Unitec Sierra Server Management Application Guide
Below you will find brief information for Sierra Server 1.76.X.X, Portal Ti, Sentinel, C-Start, Washpay. Sierra Server provides payment and management capabilities for Unitec Car Wash terminals. It's factory installed and operates with Windows 7 POSReady. The system connects to terminals such as Portal Ti and Sentinel to process credit card payments.
Advertisement
Advertisement
Sierra Server
Version: 1.76.X.X
PA-DSS 3.2 Implementation Guide
Document Version:
2017
Date: July 1, 2017
Document Owners
Will Severe
Solutions and Security Analyst
Unitec, LLC.
Confidential Information
The information contained in this document is Unitec
Inc. confidential. Distribution of this document outside of Unitec, LLC. is strictly prohibited. Do not copy or distribute without the permission of the Chief
Technology Officer.
Table of Contents
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
2
Notice
THE INFORMATION IN THIS DOCUMENT IS FOR INFORMATIONAL PURPOSES ONLY. UNITEC
MAKES NO REPRESENTATION OR WARRANTY AS TO THE ACCURACY OR THE COMPLETENESS OF
THE INFORMATION CONTAINED HEREIN. YOU ACKNOWLEDGE AND AGREE THAT THIS
INFORMATION IS PROVIDED TO YOU ON THE CONDITION THAT NEITHER UNITEC NOR ANY OF
ITS AFFILIATES OR REPRESENTATIVES WILL HAVE ANY LIABILITY IN RESPECT OF, OR AS A RESULT
OF, THE USE OF THIS INFORMATION. IN ADDITION, YOU ACKNOWLEDGE AND AGREE THAT YOU
ARE SOLELY RESPONSIBLE FOR MAKING YOUR OWN DECISIONS BASED ON THE INFORMATION
HEREIN.
Nothing herein shall be construed as limiting or reducing your obligations to comply with any applicable laws, regulations or industry standards relating to security or otherwise including, but not limited to PCI PA-DSS and DSS.
The retailer may undertake activities that may affect compliance. For this reason, Unitec, LLC. is required to be specific to only the standard software provided by it.
About this Document
This document describes the steps that must be followed in order for your Sierra Server installations to comply with Payment Application – Data Security Standards (PA-DSS). The information in this document is based on PCI Security Standards Council Payment Application -
Data Security Standards program (version 3.2 dated June 2016)
1
.
Unitec, LLC. instructs and advises its customers to deploy Unitec, LLC. applications in a manner that adheres to the PCI Data Security Standard (v3.2). Subsequent to this, best practices and hardening methods, such as those referenced by the Center for Internet Security (CIS) and their various “Benchmarks”, should be followed in order to enhance system logging, reduce the chance of intrusion and increase the ability to detect intrusion, as well as other general recommendations to secure networking environments. Such methods include, but are not limited to, enabling operating system auditing subsystems, system logging of individual servers to a centralized logging server, the disabling of infrequently-used or frequently vulnerable networking protocols and the implementation of certificate-based protocols for access to servers by users and vendors.
You must follow the steps outlined in this Implementation Guide in order for your Sierra Server installation to support your PCI DSS compliance efforts.
1
PCI PA-DSS 3.2
can be downloaded from the PCI SSC Document Library.
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
4
Revision Information
Name Versi on
Date of Update
Will Severe 2017 1-July-2017
Summary of Changes
Release for 2017 under PA-DSS 3.2
Note: This PA-DSS Implementation Guide must be reviewed on a yearly basis, whenever the underlying application changes or whenever the PA-DSS requirements change. Updates should be tracked and reasonable accommodations should be made to distribute or make the updated guide available to users. A copy of this guide is included with products shipped from the factory and customers may also download the latest version from the SUPPORT section of the Unitec
WEB site at www.startwithunitec.com
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
5
Executive Summary
Sierra Server 1.76.X.X has been Payment Application - Data Security Standard (PA-DSS) validated, in accordance with PA-DSS Version 3.2. For the PA-DSS assessment, we worked with the following
PCI SSC approved Payment Application Qualified Security Assessor (PAQSA):
Coalfire Systems, Inc.
11000 Westmoor Circle, Suite 450,
Westminster, CO 80021
Coalfire Systems, Inc.
1633 Westlake Ave N #100
Seattle, WA 98109
This document also explains the Payment Card Industry (PCI) initiative and the Payment
Application Data Security Standard (PA-DSS) guidelines. The document then provides specific installation, configuration, and ongoing management best practices for using Unitec, LLC.’s Sierra
Server Version 1.76.X.X as a PA-DSS validated Application operating in a PCI DSS compliant environment.
PCI Security Standards Council Reference Documents
The following documents provide additional detail surrounding the PCI SSC and related security programs (PA-DSS, PCI DSS, etc):
Payment Card Industry Payment Applications - Data Security Standard (PCI PA-DSS) https://www.pcisecuritystandards.org/security_standards/index.php
Payment Card Industry Data Security Standard (PCI DSS) https://www.pcisecuritystandards.org/security_standards/index.php
Open Web Application Security Project (OWASP) http://www.owasp.org
Center for Internet Security (CIS) Benchmarks (used for OS Hardening) https://benchmarks.cisecurity.org/downloads/multiform/
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
6
Application Summary
Payment Application
Name
Application
Description
Sierra Server
Payment
Application
Version
1.76.X.X
The Sierra Server application provides payment and management capabilities to Unitec Car Wash terminals. It is factory installed on a Unitec supplied site controller or the Car Wash terminal and operates with the Windows7
POSReady embedded Operating System.
Typical Role of
Application
Sierra Server was designed for use in the Automatic Car Wash market
Target Market for
Payment Application
Target Market for Payment Application (check all that apply):
X Retail e-Commerce
Others (please specify):
Processors X Gas/Oil
X Small/medium merchants
The following is a brief description of files and tables that store cardholder data:
File or Table Name
Description of Stored
Cardholder Data
Stored Cardholder
Data
No card holder data is stored by the application. N/A
Individual access to cardholder data is logged as follows:
Card holder data is not retained or accessible at any time.
Components of the
Payment Application
Required Third Party
Payment Application
Software
The following are the application-vendor-developed components which comprise the payment application:
Sierra Server is the server application of a Unitec Car Wash system and works exclusively with a ‘client’ software applications that run on a Unitec Portal Ti,
Sentinel, C-Start or Washpay terminal. The system is supplied with a factory configured network router as shown in the Network Diagram (later in this document).
The following are additional third party payment application components required by the payment application:
DSIClientX (Version 3.85) from Datacap Systems, which connects to a server hosted by Mercury Payment Systems
Database Software
Supported
The following are database management systems supported by the payment application:
Sierra Server databases use SQL Express 2012 database software
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
7
Other Required
Third Party Software
The following are other required third party software components required by the payment application:
.Net Framework version 4.5.50709 (Microsoft)
IIS Version 7.5.7600.16385 (Microsoft)
Required Hardware
The following are Hardware Systems required by the payment application:
Unitec Portal Ti Kiosk
Unitec Sentinel Kiosk
Unitec C-Start Kiosk
Unitec Washpay Paynode
The following are Operating Systems supported or required by the payment application:
Operating System(s)
Supported
Windows Embedded POSReady 7
Application
Authentication
Application
Encryption
The Sierra Server application is accessed via a set of web pages, the Sierra
Management Interface, which are hosted on the system where the application is running. Access is controlled by a username/password authentication mechanism which follows PA-DSS 3.2. Passwords are protected by using the
SHA-512 hash function in conjunction with a cryptographically secure pseudorandom number generated 64-byte salt (new salt per password creation), and stored in the SQL database.
Sierra Server utilizes a 128-bit implementation of the Rijndael Algorithm to encrypt cardholder data in transit, as well as while in RAM. CHD is never written to any database or file storage location.
Application
Functionality
Supported
Payment Processing
Connections:
Payment Application Functionality (check only one):
Automated Fuel
Dispenser
Card-Not-Present
POS Admin
X POS Kiosk
POS Specialized
POS Suite/General
POS Face-to-Face/POI Payment Back Office
Payment Gateway/Switch
Payment Middleware
Payment Module
Shopping Cart & Store Front
Priority Wash, utilizing MX Merchant API
Mercury Payment Systems (Vantiv), utilizing Datacap Dsi Client
Chase Paymentech, utilizing Payment Express SCR200 EMV terminal,
Datacap Dial Tran (for dial processing) or IP Tran (for Internet)
Elavon (NOVA), utilizing Datacap Dial Tran (for dial processing) or IP Tran
(for
Internet)
First Data Atlanta (Buypass), utilizing Datacap Dial Tran (for dial processing) or IP Tran (for Internet)
First Data Omaha, utilizing Datacap Dial Tran (for dial processing
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
8
Description of Listing
Versioning
Methodology
Tsys (Visanet), utilizing Datacap Dial Tran (for dial processing) or IP Tran
(for Internet)
Unitec uses a Major-Minor-Quarter-Revision versioning scheme, such as X.Yy.Z.abcd
X – The major version number. Updates only when major changes, like an entire re-design of a significant portion of the solution are made. These changes require a full PA-DSS validation.
Yy – An incremental, minor portion of the version number. This number stays the same through the entire year and increments by ‘y’ every year. This number ranges from 0 to 9. After the 10 th
year, the ‘Y’ would be incremented by 1 as well. These changes require a no-impact, low-impact or high-impact change
PA-DSS validation.
Z – The quarterly counter. This value can only be 1, 2, 3, 4 – indicating the quarter of the year. This is a Wildcard incremented for changes that do not require PA-DSS validation.
abcd – Source code revision. Always available, but not displayed anywhere for official, proper quarterly releases. This is a Wildcard incremented for changes that do not require PA-DSS validation.
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
9
Typical Network Implementation
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
10
Credit/Debit Cardholder Dataflow Diagram
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
11
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
12
Difference between PCI Compliance and PA-DSS Validation
As a software vendor who develops payment applications, our responsibility is to be “PA-DSS
Validated.” We have performed an assessment and payment application validation review with our independent assessment firm (PAQSA), to ensure that our platform does conform to industry best practices when handling, managing and storing payment related information.
PA-DSS Version 3.2 is the standard against which Payment Application has been tested, assessed, and validated.
PCI Compliance is then later obtained by the merchant, and is an assessment of your actual server
(or hosting) environment called the Cardholder Data Environment (CDE).
Obtaining “PCI Compliance” is the responsibility of you the merchant and your hosting provider, working together, using PCI compliant architecture with proper hardware & software configurations and access control procedures.
The PA-DSS Validation is intended to ensure that Sierra Server will help you facilitate and maintain
PCI Compliance with respect to how the payment application handles user accounts, passwords, encryption, and other payment data related information.
The Payment Card Industry (PCI) has developed security standards for handling cardholder information in a published standard called the PCI Data Security Standard (DSS). The security requirements defined in the DSS apply to all members, merchants, and service providers that store, process, or transmit cardholder data.
The PCI DSS requirements apply to all system components within the payment application environment which is defined as any network device, host, or application included in, or connected to, a network segment where cardholder data is stored, processed or transmitted.
The 12 Requirements of the PCI DSS:
Build and Maintain a Secure Network and Systems
1. Install and maintain a firewall configuration to protect cardholder data
2. Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data
3. Protect stored cardholder data
4. Encrypt transmission of cardholder data across open, public networks
Maintain a Vulnerability Management Program
5. Protect all systems against malware and regularly update anti-virus software or programs
6. Develop and maintain secure systems and applications
Implement Strong Access Control Measures
7. Restrict access to cardholder data by business need-to-know
8. Identify and authenticate access to system components
9. Restrict physical access to cardholder data
Regularly Monitor and Test Networks
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
13
10. Track and monitor all access to network resources and cardholder data
11. Regularly test security systems and processes
Maintain an Information Security Policy
12. Maintain a policy that addresses information security for all personnel
Considerations for the Implementation of Payment
Application in a PCI-Compliant Environment
The following areas must be considered for proper implementation in a PCI-Compliant environment.
Remove Historical Sensitive Authentication Data
Handling of Sensitive Authentication Data
Secure Deletion of Cardholder Data
All PAN is masked by default
Cardholder Data Encryption & Key Management
Removal of Historical Cryptographic Material
Remove Historical Sensitive Authentication Data (PA-DSS 1.1.4)
Sierra Server retains only cardholder data elements that are allowed per the PCI DSS. It should be noted however that version 1.12 did store full track 2 contents – in encrypted form – prior to authorization. This data was deleted from the database upon authorization but there are no tools available to securely wipe trace data from the storage device (the D-Drive flash card). To comply with this requirement, Sierra Server installations with version 1.12 should be updated as follows:
Acquire the necessary hardware and update utilities to update Sierra Server from version
1.12 to the current version from Unitec.
Apply the software upgrade in accordance with the instructions provided with the upgrade utility.
Save a database back up onto a thumbdrive by following the procedures described in the
Operator’s Manual.
Install the new D-drive that contains the compliant version of Sierra Server. Use the restore function to copy the database from the thumbdrive onto the new D-Drive. Use of the restore function does not transfer either historic or cryptographic material including track data.
The replaced D Drive may house sensitive data and must be securely destroyed. Secure removal of previously stored Sensitive Authentication Data is absolutely necessary for PCI DSS compliance.
Unitec uses a 3 rd
party service to handle the destruction of these drives. Upon completion of the update process described above, any replaced D Drive older than version 1.24 must be returned to Unitec Customer Service through a secure courier (e.g. Fed-ex, UPS) so it can be destroyed. Unitec ensures the secure handling and destruction of all received D Drives through
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
14
contract with a media destruction service who incinerates the drives in a secured environment and provides Certificates of Destruction which are archived at Unitec.
Handling of Sensitive Authentication Data (PA-DSS 1.1.5)
Unitec Sierra Server does not collect or store Sensitive Authentication Data for any reason, and we strongly recommend that you do not do this either. However, if for any reason you should do so, the following guidelines must be followed when dealing with Sensitive Authentication Data used for pre-authorization (swipe data, validation values or codes, PIN or PIN block data):
Collect sensitive authentication data only when needed to solve a specific problem
Store such data only in specific, known locations with limited access
Collect only the limited amount of data needed to solve a specific problem
Encrypt sensitive authentication data while stored
Securely delete such data immediately after use
Secure Deletion of Cardholder Data (PA-DSS 2.1)
Sierra Server does not store cardholder data and therefore there is no data to be purged by the application as required by PA-DSS v3.2.
Any cardholder data you store outside of the application must be documented and you must define a retention period at which time you will securely delete (render irretrievable) the stored cardholder data. When defining a retention period you must take into account legal, regulatory, or business purpose.
All underlying software (this includes operating systems and/or database systems) must be configured to prevent the inadvertent capture of PAN. Instructions for configuring the underlying operating systems and/or databases can be found in Appendix A.
All PAN is Masked by Default (PA-DSS 2.2)
Sierra Server does not have the ability to display full PAN for any reason and therefore there is no configuration details to be provided as required for PA-DSS v3.2. Truncated PAN, limited to Last-
4 digits, can be found in the following locations:
SQL Database (Unitec.mdf, DeferredPayment and HotFile tables) – Last 4 digits only.
Application Logs (Unitec.Siteserver_yyyy-mm-dd.log, Unitec.CStart_yyyy-mm-dd.log) –
Truncated PAN as either “*”+ last 4, or only last 4.
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
15
Customer receipts – Last 4 digits only.
Transaction Reports (summary and detail) – Last 4 digits only.
Cardholder Data Encryption & Key Management (PA-DSS 2.3, 2.4, and 2.5)
Sierra Server does not store cardholder data in any way nor does it provide any configurability that would allow a merchant to store cardholder data, therefore no encryption of cardholder data is required for PA-DSS v3.2.
Removal of Historical Cryptographic Material (PA-DSS 2.6)
Sierra Server Version 1.12 encrypted cardholder data that was stored pre-authorization. As there are no tools available for removing cryptographic materials, customers using version 1.12 should upgrade their products following the procedure previously described (under the section titled
“Remove Historical Sensitive Authentication Data”)
Set up Strong Access Controls (3.1 and 3.2)
The PCI DSS requires that access to all systems in the payment processing environment, including all PCs, servers, and databases with cardholder data or with payment applications; be protected through use of unique users and complex passwords. Unique user accounts indicate that every account used is associated with an individual user and/or process with no use of generic group accounts used by more than one user or process.
The following roles within the application have administrative access:
User Management
Utilities (including access to the credit mode setup parameters and any other PCI-related setup)
All authentication credentials are generated and managed by the application. Secure authentication is enforced automatically by the payment application for all credentials by the completion of the initial installation and for any subsequent changes (for example, any changes that result in user accounts reverting to default settings, any changes to existing account settings, or changes that generate new accounts or recreate existing accounts). To maintain PCI DSS compliance the following 11 points must be followed per the PCI DSS:
1. The payment application must not use or require the use of default administrative accounts for other necessary or required software (for example, database default administrative accounts) (PCI DSS 2.1 / PA-DSS 3.1.1)
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
16
2. The payment application must enforce the changing of all default application passwords for all accounts that are generated or managed by the application, by the completion of installation and for subsequent changes after the installation (this applies to all accounts, including user accounts, application and service accounts, and accounts used by Unitec,
LLC. for support purposes) (PCI DSS 2.1 / PA-DSS 3.1.2)
3. The payment application must assign unique IDs for all user accounts. (PCI DSS 8.1.1 / PA-
DSS 3.1.3)
4. The payment application must provide at least one of the following three methods to authenticate users: (PCI DSS 8.2 / PA-DSS 3.1.4) a. Something you know, such as a password or passphrase b. Something you have, such as a token device or smart card c. Something you are, such as a biometric
5. The payment application must NOT require or use any group, shared, or generic accounts and passwords (PCI DSS 8.5 / PA-DSS 3.1.5)
6. The payment application requires passwords must to be at least 7 characters and includes both numeric and alphabetic characters (PCI DSS 8.2.3 / PA-DSS 3.1.6)
7. The payment application requires passwords to be changed at least every 90 days (PCI
DSS 8.2.4 / PA-DSS 3.1.7)
8. The payment application keeps password history and requires that a new password is different than any of the last four passwords used (PCI DSS 8.2.5 / PA-DSS 3.1.8)
9. The payment application limits repeated access attempts by locking out the user account after not more than six logon attempts (PCI DSS 8.1.6 / PA-DSS 3.1.9)
10. The payment application sets the lockout duration to a minimum of 30 minutes or until an administrator enables the user ID. (PCI DSS 8.1.7 / PA-DSS 3.1.10)
11. The payment application requires the user to re-authenticate to re-activate the session if the application session has been idle for more than 15 minutes. (PCI DSS 8.1.8 / PA-DSS
3.1.11)
Sierra Server is shipped with a factory default Administrative account. Upon first login with default user credentials, the user will be prompted and required to change the account password.
The password for this account can be changed at any time as follows:
After log-in, select SET-UP from the main menu options
Select USERS from the sub-menu that’s shown on the left side of the page
Click on the EDIT button shown for the default account and enter a new password. As described above, your password must be at least 7 characters and include both alpha and numeric characters.
Re-enter your new password in the ‘confirm password’ box then click on the SAVE button to complete the change.
Your password will be valid for 90 days only. As your password expiration date approaches, you will be notified that the password will expire each time you log in to the management application and prompted to reset your password. Follow the procedure described above to enter a new password (Note - Your new password must not be the same as any of the last passwords used).
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
17
Properly Train and Monitor Admin Personnel
It is your responsibility to institute proper personnel management techniques for allowing admin user access to cardholder data, site data, etc. You can control whether each individual admin user can see credit card PAN (or only last 4).
In most systems, a security breach is the result of unethical personnel. So pay special attention to whom you trust into your admin site and who you allow to view full decrypted and unmasked payment information.
Log settings must be compliant (PA-DSS 4.1.b, 4.4.b)
4.1.b: Sierra Server has PA-DSS compliant logging enabled by default. This logging is not configurable and may not be disabled. Disabling or subverting the logging function of Sierra
Server in any way will result in non-compliance with PCI DSS. Logs may be accessed by:
1. Log in to the Sierra Management Application and select the UTILITIES option.
2. Select LOGS from the list of functions shown in the Utilities menu
3. Select System.Log from the drop down list provided in the ‘Log File’ menu box and click on the VIEW LOG button to display the log contents.
4. To save the log file (in .CSV format) click on the SAVE button, select the SAVE option and the drive and folder where the log is to be saved.
Implement automated assessment trails for all system components to reconstruct the following events:
10.2.1 All individual user accesses to cardholder data from the application
10.2.2 All actions taken by any individual with administrative privileges in the application
10.2.3 Access to application audit trails managed by or within the application
10.2.4 Invalid logical access attempts
10.2.5 Use of the application’s identification and authentication mechanisms (including but not limited to creation of new accounts, elevation of privileges, etc.) and all changes, additions, deletions to application accounts with root or administrative privileges
10.2.6 Initialization, stopping, or pausing of the application audit logs
10.2.7 Creation and deletion of system-level objects within or by the application
Record at least the following assessment trail entries for all system components for each event from 10.2.x above:
10.3.1 User identification
10.3.2 Type of event
10.3.3 Date and time
10.3.4 Success or failure indication
10.3.5 Origination of event
10.3.6 Identity or name of affected data, system component, or resource.
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
18
Disabling or subverting the logging function of Sierra Server in any way will result in noncompliance with PCI DSS.
4.4.b: Sierra Server facilitates centralized logging.
Payment application logs required per the PA-DSS can be retrieved through the Sierra
Management Application and saved on to a thumbdrive or other media for use in a centralized logging system. Sierra Server log files are saved as .CSV files. To access the log files:
1. Log in to the Sierra Management Application and select the UTILITIES option.
2. Select LOGS from the list of functions shown in the Utilities menu
3. Select System.Log from the drop down list provided in the ‘Log File’ menu box and click on the VIEW LOG button to display the log contents.
4. To save the log file (in .CSV format) click on the SAVE button, select the SAVE option and the drive and folder where the log is to be saved.
It should be noted that a log file’s size is limited and when its capacity is reached, a new file will start. The current file will be named System.log and previous files will be appended with a sequential digit as System.log1, System.log2 etc… up to System.log7 with System.log1 being the most recent. The (8) most recent log files will be stored.
For more details on accessing in navigating through the Management application, refer to the
Sierra Server User’s Manual.
PCI-Compliant Wireless settings (PA-DSS 6.1.a and 6.2.b)
Sierra Server does not support wireless technologies. However, should the merchant implement wireless access within the cardholder data environment, the following guidelines for secure wireless settings must be followed per PCI Data Security Standard 1.2.3, 2.1.1 and 4.1.1:
2.1.1: Change wireless vendor defaults per the following 5 points:
1. Encryption keys must be changed from default at installation, and must be changed anytime anyone with knowledge of the keys leaves the company or changes positions
2. Default SNMP community strings on wireless devices must be changed
3. Default passwords/passphrases on access points must be changed
4. Firmware on wireless devices must be updated to support strong encryption for authentication and transmission over wireless networks
5. Other security-related wireless vendor defaults, if applicable, must be changed
1.2.3: Perimeter firewalls must be installed between any wireless networks and systems that store cardholder data, and these firewalls must deny or control (if such traffic is necessary for business purposes) any traffic from the wireless environment into the cardholder data environment.
4.1.1: Industry best practices (for example, IEEE 802.11.i) must be used to implement strong encryption for authentication and transmission of cardholder data.
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
19
Note: The use of WEP as a security control was prohibited as of June 30, 2010.
Services and Protocols (PA-DSS 8.2.c)
Sierra Server does not require the use of any insecure services or protocols. Here are the services and protocols that Sierra Server does require:
Application Experience
Application Host Helper Service
Application Management
Base Filtering Engine
Certificate Propagation
Client for NFS
COM+ Event System
Computer Browser
Cryptographic Services
DCOM Server Process Launcher
Desktop Window Manager Session Manager
DHCP Client
Diagnostic Policy Service
Diagnostic System Host
Dialog Box Filter
Distributed Link Tracking Client
DNS Client
EasyMail SMTP Express
Function Discovery Resource Publication
Group Policy Client
IKE and AuthIP IPsec Keying Modules
IP Helper
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
20
IPsec Policy Agent
Keyboard Filter
LPD Service
Message Queuing
Message Queuing Triggers
Multimedia Class Scheduler
Net.Msmq Listener Adapter
Net.Pipe Listener Adapter
Net.Tcp Listener Adapter
Net.Tcp Port Sharing Service
Network List Service
Network Location Awareness
Network Store Interface Service
Offline Files
Plug and Play
Power
Print Spooler
Remote Desktop Configuration
Remote Desktop Services
Remote Desktop Services UserMode Port Redirector
Remote Procedure Call (RPC)
RIP Listener
RPC Endpoint Mapper
Security Accounts Manager
Security Center
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
21
Server
Simple TCP/IP Services
Site Server
Software Protection
SQL Server (SQLEXPRESS)
SQL Server VSS Writer
System Event Notification Service
Tablet PC Input Service
Task Scheduler tbupddwu
TCP/IP NetBIOS Helper
TLS 1.2
User Profile Service
Windows Audio
Windows Audio Endpoint Builder
Windows Defender
Windows Driver Foundation - User-mode Driver Framework
Windows Event Log
Windows Font Cache Service
Windows Management Instrumentation
Windows Modules Installer
Windows Process Activation Service
Windows Search
Windows Update
WinHTTP Web Proxy Auto-Discovery Service
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
22
Workstation
Never store cardholder data on internet-accessible systems (PA-
DSS 9.1.c)
Never store cardholder data on Internet-accessible systems (e.g., web server and database server must not be on same server.)
For customers whom wish to enable access from the Internet to the Sierra Management
Application, the system must be installed behind a properly configured firewall, with port 9810 forwarded to the Sierra Server host system for TCP (HTTP) communications. It is not recommended to configure the system to a DMZ.
Incoming 9810 will support HTTP access to the web page. Outbound traffic will be limited to encrypted credit transactions (TLS1.2 and/or SSL), and possibly outgoing email messages.
PCI-Compliant Remote Access (10.1)
The PCI standard requires that if employees, administrators, or vendors are granted remote access to the payment processing environment; access should be authenticated using a twofactor authentication mechanism. The means two of the following three authentication methods must be used:
1. Something you know, such as a password or passphrase
2. Something you have, such as a token device or smart card
3. Something you are, such as a biometric
Sierra Server does not accommodate remote access by default but does allow Remote Desktop
(RD) to be temporarily enabled for troubleshooting purpose. This action requires an
Administrative password for Sierra Server access (Something you know) and a unique activation code (or token) that is issued by Unitec (something you have). The activation code is valid for one day only.
PCI-Compliant Delivery of Updates (PA-DSS 10.2.1.a, 7.2.3)
Unitec delivers patches and updates in a secure manner:
As a development company, we keep abreast of the relevant security concerns and vulnerabilities in our area of development and expertise.
We do this by subscribing to Microsoft security alert services and by regularly testing Sierra
Server with a security scanning tool (Nessus Vulnerability Scanner). Once we identify a relevant vulnerability, we work to develop & test a product update that helps protect Sierra Server against the specific, new vulnerability.
In most cases, the update will require a change to the Windows Operating System (OS) and depend on associated patches issued by Microsoft. These patches are incorporated by Unitec, tested and released as a new OS version. When a new OS version is released, an update program (or utility) is developed for applying the OS update to previously deployed units. New
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
23
OS versions and update programs are issued quarterly, and all resellers and customers are notified of release and availability via Unitec’s website, www.startwithunitec.com
, as well as electronics newsletters and direct mailings.
We do not deliver software updates via remote access to customer networks. Instead, software updates are provided as a utility that’s loaded onto a USB thumbdrive that can be ordered from
Unitec, LLC. Sierra Server uses a digital signature technique based on a salted SHA-512 hash of the utility contents to ensure the integrity of an update program. This security measure ensures any update applied to Sierra Server is from a known and trusted source and eliminates the possibility of installing invalid files or programs.
The process for installing a software update is as follows:
1. Acquire the update program from your Unitec distributor (USB Thumb Drives containing the update utility are ordered and shipped from Unitec, LLC. via UPS/FedEx/USPS).
2. Connect the thumbdrive with the update program to a USB port on the site server or terminal (depending on which device Sierra Server is installed).
3. Log on to the management system and select the UTILITIES Menu tab
4. From the Utilities page, select FILES from the list of Utilities functions and click on the
‘Load Update Files’ button. A message will be displayed when the file loading is complete.
The update will be installed the next time Sierra Server is restarted.
5. To restart Sierra Server (and install the update), select SYSTEM from the list of Utilities functions and click on the ‘Restart Server’ button at the bottom of the page (Note: As this will cause the system to go out of service temporarily, confirm that the site is idle before restarting the server.
PCI-Compliant Remote Access (10.2.3.a)
The PCI standard requires that if employees, administrators, or vendors are granted remote access to the payment processing environment; access should be authenticated using a twofactor authentication mechanism (username/ password and an additional authentication item such as a token or certificate).
In the case of vendor remote access accounts, in addition to the standard access controls, vendor accounts should only be active while access is required to provide service. Access rights should include only the access rights required for the service rendered, and should be robustly audited.
If users and hosts within the payment application environment may need to use third-party remote access software such as Remote Desktop (RDP)/Terminal Server, etc. to access other hosts within the payment processing environment, special care must be taken.
In order to be compliant, every such session must be encrypted with at least 128-bit encryption
(in addition to satisfying the requirement for two-factor authentication required for users connecting from outside the payment processing environment). For Remote Desktop
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
24
(RDP)/Terminal Server this means using the high encryption setting on the server. Additionally, the PCI user account and password requirements will apply to these access methods as well.
When requesting support from a vendor, reseller, or integrator, customers are advised to take the following precautions:
Change default settings (such as usernames and passwords) on remote access software (e.g. VNC)
Allow connections only from specific IP and/or MAC addresses
Use strong authentication and complex passwords for logins according to PA-DSS
3.1.1 – 3.1.10 and PCI DSS 8.1, 8.3, and 8.5.8-8.5.15
Enable encrypted data transmission according to PA-DSS 12.1 and PCI DSS 4.1
Enable account lockouts after a certain number of failed login attempts according to
PA-DSS 3.1.8 and PCI DSS 8.5.13
Require that remote access take place over a VPN via a firewall as opposed to allowing connections directly from the internet
Enable logging for auditing purposes
Restrict access to customer passwords to authorized reseller/integrator personnel.
Establish customer passwords according to PA-DSS 3.1.1 – 3.1.10 and PCI DSS
Requirements 8.1, 8.2, 8.4, and 8.5.
As previously mentioned, Sierra Server allows Remote Desktop to be temporarily enabled for troubleshooting. As outlined in the text above any use of this feature outside of the secure network must be secured through a VPN.
Data Transport Encryption (PA-DSS 11.1.b)
The PCI DSS requires the use of strong cryptography and encryption techniques with at least a
128 bit encryption strength (either at the transport layer with TLS 1.1/1.2 or IPSEC; or at the data layer with algorithms such as RSA or Triple-DES) to safeguard cardholder data during transmission over public networks (this includes the Internet and Internet accessible DMZ network segments).
PCI DSS requirement 4.1: Use strong cryptography and security protocols such as transport layer security (TLS 1.1 / TLS 1.2) and Internet protocol security (IPSEC) to safeguard sensitive cardholder data during transmission over open, public networks.
Examples of open, public networks that are in scope of the PCI DSS are:
The Internet
Wireless technologies
Global System for Mobile Communications (GSM)
General Packet Radio Service (GPRS)
Refer to the Dataflow diagram for an understanding of the flow of encrypted data associated with
Sierra Server.
Sierra Server is not designed or developed to use any wireless components.
PCI-Compliant Use of End User Messaging Technologies (PA-DSS
11.2.b)
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
25
Sierra Server does not allow or facilitate the sending of PANs via any end user messaging technology (for example, e-mail, instant messaging, and chat).
PCI requires that cardholder information sent via any end user messaging technology must use strong encryption of the data.
Non-console administration and Multi-Factor Authentication (PA-
DSS 12.1, 12.2)
Sierra Server allows non-console (remote) administration via a web page interface. Because Sierra
Server allows such access, multi-factor authentication (at least 2 of something you know, something you have, something you are) must be utilized when accessing Sierra Server over these technologies.
When accessing Sierra Server over non-console methods, Sierra Server utilizes an integrated SMS verification code delivery mechanism to provide MFA control over such access. In order to properly utilize the MFA solution:
On initial installation and setup, when the Owner user is prompted to change the default password, they are also required to enter a valid phone number that is capable of receiving SMS messages to be used with the Unitec MFA solution.
Additional users who are configured with Administrative Access will be required to have an MFA phone number as part of their user profile.
When an Administrative User, who is connecting via web browser from a remote system, enters their User ID and Password, they will be presented with an MFA web page displaying the associated SMS phone number (masked) and a prompt to generate an expiring validation code.
Once the user selects to generate a validation code, a 6-digit validation code will be sent via SMS to the associated phone number. The user will have 5 minutes to enter the code and complete the login process. This validation code is not stored by the application, and expires after use or 5 minutes, whichever occurs first.
If the code is not entered within the allotted time frame, or is entered incorrectly, the user will be denied access and can repeat the MFA process.
Network Segmentation
The PCI DSS requires that firewall services be used (with NAT or PAT) to segment network segments into logical security domains based on the environmental needs for internet access.
Traditionally, this corresponds to the creation of at least a DMZ and a trusted network segment where only authorized, business-justified traffic from the DMZ is allowed to connect to the trusted segment. No direct incoming internet traffic to the trusted application environment can be allowed. Additionally, outbound internet access from the trusted segment must be limited to required and justified ports and services.
Refer to the standardized Network diagram for an understanding of the flow of encrypted data associated with Sierra Server.
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
26
Maintain an Information Security Program
In addition to the preceding security recommendations, a comprehensive approach to assessing and maintaining the security compliance of the payment application environment is necessary to protect the organization and sensitive cardholder data.
The following is a very basic plan every merchant/service provider should adopt in developing and implementing a security policy and program:
Read the PCI DSS in full and perform a security gap analysis. Identify any gaps between existing practices in your organization and those outlined by the PCI requirements.
Once the gaps are identified, determine the steps to close the gaps and protect cardholder data. Changes could mean adding new technologies to shore up firewall and perimeter controls, or increasing the logging and archiving procedures associated with transaction data.
Create an action plan for on-going compliance and assessment.
Implement, monitor and maintain the plan. Compliance is not a one-time event.
Regardless of merchant or service provider level, all entities should complete annual selfassessments using the PCI Self Assessment Questionnaire.
Call in outside experts as needed.
Payment Application Initial Setup & Configuration
As Sierra Server is factory installed onto Unitec proprietary hardware products, there’s no field installation of software required and minimal set-up. To ensure compliance with PCI-DSS, the merchant must remember to reset the default password for the Administrative account.
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
27
Appendix A: Addressing Inadvertent Capture of PAN
Addressing Inadvertent Capture of PAN on WINDOWS 7
Disabling System Restore – Windows 7
Right Click on Computer > Select “Properties”
Select “System Protection” on the top left list, the following screen will appear:
Select Configure, the following screen will appear:
Select “Turn off system protection”
Click apply, and OK to shut the System Protection window
Click OK again to shut the System Properties window
Reboot the computer
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
28
Encrypting PageFile.sys – Windows 7
* Please note that in order to perform this operation the hard disk must be formatted using NTFS.
Click on the Windows “Orb” and in the search box type in “cmd”.
Right click on cmd.exe and select “Run as Administrator”
To Encrypt the Pagefile type the following command: fsutil behavior set
EncryptPagingFile 1
To verify configuration type the following command: fsutil behavior query
EncryptPagingFile
If encryption is enabled EncryptPagingFile = 1 should appear
In the event you need to disable PageFile encryption type the following command: fsutil behavior set EncryptPagingFile 0
To verify configuration type the following command: fsutil behavior query
EncryptPagingFile
If encryption is disabled EncryptPagingFile = 0 should appear
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
29
Clear the System Pagefile.sys on shutdown
Windows has the ability to clear the Pagefile.sys upon system shutdown. This will purge all temporary data from the pagefile.sys (temporary data may include system and application passwords, cardholder data (PAN/Track), etc.).
NOTE: Enabling this feature may increase windows shutdown time.
Click on the Windows “Orb” and in the search box type in “regedit”.
Right click on regedit.exe and select “Run as Administrator”
Navigate to HKLM\System\CurrentControlSet\Control\Session Manager\Memory
Management
Change the value from 0 to 1
Click OK and close Regedit
If the value does not exist, add the following: o Value Name: ClearPageFileAtShutdown o Value Type: REG_DWORD o Value: 1
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
30
Disabling System Management of PageFile.sys – Windows 7
Right Click on Computer > Select “Properties”
Select “Advanced System Settings” on the top left list, the following screen will appear:
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
31
Under performance select “Settings” and go to the “Advanced” tab, the following screen will appear:
Select “Change” under Virtual Memory, the following screen will appear:
Uncheck “Automatically manage page file size for all drives”
Select “Custom Size”
Enter the following for the size selections:
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
32
o Initial Size – as a good rule of thumb, the size should be equivalent to the amount of memory in the system. o Maximum Size – as a good rule of thumb, the size should be equivalent to 2x the amount of memory in the system.
Click “Ok”, “OK”, and “OK”
You will be prompted to reboot your computer.
Disabling Windows Error Reporting – Windows 7
Open the Control Panel
Open the Action Center
Select “Change Action Center Settings”
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
33
Select “Problem Reporting Settings”
Select “Never Check for Solutions”
Copyright 2017, Unitec, LLC.
Proprietary and Confidential Information
34
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement
Key features
PA-DSS validated payment application
Supports various payment processors
User Management
Centralized logging
Data Transport Encryption
SQL Express 2012 database support
Frequently asked questions
PA-DSS validation confirms that the payment application conforms to industry best practices for handling, managing, and storing payment-related information.
Sierra Server helps facilitate PCI compliance with features like user account management, password protection, data encryption, and secure handling of payment data.
Software updates are provided as a utility loaded onto a USB thumbdrive, ensuring a secure and trusted source for installation.
