_gmt":"2023-02-01T07:58:00","slug":"postgresql-ile-pci-dss-uyumlulugunu-saglamak","status":"publish","type":"post","link":"https:\/\/profelis.com.tr\/en\/2017\/10\/28\/postgresql-ile-pci-dss-uyumlulugunu-saglamak\/","title":{"rendered":"Achieving PCI-DSS Compliance with PostgreSQL"},"content":{"rendered":"

Achieving PCI-DSS Compliance with PostgreSQL<\/h2>\n

Note: Recently, (We are expecting it in November 2017.<\/em>Our article detailing the new features to be introduced in the PCI-DSS standards, whose fourth version will be announced, will be published next week. Therefore, this article may be updated in the coming days.<\/p>\n

What is PCI-DSS?<\/h2>\n

PCI-DSS is an international security regulation that determines security standards for credit card transactions and mandates certificates according to merchant levels. PCI-DSS standards (regulations) are established by a council whose members include major organizations such as Mastercard, Visa, American Express, Discover Services, and Veracode.<\/p>\n

Having undergone various changes since its initial release announced in 2006, it has gained international validity over time. As of October 28, 2017, the current version is 3.2, and the PCI-DSS version 4.0 will be announced soon.<\/p>\n

Who must comply with PCI-DSS standards?<\/h3>\n

Every company or institution that holds card data is subject to PCI-DSS regulation.<\/p>\n

Which card data should be stored and in what way?<\/h3>\n

It is helpful to check the organization's own document for this information, as auditing bodies sometimes interpret the rules according to their own discretion.<\/p>\n

\"\" Technical Guidelines for PCI Data Storage<\/p>\n

Merchant Tiers and PCI-DSS Requirements<\/h2>\n

There are 4 different levels determined by the number of transactions made by the merchant. Transaction volume is evaluated as the number of transactions, not in terms of currency.<\/p>\n\n\n\n\n\n\n\n\n
#<\/th>\nLevel 1<\/th>\nLevel 2<\/th>\nLevel 3<\/th>\nLevel 4<\/th>\n<\/tr>\n<\/thead>\n
Trading Volume<\/th>\nCompanies that process more than 6 million transactions per year<\/td>\nCompanies processing between 1 and 6 million transactions annually<\/td>\nCompanies with 20 thousand to 1 million transactions per year<\/td>\nCompanies making fewer than 20 thousand transactions per year<\/td>\n<\/tr>\n
On-site Inspection<\/th>\nOnce a year<\/td>\nNo<\/td>\nNo<\/td>\nNo<\/td>\n<\/tr>\n
Network Scan<\/th>\nQuarterly<\/td>\nQuarterly<\/td>\nQuarterly<\/td>\nQuarterly<\/td>\n<\/tr>\n
Completing the Self-Assessment Form<\/th>\nOnce a year<\/td>\nOnce a year<\/td>\nOnce a year<\/td>\nOnce a year<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Their adequacy and compliance are evaluated by official inspection agencies at certain periods using different methods and frequencies according to different levels.<\/p>\n

How to Comply with PCI-DSS Using PostgreSQL?<\/h2>\n

1. Installing a firewall to protect cardholder data<\/h3>\n

pg_hba.conf<\/strong>\u00a0It provides protection against connection requests from the inside and outside, regardless of whether there is a firewall or not. This protection can be defined in terms of IP addresses, address blocks, usernames, etc., and can be configured as accept, deny the rest.<\/p>\n

Furthermore, with the log_connections\/disconnections setting, connection tracking can be monitored via the central log server.<\/p>\n

2. Not using the initial passwords and other security parameters received from suppliers without changing them<\/h3>\n

Access to the database is not allowed with the root user. The default used for access \u201cPostgreSQL<\/strong>\u201dA strong password must be assigned for the user \u201d. On the pg_hba.conf file, authorization performed by accepting trusted users, hosts, IP addresses, etc., using host name\/IP address and user definitions should not be used. In addition, remote connection access to the template1 and postgres default databases must be disabled.<\/p>\n

The monitor user must be granted the necessary permissions. Object access permissions on PUBLIC must be revoked. Authorization and function definition for the sample monitor user:<\/p>\n

CREATE ROLE monitoruser WITH NOSUPERUSER NOCREATEROLE NOCREATEDB LOGIN PASSWORD 'X!2{K@Jnalaks-23<932_1ks2HS';\nALTER ROLE monitoruser SET search_path TO secure_check_postgres, pg_catalog;\nSET search_path to secure_check_postgres;\nCREATE FUNCTION pg_ls_dir(text) RETURNS SETOF text AS $begin return query(select pg_catalog.pg_ls_dir('pg_xlog')); end$ LANGUAGE plpgsql SECURITY DEFINER;<\/pre>\n
3. Protection of stored cardholder data<\/h3>\n
\u201cSecurity methods that can be used on cardholder data, such as encryption, truncation, masking, and hashing, must be utilized. If an attacker bypasses other security methods and somehow manages to access cardholder data, this data is expected to be unusable without the tools belonging to the security methods used, such as keys and certificates...\u201d<\/p><\/blockquote>\n
The sub-requirements of Requirement 3 of the PCI-DSS 3.2 standard elaborate on the previously introduced topic in a bulleted format, detailing all necessary actions. Among these, topics such as how certificates or keys used for encryption must be protected and who should have access to them are explained in detail. Accordingly, there are tools, features, and functions available on the PostgreSQL side that can be used for this purpose.<\/p>\n
For example, \u201cThe entire PAN information must be stored by hashing it.\u201d<\/em> Instead of MD5, cryptographic methods such as AES and SHA-256 should be preferred as the hash method to be used regarding the subject.<\/p>\n
pgcrypto<\/strong> The package meets all encryption requirements demanded by PCI-DSS. (Ref: https:\/\/www.postgresql.org\/docs\/current\/static\/pgcrypto.html<\/a>)<\/p>\n
4. Encryption of cardholder data and sensitive authentication data transmitted across public networks<\/h3>\n
To transmit data encrypted on public networks that are susceptible to interception, while on the other hand, for performance reasons, allowing this data to travel unencrypted within your data center or your own secure network, similarly pg_hba.conf<\/strong> file. Using the pg_hba.conf file, the system administrator can easily specify which hosts or networks must use encryption (SSL, etc.) during access separately from those that do not.<\/p>\n
Using anti-virus software and updating the software regularly<\/h3>\n
Your PostgreSQL server system being Linux\/Unix is more secure than it being MS Windows. Especially regarding issues like anti-virus, the choice of your operating system and protection measures come to the fore.<\/p>\n
6. Development and maintenance of security systems and applications<\/h3>\n
Infrastructure is provided so that security updates can be made quickly. If you are using Community PostgreSQL, make sure your Linux distribution is good and that update packages are continuously released. If you are using EnterpriseDB Postgres Advanced Server, security updates will continuously be in the repository for the version you are using, and announcements will be sent to you.<\/p>\n
7. Restricting access to cardholder data for company employees who do not need it according to their job description<\/h3>\n
PostgreSQL has been supporting column-level access authorization for a very long time (since version 8.4). You can use it to hide cardholder data or sensitive data from standard users and developers, or you can use custom views or virtual private database support for them.<\/p>\n
Assignment of a separate user ID and password for each person with computer access<\/span><\/p>\n
Access the database with a shared user, do not use password sharing. For authorization, instead of relying solely on passwords, you can use multi-factor authentication.<\/p>\n
9. Limiting physical access to cardholder data<\/h3>\n
pg_stat_statements<\/strong> You can install its plugin and track all queries made to the entire database (SELECT, INSERT, UPDATE, DELETE). It is recommended to keep audit logs for a long time. You should set up alerts for connection requests, especially failed connection attempts. You must monitor queries and access to the table where PAN information is stored.<\/p>\n
It has become increasingly common for the encryption mechanisms used in payment systems to be different from the database system. Encrypting and storing card information presented via web services or APIs on a separate system using keys and cryptographic devices or applications before it is even written to the database appears to be the most viable protection. In particular, you must never store the private keys used for decryption on the database server itself, especially the certificate used for encryption.<\/p>\n
I would suggest that you store the logs long-term. By long-term, I mean at least 3 years. Although this is entirely my personal opinion, the reason I have come to this conclusion is the attacks suffered by organizations like SONY and VISA, and the fact that these attacks were sometimes discovered much later. If you learn that you have been exposed to a past attack, besides the obligation to report it, the only thing that can help you find the vulnerability so you do not experience it again is the logs.<\/p>\n
10. Monitoring access to network resources and cardholder data<\/h3>\n
You may not be obligated to conduct a security test, but if you do, no one will ask you why you did it. I recommend that security tests be performed by external personnel, or there should be a separate unit or staff working exclusively on this matter. In other words, these tests should not be performed by the system administrators who manage the database or the application.<\/p>\n
11. Regular testing of security systems and processes<\/h3>\n
The meaning of regular should not be understood as a known schedule. If possible, you might not inform the system administrators during external security tests. This can lead to chaos, and if it does, you will see how the organization's staff reacts during an external scan or attack...<\/p>\n
12. Establishing an information security policy<\/h3>\n
G\u00fcvenli\u011fin %80’i insan ve s\u00fcre\u00e7lerden, geri kalan\u0131 ancak teknolojiden olu\u015fmaktad\u0131r. Bunun kan\u0131t\u0131 neredeyse %80 g\u00fcvenlik ihlallerinin tamam\u0131 yetkili kullan\u0131c\u0131 parolas\u0131n\u0131n veya bilgilerinin ele ge\u00e7irilmesinden kaynaklanmaktad\u0131r. Therefore, if it is necessary to invest more in security, you must start with people, not technology!<\/strong><\/p>","protected":false},"excerpt":{"rendered":"
PCI-DSS 4 s\u00fcr\u00fcm\u00fc yay\u0131nlanmak \u00fczere. PCI-DSS kredi kartlar\u0131 ile al\u0131\u015fveri\u015f yap\u0131l\u0131rken, g\u00fcvenlik standartlar\u0131n\u0131 belirlemekte olan ve t\u00fcccarlar\u0131n seviyelerine g\u00f6re sertifikalar\u0131n zorunlu tutuldu\u011fu uluslararas\u0131 bir g\u00fcvenlik mevzuat\u0131d\u0131r. PCI-DSS standartlar\u0131 (reg\u00fclasyon), \u00fcyeleri aras\u0131nda Mastercard, Visa, Amerikan Express, Discover Services, Veracode gibi b\u00fcy\u00fck kurulu\u015flar\u0131n da bulundu\u011fu bir kurul taraf\u0131ndan d\u00fczenlenmektedir.<\/p>","protected":false},"author":3,"featured_media":15530,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[76,75,45],"tags":[48,61,60],"class_list":["post-2045","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","category-postgresql","category-yazi","tag-enterprisedb","tag-linux","tag-postgresql"],"_links":{"self":[{"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/posts\/2045","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/comments?post=2045"}],"version-history":[{"count":0,"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/posts\/2045\/revisions"}],"wp:attachment":[{"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/media?parent=2045"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/categories?post=2045"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/tags?post=2045"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}