Payment Card Industry (PCI)

Organizations face several challenges when working to prove their compliance with PCI DSS. The largest organizations are challenged with assessments that are conducted annually by a Qualified Security Assessor (QSA) who creates a Report on Compliance (ROC). And although compliance with PCI DSS is not required by federal law in the United States, the laws of some states either refer to PCI DSS directly or make equivalent provisions. If an organization has been breached and was not in compliance with PCI, the card issuers can impose significant financial penalties on the merchant. Since it is the responsibility of the merchant to achieve, demonstrate, and maintain their compliance at all times during the annual assessment, best practice for PCI DSS compliance is to continually improve processes to ensure ongoing compliance, rather than treating compliance as a point-in-time project. Naturally, this can create a tremendous resource drain on technology- and security-oriented teams.

As a part of this process, the primary mission is to protect cardholder data and the security of the transactions involved with this information. Privileged access management can assist with many of the requirements for PCI DSS compliance in various forms, from restricting access, to command-line filtering. Figure 20-1 provides a high-level diagram of PCI DSS requirements. Based on the requirements, it is easy to see how PAM can impact privileges everywhere.

HIPAA

Enacted by the US Congress in 1996, the Health Insurance Portability and Accountability Act (HIPAA) provides provisions to protect health insurance coverage for workers and their families when they change or lose their jobs. HIPAA requires the establishment of national standards for electronic healthcare transactions and national identifiers for providers, health insurance plans, and employers. HIPAA has become a de facto standard for protecting the privacy and security of personally identifiable information (PII) in the healthcare industry.

SOX

In July 2002, the US Congress passed the Sarbanes-Oxley Act (“SOX”), which was primarily designed to restore investor confidence following well-publicized bankruptcies that brought chief executives, audit committees, and independent auditors under heavy scrutiny. The act applies to all publicly registered companies under the jurisdiction of the Securities and Exchange Commission (SEC). Financial data and documentation are at the heart of the compliance issue, and within the legislation, SOX Section 404: Assessment of Internal Controls defines vulnerability and privileged access management as a business requirement. This helps a business understand the flow of transactions, including IT aspects, to identify points at which a misstatement could arise, and evaluate controls designed to prevent or detect fraud. The latter places privileges as an attack vector and session monitoring clearly in focus for fraud detection and prevention.

GLBA

NIST

NIST Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organizations, was developed by a joint task force composed of representatives from NIST, the Department of Defense, the Intelligence Community, and the Committee on National Security Systems. This interagency partnership formed in 2009.

This guide delivers a holistic approach to information security and risk management by providing organizations with a comprehensive set of security controls essential to fundamentally strengthen their information systems, as well as the environments in which they operate. The resulting systems are more resilient in the face of threats and cyberattacks. NIST SP 800-53 outlines a “Build It Right” strategy combined with various security controls for continuous monitoring and strives to provide the senior leaders of organizations information in near real-time to support making risk-based decisions related to their critical missions.

Controlling and monitoring privileged access is extremely important for mitigating the risks posed by insider threats, preventing data breaches, and meeting compliance requirements. With that being said, security and IT leaders should walk a fine line between protecting the organization’s critical data to ensure business continuity and enable users and administrators to be productive.

The NIST publication recognizes this dilemma and formalizes separation of duties, change control, and privileged session auditing. This clearly defines how an organization should manage access and when. Unfortunately, the size and scope of actual PAM mappings to NIST 800-53 is enormous. If your organization has NIST requirements, please consider external consultants (or in-house expertise if you have the resources) to map your business requirements to contracts and actual deliverables. The scope may even include your supply chain and be completely outside of your control, except for contractually-based audits.

ISO

The International Organization for Standardization (ISO) has established guidelines and general principles for initiating, implementing, maintaining, and improving information security management in an organization. The objectives outlined in ISO 27002:2013(E) provide general guidance on the commonly accepted goals of information security management.

The control objectives and controls in ISO 27002 are intended to be implemented to meet the requirements identified by a risk assessment. ISO 27002 can serve as a practical guideline for developing organizational security standards and effective security management practices, and to help build confidence in interorganizational activities.

Security best practices have been adopted in almost every regulation and framework. ISO 27002 is no different when monitoring and managing privileges, and sessions form a fundamental part of managing the privileged attack vector and thwarting threat actors. Mapping these controls to your privileged access management deployment will help close off many of the attack vectors that we have discussed.

GDPR

The General Data Protection Regulation (GDPR) is one of the most important movements in the area of data protection in recent years. It was passed into European Union (EU) law on April 28, 2016, and became enforceable on May 25, 2018. Over several hundred million dollars in fines have already been levied for GDPR violations since the law went into effect.

In summary, the GDPR defines controls around how organizations store and process the personal data of EU citizens, irrespective of where the organization is based, owned, or operating. Anyone storing or processing the personal data of an EU citizen must comply with the GDPR or face significant fines in the event of a failed audit or data breach. Those fines can be up to 4% of the organization’s global turnover, or €10m, whichever is greater. With this level of impact, it is vital that all organizations understand their obligations under the GDPR and take appropriate measures to ensure they are compliant by demonstrating that the proper controls are in place to protect information.

In material terms, GDPR applies to the processing of personal data wholly or partly by automated (electronically) means and to processing other than by automated means, that is, as part of a paper or manual filing system. Processing related to the prevention, investigation, detection, or prosecution of criminal offenses, execution of penalties, and safeguarding public security is excluded from the GDPR. This is an important differentiation since law enforcement and their investigations are not participatory entities and may have exclusions when collecting personal data from organizations normally governed by GDPR.

In territorial terms, GDPR applies to the processing of personal data for data subjects who are in the European Union (EU)—in particular, when related to the offering of goods and services (irrespective of whether payment is required) and monitoring of their personal behavior. The regulation also applies to the processing of data by a controller wherever Member State law applies, through public international law.

CCPA

The California Consumer Privacy Act (CCPA) has been quoted as the beginning of America’s GDPR-type data privacy laws. Similar to the GDPR, the CCPA requires organizations to focus first on consumer data in 2020 and then personal data shared between businesses in 2021. It requires organizations to provide transparency in how they are collecting, sharing, and using personal information based on an individual’s request. And remember, a privileged account typically can access this data en masse, making it relevant, from an incident or breach perspective, to secure.

ASD

The Australian Signals Directorate (ASD) has developed a list of strategies to mitigate targeted cyber intrusions. The recommended mitigation strategies were developed in 2014 through ASD’s extensive experience in operational cybersecurity, including responding to serious cyber intrusions and performing vulnerability assessments and penetration testing for Australian Government Agencies.

In 2017, the ASD expanded the Top 4 recommendations to contain the Essential Eight. The dynamic nature of cybersecurity required a course correction to address the latest threats, like ransomware. Businesses and governments are accustomed to broad stroke changes occurring every few years, but rarely are recommendations made that are very precise to manage specific threats. The Essential Eight are the following:

Based on a threat actor’s methods to gain privileges, these recommendations are completely in line with the threats solved by privileged access management. The privileged attack vector mitigation is included in the Top 4 and Essential Eight (5–7) and represents a refined strategy to stop threats worldwide. Number eight is a backup discipline and is not a privileged attack vector. It can, however, be used for remediation for attacks like ransomware.

MAS

The Monetary Authority of Singapore (MAS) was founded in 1971 to oversee various monetary functions associated with financial and banking institutions. Throughout the years, their guidelines have been revised to manage emerging technologies and the evolving threat landscape. In June 2013, the MAS created a new set of guidelines for Internet Banking and Technology Risk Management (IBTRM). This addendum mandated certain requirements for Technology Risk Management (TRM) and contained a set of guidelines as well (TRM Guidelines), along with errata notices (TRM Notices).

The TRM Guidelines are statements of industry best practices to which financial institutions are expected to adhere. The guidance is not legally binding, but is used by MAS in risk assessment audits of financial institutions.

SWIFT

Organizations can address their compliance and security requirements as defined in the SWIFT Customer Security Controls Framework by implementing PAM solutions. Please note, if your organization currently adheres to the NIST Cybersecurity Framework, ISO 27002, or PCI DSS, SWIFT provides mappings to other frameworks to expedite compliance verification and to help avoid duplication of efforts in attestation reporting.

MITRE ATT&CK

While technically not a regulatory compliance framework, the MITRE ATT&CK¹ knowledge base is designed to help third parties discover, prioritize, categorize, and recommend strategies for threat remediation. It is a practical structure based on real-world attacks that are categorized by operating system, privileges, method, and technical details for classes of attack vectors. Not surprisingly, the vast majority of attacks can be mitigated by privileged access management solutions, especially when password management, endpoint least privileged management, and remote access capabilities are used in concert. Organizations are using the knowledge base as a guide to prove their risk mitigation strategies actually meet compliance objectives for risk reduction.

While each Enterprise Tactic is comprised of multiple Technique IDs,³ the detection, privileges, and mitigation detail provide a blueprint for using a tool, solution, policy, or configuration change to thwart each item as an attack vector. This alone is why many organizations embrace the MITRE ATT&CK framework, because it provides real-world guidance vs. theoretical aspirations like many legally binding regulatory compliance frameworks. And, if you manage to implement privilege security controls based on these real-world threats, it demonstrates compliance for many other regulatory initiatives.