Sensitive Authentication Data requires special handling (PA-DSS 1.1.5.c). Unitec Sierra Server Software Version 1.63

PADSS Implementation Guide - Sierra Version 1.63 incinerates the drives in a secured environment and provides Certificates of Destruction which are archived at Unitec.

Sensitive Authentication Data requires special handling (PA-DSS 1.1.5.c)

UNITEC does not store Sensitive Authentication data for any reason, and we strongly recommend that you do not do this either. However, if for any reason you should do so, the following guidelines must be followed when dealing with sensitive authentication data (swipe data, validation values or codes, PIN or

PIN block data):

Collect sensitive authentication data only when needed to solve a specific problem

Store such data only in specific, known locations with limited access

Collect only the limited amount of data needed to solve a specific problem

Encrypt sensitive authentication data while stored

Securely delete such data immediately after use

Purging of Cardholder Data (PA-DSS 2.1)

SIERRA does not store cardholder data and therefore there is no data to be purged by the application as required by PA-DSS v2.0.

Any cardholder data you store outside of the application must be documented and you must define a retention period at which time you will purge (render irretrievable) the stored cardholder data.

Cardholder Data Encryption Key Management (PA-DSS 2.5.c and 2.6.a)

SIERRA does not store cardholder data in any way nor does it provide any configurability that would allow a merchant to store cardholder data, therefore no encryption of cardholder data is required for

PA-DSS v2.0.

Removal of Cryptographic material (PA-DSS 2.7.a)

SIERRA Version 1.12 encrypted cardholder data that was stored pre-authorization. As there are no tools available for removing cryptographic materials, customers using version 1.12 should upgrade their products following the procedure previously described (under the section titled “Remove Historical

Sensitive Authentication Data”)

Set up Strong Access Controls (3.1.a and 3.2)

The PCI DSS requires that access to all systems in the payment processing environment be protected through use of unique users and complex passwords. Unique user accounts indicate that every account used is associated with an individual user and/or process with no use of generic group accounts used by more than one user or process.

Copyright 2013, Unitec

Proprietary and Confidential Information

13

PADSS Implementation Guide - Sierra Version 1.63

3.1.a: You must assign strong passwords to any default accounts (even if they won’t be used), and then disable or do not use the accounts.

All authentication credentials are provided by the application. For both the completion of the initial installation and for any subsequent changes (for example, any changes that result in user accounts reverting to default settings, any changes to existing account settings, or changes that generate new accounts or recreate existing accounts), the following 10 points must be followed per PCI 8.1, 8.2, and

8.5.8-15:

1. The application must assign unique IDs for user accounts. (8.1)

2. The application must provide at least one of the following three methods to authenticate users:

(8.2) a. Something you know, such as a password or passphrase b. Something you have, such as a token device or smart card c. Something you are, such as a biometric

3. The application must NOT require or use any group, shared, or generic accounts or passwords.(8.5.8

4. The application requires passwords to be changed at least every 90 days (8.5.9)

5. The application requires passwords must to be at least 7 characters (8.5.10)

6. The application requires passwords to include both numeric and alphabetic characters (8.5.11)

7. The application keeps password history and requires that a new password is different than any of the last four passwords used. (8.5.12)

8. The application limits repeated access attempts by locking out the user account after not more than six logon attempts. (8.5.13)

9. The application sets the lockout duration to a minimum of 30 minutes or until an administrator enables the user ID. (8.5.14)

10. The application requires the user to re-authenticate to re-activate the session if the application session has been idle for more than 15 minutes.

SIERRA is shipped with a factory default Administrative account. The password for this account must be changed as follows:



After log-in, select SET-UP from the main menu options



Select USERS from the sub-menu that’s shown on the left side of the page



Click on the EDIT button shown for the default account and enter a new password. As described above, your password must be at least 7 characters and include both alpha and numeric characters.



Re-enter your new password in the ‘confirm password’ box then click on the SAVE button to complete the change.

Your password will be valid for 90 days only. As your password expiration date approaches, you will be notified that the password will expire each time you log in to the management application and prompted to reset your password. Follow the procedure described above to enter a new password

(Note - Your new password must not be the same as any of the last passwords used).

Copyright 2013, Unitec

Proprietary and Confidential Information

14