PADSS Implementation Guide
29/12/2016 The Raiser's Edge PADSS Implementation Guide U
K
©2016 Blackbaud, Inc. This publication, or any part thereof, may not be reproduced or transmitted in any form or by any means, electronic, or mechanical, including photocopying, recording, storage in an information retrieval system, or otherwise, without the prior written permission of Blackbaud, Inc.
The information in this manual has been carefully checked and is believed to be accurate. Blackbaud, Inc., assumes no responsibility for any inaccuracies, errors, or omissions in this manual. In no event will Blackbaud, Inc., be liable for direct, indirect, special, incidental, or consequential damages resulting from any defect or omission in this manual, even if advised of the possibility of damages.
In the interest of continuing product development, Blackbaud, Inc., reserves the right to make improvements in this manual and the products it describes at any time, without notice or obligation.
All Blackbaud product names appearing herein are trademarks or registered trademarks of Blackbaud, Inc.
All other products and company names mentioned herein are trademarks of their respective holder.
PADSS-2016
Contents
Sensitive Authentication Data and Cardholder Data Retention
Cardholder Data Encryption
User Account Management
Firewall Management
Wireless Devices
Remote Access
Non-console Administrative Access
Internet-Accessible Systems
Records
Batch
Import
Export
11
16
16
16
14
15
15
15
11
12
13
13
14
14
14
4
9
10
9
9
8
8
5
6
4
5
6
6
7
18
chapter 1
PCI DSS Implementation
Payment Card Industry and Payment Application Data Security Standards
Data Management
Sensitive Authentication Data and Cardholder Data Retention
Cardholder Data Encryption
Network Security
User Account Management
Firewall Management
Wireless Devices
Remote Access
Non-console Administrative Access
Internet-Accessible Systems
System Maintenance
Network Maintenance
When you accept payment cards for donations or revenue, the security of the credit card information is very important. Used properly, Blackbaud programs can help you maintain this information in accordance with the Payment Card Industry Data Security Standard (PCI DSS). To help promote this awareness of the security requirements for credit card and cardholder data, this chapter provides information about PCI DSS and how it impacts your organisation. With the proper security of credit card information, you can protect your constituents and clients from inconvenience and financial and personal loss, and help protect your organisation from additional expense.
Note: This guide provides only an overview of PCI DSS requirements and recommended best practices to ensure compliance. For additional detail, visit https://www.pcisecuritystandards.org
to download the PCI DSS specification.
4
5
5
6
6
9
9
9
8
8
6
7
10
Payment Card Industry and Payment Application
Data Security Standards
Developed by Visa, the Payment Application Data Security Standard (PA DSS) requires software companies such as Blackbaud to develop secure programs that enable users to comply with the PCI
DSS. To learn more about PA DSS and download the specification, visit http://usa.visa.com/download/merchants/cisp_payment_application_best_practices.doc
.
5
C
HAPTER
1
Note: The Payment Card Industry (PCI) Security Standards Council includes American Express, Discover
Financial Services, JCB International, Mastercard Worldwide, and Visa Inc. and was formed to help implement consistent data security measures on a global basis.
Developed by the PCI Security Standards Council, the PCI DSS includes requirements for security management, policies, procedures, network architecture, software design, and other proactive measures. As an organisation that collects payment card information, such as to process payments or donations, you must adhere to the PCI DSS and proactively protect this data. To learn more about PCI
DSS and download the specification and its supporting documents, visit https://www.pcisecuritystandards.org
.
Note: Depending on your organisation and the number of payment card transactions you process, you may need to engage an external security assessment company to determine your level of compliance with PCI DSS and other security compliance programmes. If you use an external assessor, we recommend you select one that is qualified and familiar with the latest requirements from the PCI
Security Standards Council. To validate whether your organisation is compliant with PCI DSS, we recommend you also visit https://www.pcisecuritystandards.org
and complete the PCI Security
Standards Council Self-Assessment Questionnaire.
Data Management
Encryption is necessary to protect cardholder data. If a user circumvents security controls and gains access to encrypted data, without the proper cryptographic keys, the user cannot read or use the data.
To reduce the risk of malicious abuse, you must consider other effective methods to protect stored data. For example, store cardholder data only when it is absolutely necessary, and do not send the cardholder data in unencrypted email messages.
Sensitive Authentication Data and Cardholder Data
Retention
You should keep the storage of cardholder data to a minimum. To comply with PCI DSS, your organisation must develop and maintain a data retention and disposal policy.
l
Limit the cardholder data stored and the retention time to only that which is required for business, legal, and regulatory purposes.
l
Purge all cardholder data that exceeds the retention period.
Do not retain sensitive authentication data, such as the full magnetic stripe, card validation code, or personal identification number (PIN) information, in your database. If you must retain sensitive authentication data, such as for troubleshooting purposes, you must follow these guidelines:
l
Collect sensitive authentication data only when necessary to solve a specific problem.
l
Store sensitive authentication data only in specific, known locations with limited access.
l
Collect only the limited amount of data necessary to solve a specific problem.
l
Encrypt sensitive authentication data while stored.
l
Securely delete sensitive authentication data after use.
PCI DSS I
M P L EM EN TA TIO N
6
Warning: To comply with PCI DSS, you must remove historical sensitive authentication data and cardholder data from your database. If you upgrade from a non-compliant version, or if your organisation used attributes, notes, or text-free fields to store sensitive authentication information or cardholder data, you must search for and securely delete this data from your database to comply with
PCI DSS.
To ensure the complete and secure removal of cardholder data, you must securely erase temporary files that may contain sensitive authentication information and cardholder data.
l
If you use Microsoft Windows XP or Windows Vista, turn off System Restore on the System
Properties screen. To track changes in Windows, System Restore creates and uses restore points, which may retain cardholder data. When you turn off System Restore, the operating system automatically removes existing restore points and stops the creation of new restore points.
l
To ensure the complete removal of data, install and run a secure delete tool such as Heidi Eraser.
With a secure delete tool, you can safely erase temporary files that may contain sensitive information or cardholder data. For information about how to install and run the secure delete tool, refer to the manufacturer's documentation.
Cardholder Data Encryption
To comply with PCI DSS, your organisation must encrypt cardholder information during transmission over open public networks that malicious users could abuse to intercept, modify, and divert data during transit. These open public networks include the Internet, WiFi (IEEE 802.11x), the global system for mobile communication (GSM), and general packet radio service (GPRS). To safeguard sensitive authentication information and cardholder data during transmission, use strong cryptography and security protocols such as Transport Layer Security (TLS) version 1.2 (or above) and Internet Protocol
Security (IPSEC). Never send unencrypted cardholder data in an email message.
Network Security
With a secure network, you can protect your system and credit card information from internal and external malicious users. To secure your network, we recommend you utilise a firewall and configure wireless devices and remote access software.
User Account Management
To comply with PCI DSS, you must assign unique identification to each person who accesses networks, workstations, or servers that contain the program or cardholder data. Unique login credentials ensure that only authorised users can access and work with the critical data and systems included in your network. With unique login credentials, you can also trace actions on your network to specific users.
These credentials must include a unique user name and a way to authenticate the user's identity, such as a complex password, a token key, or biometrics.
At a minimum, your organisation must implement these guidelines to create network user accounts and manage user authentication and passwords. You must communicate password procedures and policies to all users who can access cardholder data.
7
C
HAPTER
1
l
Use authorisation forms to control the addition, deletion, and modification of user IDs.
l
Verify the identity of users before you reset passwords.
l
Immediately revoke account access for terminated users.
l
Remove or disable inactive user accounts at least every 90 days.
l
Enable user accounts for use by vendors for remote maintenance only when needed, and immediately deactivate them after use.
l
Do not use group, shared, or generic user accounts and passwords.
l
Require users to change their initial passwords immediately after the first use and subsequent passwords at least every 90 days.
l
Require passwords with a minimum length of seven numeric and alphabetic characters.
l
Require that new passwords not match one of the last four passwords used by the user.
l
Lock out the user account after no more than six failed login attempts. Set the lockout duration to 30 minutes or until a system administrator enables the user account.
l
Log out idle sessions after 15 minutes so users must enter the password to activate the workstation.
l
To log user authentication and requests, turn on database logging in Microsoft SQL Server.
Firewall Management
If you use software to process payments, we recommend you verify that the workstation's link to the
Internet is secure. If you transfer transactions online, ensure your Internet hardware, such as the modem or DSL router, provides a built-in firewall. You must restrict connections between publicly accessible servers and any system component that stores cardholder data, including connections from wireless networks. To comply with PCI DSS, the firewall configuration must:
l
Restrict inbound Internet traffic to Internet Protocol (IP) addresses within the DMZ.
l
Not allow internal addresses to pass from the Internet into the DMZ.
l
Implement inspection or dynamic packet filtering to allow only established connections into the network.
l
Place the payment processing program and the database that contains the cardholder data in an internal network zone segregated from the DMZ.
l
Restrict inbound and outbound traffic to only that which is necessary for the cardholder data environment, and deny all other traffic that is not specifically allowed.
l
Secure and synchronise router configuration files such as running and start-up configuration files.
Your organisation must also install perimeter firewalls between any wireless networks and the cardholder data environment and configure these firewalls to deny or control any traffic from the wireless environment. To comply with PCI DSS, your organisation must configure all mobile and employee-owned computers with direct connectivity to the Internet, such as laptop computers, used to access the network with an installation of personal firewall software.
PCI DSS I
M P L EM EN TA TIO N
8
Wireless Devices
If you use wireless devices to store or transmit payment transaction information, you must configure these devices to ensure network security in compliance with PCI DSS.
l
Install perimeter firewalls between any wireless networks and systems that store cardholder data.
These firewalls must deny or control any traffic necessary for business purposes from the wireless environment to the cardholder data environment.
l
Implement strong encryption, such as Advanced Encryption Standard (AES), on all wireless networks.
l
At installation, change wireless encryption keys, passwords, and SNMP community strings from the default. After installation, change wireless encryption keys, passwords, and SNMP community strings when anyone with knowledge of these items leaves the organisation or changes positions with the organisation.
l
Do not use the vendor-supplied defaults for the wireless environment. Change the default passwords or pass phrases on access points and single network management protocol (SNMP) community strings on wireless devices.
l
Change the default service set identifier (SSID) and disable SSID broadcasts when applicable.
l
Update the firmware on wireless devices to support strong encryption—such as WiFi-protected access (WPA or WPA2) technology, Internet Protocol security virtual private network (IPSec VPN), or Transport Layer Security (TLS)—for authentication and transmission over wireless networks.
l
Use industry best practices (for example, IEEE 802.11i) to implement strong encryption for the transmission of cardholder data and sensitive authentication data over the wireless network in the cardholder data environment.
Warning: As of June 30, 2010, it is prohibited to use Wired Equivalent Privacy (WEP) for payment applications. We strongly recommend you use WPA2 technology to secure wireless implementations.
To comply with PCI DSS, your organisation must configure all mobile and employee-owned computers with direct connectivity to the Internet, such as laptop computers, used to access the network with an installation of personal firewall software. The firewalls must be active and configured to a specific standard that users cannot alter.
Remote Access
Blackbaud CRM payment functionality is accessible only to users with access to your organisation's network. The application is configured to only be accessible with network access by default. Blackbaud does not have nor require access to customer networks in order to install Blackbaud CRM.
Blackbaud CRM updates are not delivered via remote access from Blackbaud.
If your organisation allows for remote network access by employees, administration, and vendors, you must implement two-factor authentication (T-FA) for logins in order to meet PCI-DSS requirements. T-
FA requires unique login credentials (username and password) and an additional authentication item such as a token or individual certificate. Use of technology such as remote authentication and dial-in service (RADIUS) or terminal access controller access control system (TACACS) with tokens or VPN
(based on TLS or IPSec) with individual certificates are acceptable methods of T-FA.
9
C
HAPTER
1
To comply with PCI DSS, your organisation must configure the remote access software to ensure network security.
l
Do not use the vendor-supplied defaults, such as passwords, for the remote access software.
l
Establish unique login credentials and complex passwords for remote access users in accordance
with PCI DSS requirements 8.1.5 and 8.3. For information, see User Account Management on page 6 .
l
Allow connections from only specific known IP and MAC addresses.
l
Enable encrypted data transmission in accordance with PCI DSS 4.1.
l
Lock out the remote access user account after no more than six failed login attempts.
l
Require remote access users to establish a VPN connection through a firewall before they connect to the network.
l
Enable the logging function.
l
Establish complex passwords for customers in accordance with PCI DSS requirements 8.2.3.
l
Restrict access to customer passwords to authorised third-party personnel.
l
To verify the identities of remote access users, require T-FA such as both a user login and a password.
If your organisation enables remote access for use by vendors, it should be only when needed and immediately deactivated after use.
Non-console Administrative Access
To comply with PCI DSS, your organisation must encrypt all non-console administrative access. For web-based management and other non-console administrative access, use technologies such as
Secure Shell (SSH), VPN, or TLS.
If you use Remote Desktop (RDP) for non-console administrative access, it is advised that you follow best practices for RDP security such as digitally signing RDP files with a custom certificate, tightening connection security through a TLS security layer and raising the encryption level to high, and using network level authentication.
For information on configuring RDP security, see Microsoft documentation at https://technet.microsoft.com/en-us/library/cc753488.aspx
.
Internet-Accessible Systems
Do not store cardholder data on Internet-accessible systems. For example, do not house the database server within the same server as the web server.
System Maintenance
Once you secure your system, you must keep your equipment current. Malicious users can use security vulnerabilities to access your system. Both hardware and software manufacturers occasionally issue
PCI DSS I
M P L EM EN TA TIO N
10 updates to products, such as to remedy these vulnerabilities and help prevent such attacks. We recommend you ensure you have the most recently released patches installed. For example, you can frequently review the manufacturer's websites, newsletters, and online forums to check for the current patches.
Occasionally, a manufacturer may stop support of a product. In this case, we recommend you determine whether your organisation should continue to use an unsupported product. Also, a manufacturer may inform you of a flaw or defect in a product that may make your organisation vulnerable to attack. We recommend you pay attention to these alerts and update your system accordingly.
To further reduce vulnerability, we recommend you also deploy anti-virus software on your systems and ensure they are current, actively running, and can generate assessment logs.
Network Maintenance
Once you secure your system, you must monitor and track access to the network and your credit card information, such as with logging mechanisms. The lack of activity logs can make the determination of the cause of an attack very difficult. Logs help you track and analyse network activity when something goes wrong. To further reduce vulnerability, we recommend you also frequently test your network to verify its security continues to be maintained, regardless of age or changes in software.
To comply with PCI DSS, you must implement automated audit trails for all system components to track these events:
l
All individual users who access cardholder data.
l
All actions performed by users with root or administrative privileges.
l
All access of the audit trails.
l
All invalid logical access attempts.
l
All use of identification and authentication mechanisms.
l
The initialisation of the audit logs.
l
The creation and deletion of system-level objects.
For each event, your organisation must also record these audit trail entries for all system components:
l
The user who initiates the event.
l
The type of event.
l
The date and time of the event.
l
Whether the event succeeds or fails.
l
The origination of the event.
l
The data, system component, or resource the event affects.
chapter 2
PA DSS Implementation in The
Raiser's Edge
Blackbaud Payment Service and The Raiser's Edge
User Account Configuration and Security
Cardholder Data
Records
Batch
Import
Export
Merchant Accounts
Authentication Event Log
Electronic Funds Transfer
NetSolutions
Rollback and Uninstall
Services and Protocols
Revision Information
The Raiser's Edge 7.9 or later, including the current 7.96, provides enhancements to help you secure your data and comply with PCI DSS. We strongly recommend you update your software to this version.
15
15
15
16
16
16
11
12
13
13
14
14
14
14
Blackbaud Payment Service and The Raiser's
Edge
The Raiser's Edge 7.9 or later does not store complete credit card numbers in the database. To store credit card and merchant account information, the program uses the Blackbaud Payment Service.
When you first update The Raiser's Edge, you select whether to send your existing credit card information to the web service or simply mask the credit card numbers in your database. If you process recurring credit card payments through The Raiser's Edge, the program uses the Blackbaud
Payment Service to transmit credit card information and process transactions through your merchant accounts.
12
C
HAPTER
2
Note: The Raiser's Edge does not send incomplete credit card numbers, or those associated with one-time gifts such as donations, to the Blackbaud Payment Service. During the update process,
The Raiser's Edge removes these credit card number from your database and retains only the last four digits.
When you first submit credit card information to the Blackbaud Payment Service for storage, it create a unique reference number for each credit card number to securely identify and process transactions in accordance with PCI DSS.
User Account Configuration and Security
The Raiser's Edge requires the use of strong or complex passwords.
l
Passwords are case-sensitive and require numeric and alphabetic characters.
l
Passwords can have up to 50 characters but must have a minimum of eight
l
In Configuration, you can confirm business rules to require users to change their passwords on a routine basis. New passwords entered by users cannot match one of the last four passwords used by the user.
Warning: To help secure user login credentials, we strongly recommend you use Windows authentication with The Raiser's Edge. Windows authentication uses security support providers
(SSPs), installed as dynamic-link libraries (DLLs), as protocols to verify the credentials of users and control the connection, communication, and data transfer between computers in a Windows environment. For information about Windows authentication, see http://technet.microsoft.com/enus/library/cc755284.aspx.
To secure your database, The Raiser's Edge automatically locks out a user account after a specified number of failed login attempts. To prevent further attempts, a locked user account remains locked for a specified time period. In Configuration, you can configure business rules to specify the number of failed attempts to allow before the program locks the user account and the duration of the lockout.
PA DSS I
M P L EM EN TA TIO N IN
T
HE
R
A ISER
'
S
E
DGE
13
Warning: To comply with PCI DSS, you must require users to change passwords at least every 90 days and lock out a user account after no more than six failed login attempts. You must set the lockout duration to 30 minutes or until a system administrator enables the user account. For information about additional password and lockout requirements for PCI DSS, see
User Account
Management on page 6
.
For additional security, The Raiser's Edge automatically logs out a user when the session is idle for 15 minutes. To activate the workstation, the user must enter the password again.
Cardholder Data
When you update The Raiser's Edge to version 7.9 or later, the program automatically removes all credit card numbers from these records in your database when revisions run the first time you log in:
l
Bio 2 or Org 2 tab on a constituent record
l
Gift record with credit card information
l
Constituent or gift batch that contains credit card information
l
United Way Workplace Giving pledge envelope record that contains credit card information
l
Temporary gift record from NetSolutions
When you enter new credit card information into the program, it automatically sends the data to the
Blackbaud Payment Service for storage and retains the reference number generated by the web service. For reference, only the last four digits of credit card numbers appear in the program.
Your organisation can use attributes, notes, and free-text fields to store important information.
However, do not use these features to store sensitive information, such as payment card or cardholder data, in the program. The abuse or misuse of the program to store sensitive information can leave you vulnerable to an attack by malicious users. For information about the data management requirements of PCI DSS, see
Data Management on page 5
.
Warning: If your organisation used attributes, notes, or free-text fields to store sensitive cardholder information, you must delete these attributes and information from your database. For information about how to delete attributes from The Raiser's Edge, see the Configuration and Security Guide.
Records
When you create a new constituent or gift record, the program automatically sends the credit card information entered to the Blackbaud Payment Service when you click Save and Close. On the saved record, only the last four digits of the credit card number appear.
In accordance with PCI DSS, your organisation must develop and maintain a data retention and disposal policy. You must keep cardholder data storage to a minimum and limit the retention time to only the duration required for business, legal, and regulatory purposes. In Administration, you can use
Globally Change Records to easily remove data such as cardholder name, credit card number, and expiry date from selected records in your database in The Raiser's Edge in accordance with your data retention and disposal policy. For information about Globally Change Records, see the Global Add,
Delete, and Change Guide.
14
C
HAPTER
2
Batch
When you enter credit card information in a batch, the program sends this data to the Blackbaud
Payment Service when you leave the row in the data entry grid and displays only the last four digits of the entered credit card number.
While The Raiser's Edge removes credit card numbers from existing constituent and gift batches and prevents the committal of credit card numbers to records through Batch, temporary files may exist of batches generated with a previous version that contain sensitive cardholder information. To comply with PCI DSS, you must use a real deletion tool to permanently remove temporary files that contain sensitive credit card information.
Tip: Temporary batch files generated by The Raiser's Edge have names that begin with "BB67". The batch files that contain credit card information have an extension of *.mdb. To search for temporary batch files to delete, we recommend you use the search criteria of "BB67*.mdb".
If you use Batch to authorise credit card transactions, The Raiser's Edge does not generate the transmission files used to process these transactions. Instead, the program sends this data to the
Blackbaud Payment Service, which uses your merchant accounts to process the payments through the selected gateways.
Import
When you import credit card information into The Raiser's Edge, the program automatically sends this data to the Blackbaud Payment Service. In the import file generated, only the last four digits of the credit card numbers appear.
Note: The credit card information you import into The Raiser's Edge must be valid and complete.
You cannot import masked credit card numbers into the database. Invalid or incomplete credit card information causes an exception during the import.
Export
In accordance with PCI DSS, you cannot export sensitive cardholder data from The Raiser's Edge 7.9 or later. Exported credit card numbers appear as a series of asterisks followed by the last four digits of the credit card number.
Merchant Accounts
The Raiser's Edge 7.9 or later does not store unencrypted login credentials for merchant accounts in the database. The program uses the Blackbaud Payment Service to store your organisation's merchant account information.
The Raiser's Edge can retrieve your merchant account information from the Blackbaud Payment
Service, with the exception of the login and password required to connect to the merchant account. If your organisation uses additional Blackbaud programs that process payments, such as Blackbaud
NetCommunity, you can now view and select merchant accounts added through that program in The
Raiser's Edge.
PA DSS I
M P L EM EN TA TIO N IN
T
HE
R
A ISER
'
S
E
DGE
15
Authentication Event Log
To help your organisation track users who access the database, The Raiser's Edge maintains an authentication event log. When a user logs into The Raiser's Edge, the program automatically records the event, including the name of the user, the network name of the machine used, the times the user logs in and out, and whether the user connects to the database through The Raiser's Edge or another venue such as an integrated installation of Blackbaud NetCommunity.
To check user login activity, you can access the authentication event log through the database.
l
For a SQL Server database, use the script SELECT * FROM dbo.LOGINAUDIT.
l
For an Oracle database, use the script SELECT * FROM rewin.LOGINAUDIT.
After you complete your query in Microsoft SQL Server Management Studio, you can save the log locally or on your network as a comma-separated value (*.csv) file. On the Results tab, right-click in the grid, select Save Results As, select CSV as the file type, specify the name and location to save the file, and click Save. You can then import the saved file into your centralised logging system.
Electronic Funds Transfer
If your organisation selects to use the Blackbaud Payment Service to store credit card information, you can use the optional module Electronic Funds Transfer to process credit card payments. The
Raiser's Edge does not include unencrypted credit card numbers in the transmission files generated by the credit card process. Instead, the transmission files include the reference number received from the Blackbaud Payment Service for each credit card number. To process credit card transactions,
The Raiser's Edge sends the transmission file to the Blackbaud Payment Service, which replaces the reference numbers with their corresponding credit card numbers and then sends the transmission file to your payment gateway for authorisation. For information about the Blackbaud Payment Service,
see Blackbaud Payment Service and The Raiser's Edge on page 11
.
While The Raiser's Edge 7.9 or later prevents access to the transmission files generated to process credit card transactions, previous versions of the program allowed access to copies of the files to debug or retain for history. When you generated copies of these transmission files, The Raiser's Edge may have created temporary files of the copies. Since these transmission files contain sensitive credit card information, your organisation must securely manage these files in accordance with PCI DSS. To comply with PCI DSS, you must use a real deletion tool to permanently remove temporary files that contain sensitive credit card information. To delete temporary transmission files, search for and delete files with an *.ans or *.req extension.
NetSolutions
If your organisation uses NetSolutions to receive online transactions, NetSolutions automatically sends credit card information entered through the donation page on your website to the Blackbaud
Payment Service instead of The Raiser's Edge. In The Raiser's Edge, transactions received from
NetSolutions include the reference numbers generated by the Blackbaud Payment Service for the credit card number entered on the website. For reference, only the last four digits of the credit card numbers appear in The Raiser's Edge.
16
C
HAPTER
2
NetSolutions does not store login credentials for merchant accounts in your database. You can manage your NetSolutions merchant accounts in The Raiser's Edge, which uses the Blackbaud
Payment Service to store your organisation's merchant account information. For information about
merchant accounts in The Raiser's Edge, see Merchant Accounts on page 14 .
Rollback and Uninstall
Before you install any updates, we strongly recommend you back up your database. For information about the update process, see the Update and New Features Guide.
If you encounter problems during the installation process, you can cancel the installation before it finishes. After you cancel, the install utility returns your machine to its state before the installation. If you complete the installation process but feel the program may have installed improperly, you can sue the Add or Remove Programs utility, available from the Control Panel in Windows-based operating systems, to safely uninstall the application.
All installation and update guides are available from the user guides area of our website at https://www.blackbaud.com/support/guides/guides.aspx.
Services and Protocols
The Raiser's Edge does not require the use of any insecure services or protocols. The services and protocols that The Raiser's Edge requires are Secure Sockets Layer (SSL) v3 and Hypertext Transfer
Protocol Secure (HTTPS).
Revision Information
This guide is reviewed and updated as necessary on a yearly basis and based on changes to The
Raiser's Edge or the PCI DSS and PA DSS specifications. Blackbaud distributes this guide through the user guides page on our website at https://www.blackbaud.com/support/guides/guides.aspx.
Summary of changes
Author
Steve Stegelin
(Technical Writer III)
Revision date
March 2009
Steve Stegelin
(Senior Technical
Writer)
January 2011
Steve Stegelin
(Senior Technical
Writer)
March 2012
Update document template.
Update WEP warning to include WPA2 recommendation; Update references to SSL and TLS with version number; Replace references to "primary account number (PAN)" with "cardholder data";
Remove references to ICVerify; Update
Authentication Event Log on page 15
; Add this table and
Services and Protocols on page 16
.
PA DSS I
M P L EM EN TA TIO N IN
T
HE
R
A ISER
'
S
E
DGE
17
Author
Steve Stegelin
(Information
Architect)
Steve Stegelin
(Information
Architect)
Britt Murray (Staff
Technical Writer)
Lindsey Rix (Senior
Staff Technical
Writer)
Revision date
June 2012
July 2014
December 2015
October 2016
Summary of changes
Update document template; minor edit to remove recent-speaking terms such as "now" and "new".
Update version number to include 7.93.
Update version number to include 7.95. Removed duplicate word,
Guide, from title page.
Updated version number to include 7.96.
Index
A
audit trails authentication event log
B
batch
Blackbaud Payment Service cardholder data encryption in The Raiser's Edge retention
C
D
data management
E
Electronic Funds Transfer encryption cardholder data export
F
firewalls
15
6
14
10
15
14
11
6
13
5
5
7
I
import
Internet-accessible systems
M
manage data firewalls wireless devices merchant accounts
N
NetSolutions network maintenance security non-console administrative access
P
PA DSS
1.1.4
1.1.5
10.1
10.2
10.2.1
10.3.1
14
9
5-6
5
8
9
8
8
8
14
5
7
15
10
6
9
19
I
NDEX
4.1
4.1.1
4.2
8.1
8.2
8.3
8.5
8.5.1
8.5.10
8.5.11
1.3.9
10.2
10.3
12.3
2.1.1
2.3
3.1
3.2
10.3.2
11.2
11.3
12.1
13.1
13.1.2
2.1
3.1
3.2
4.2
5.4
6.1
6.2
6.3
9.1
overview
PCI DSS
1.3
9
13
5
9
8
10
10
7
8
6 ,
12
7
6
8
7
7
6
6
6
8
16
8
8
8
7 ,
9
4
9
16
5
6 ,
12
6
10
8
6 ,
9
8
8
8.5.12
8.5.13
8.5.14
8.5.15
8.5.2
8.5.3
8.5.4
8.5.5
8.5.6
8.5.7
8.5.8
8.5.9
overview protocols purge cardholder data sensitive authentication data
R
records remote access rollback
S
sensitive authentication data retention services system maintenance
U
uninstall user accounts in The Raiser's Edge management
16
12
6
5
16
9
7
7
7
6
7
7
7
7
7
7
4
16
7
7
5
5
13
8
16
wireless devices
W
8
I
N DEX
20
