PADSS Implementation Guide - Sierra Version 1.63
Considerations for the Implementation of Payment Application in a PCI-Compliant Environment
The following areas must be considered for proper implementation in a PCI-Compliant environment.
Sensitive Authentication Data requires special handling
Remove Historical Cardholder Data
Set up Good Access Controls
Properly Train and Monitor Admin Personnel
Key Management Roles & Responsibilities
PCI-Compliant Remote Access
Use SSH, VPN, or SSLV3/TLS 1.0 or higher for encryption of administrative access
Log settings must be compliant
PCI-Compliant Wireless settings
Data Transport Encryption
PCI-Compliant Use of Email
Network Segmentation
Never store cardholder data on internet-accessible systems
Use SSLV3 for Secure Data Transmission
Delivery of Updates in a PCI Compliant Fashion
Remove Historical Sensitive Authentication Data (PA-DSS 1.1.4.a)
Sierra retains only cardholder data elements that are allowed per the PCI DSS. It should be noted however that version 1.12 did store full track 2 contents – in encrypted form – prior to authorization.
This data was deleted from the database upon authorization but there are no tools available to securely wipe trace data from the storage device (the D-Drive flash card). To comply with this requirement,
Sierra installations with version 1.12 should be updated as follows:
Acquire a software upgrade utility to update Sierra from version 1.12 to 1.24 and a new D-Drive from Unitec.
Apply the software upgrade in accordance with the instructions provided with the upgrade utility.
Save a database back up onto a thumbdrive by following the procedures described in the
Operator’s Manual.
Install the new D-drive that contains the compliant version of Sierra. Use the restore function to copy the database from the thumbdrive onto the new D-Drive. Use of the restore function does not transfer either historic or cryptographic material including track data.
The replaced D Drive may house sensitive data and must be securely destroyed. Unitec uses a 3 rd
party service to handle the destruction of these drives. Upon completion of the update process described above, any replaced D Drive older than version 1.24 must be returned to Unitec Customer Service through a secure courier (e.g. Fed-ex, UPS) so it can be destroyed. Unitec ensures the secure handling and destruction of all received D Drives through contract with a media destruction service who
Copyright 2013, Unitec
Proprietary and Confidential Information
12
