Notice. Unitec Sierra Server Software Version 1.63

Below you will find brief information for Sierra Server Software Version 1.63. This guide outlines the necessary steps for Sierra product installations to comply with Payment Application Data Security Standards (PA-DSS). It covers secure handling of sensitive authentication data, proper access controls, logging requirements, and secure update delivery methods, helping users establish and maintain a PCI-compliant environment for payment processing.

PDF

Document

PADSS Implementation Guide - Sierra Version 1.63

Notice

THE INFORMATION IN THIS DOCUMENT IS FOR INFORMATIONAL PURPOSES ONLY. UNITEC MAKES

NO REPRESENTATION OR WARRANTY AS TO THE ACCURACY OR THE COMPLETENESS OF THE

INFORMATION CONTAINED HEREIN. YOU ACKNOWLEDGE AND AGREE THAT THIS INFORMATION IS

PROVIDED TO YOU ON THE CONDITION THAT NEITHER UNITEC NOR ANY OF ITS AFFILIATES OR

REPRESENTATIVES WILL HAVE ANY LIABILITY IN RESPECT OF, OR AS A RESULT OF, THE USE OF THIS

INFORMATION. IN ADDITION, YOU ACKNOWLEDGE AND AGREE THAT YOU ARE SOLELY RESPONSIBLE

FOR MAKING YOUR OWN DECISIONS BASED ON THE INFORMATION HEREIN.

Nothing herein shall be construed as limiting or reducing your obligations to comply with any applicable laws, regulations or industry standards relating to security or otherwise including, but not limited to, PA-

DSS and DSS.

The retailer may undertake activities that may affect compliance. For this reason, UNITEC is required to be specific to only the standard software provided by it.

About this Document

This document describes the steps that must be followed in order for your Sierra product installations to comply with Payment Application – Data Security Standards (PA-DSS). The information in this document is based on PCI Security Standards Council Payment Application Data Security Standards program

(version 2.0 dated October, 2010) .

Unitec instructs and advises its customers to deploy UNITEC applications in a manner that adheres to the PCI Data Security Standard (v2.0). Subsequent to this, best practices and hardening methods, such as those referenced by the Center for Internet Security (CIS) and their various “Benchmarks”, should be followed in order to enhance system logging, reduce the chance of intrusion and increase the ability to detect intrusion, as well as other general recommendations to secure networking environments. Such methods include, but are not limited to, enabling operating system auditing subsystems, system logging of individual servers to a centralized logging server, the disabling of infrequently-used or frequently vulnerable networking protocols and the implementation of certificate-based protocols for access to servers by users and vendors.

You must follow the steps outlined in this Implementation Guide in order for your Sierra product installation to support your PCI DSS compliance efforts.

Key features

PA-DSS Validated (Version 2.0) payment application
Supports credit card processing via secured Internet connection (SSL V3)
Stores truncated PAN, card type, cardholder name, and expiration date (no full track data)
Enforces strong access controls with unique user IDs and complex, regularly changed passwords
Features PA-DSS compliant and non-configurable logging for auditing purposes
Secure delivery of software updates with SHA-2 hash verification
Supports temporary Remote Desktop troubleshooting with two-factor authentication
Does not store sensitive authentication data
Operates on Windows XP Embedded Operating System

Frequently asked questions

The Sierra server application provides payment and management capabilities to Unitec Car Wash terminals.

No, Sierra does not store complete track data. It stores the PAN in truncated form (last 4 digits), card type, cardholder name, and expiration date.

Software updates are provided as a utility loaded onto a USB thumbdrive by Unitec, distributed through Unitec distributors, and verified using SHA-2 hash verification.

Sierra Server Software operates with the Windows XP Embedded Operating System.

Sierra enforces strong access controls requiring unique IDs, complex passwords changed every 90 days, and account lockouts after failed login attempts. Remote Desktop access, when temporarily enabled for troubleshooting, requires two-factor authentication.