Teleflora Point of Sales PA-DSS Implementation Guide
User Identification and Authentication
Addresses:
PA-DSS 3.1.c
PA-DSS 3.2
PCI DSS 6.5.8
PCI DSS 8.1
PCI DSS 8.2
PCI DSS 8.3
PCI DSS 8.4
PCI DSS 8.5
A key component to securing your Dove POS environment is ensuring that users are properly authenticated for the task to be performed. The Dove POS application does not require users to have administrative privileges in order to run. Note that, for the purpose of Dove POS, any user who is a member of the “Administrators” windows group is considered an “Administrative user”. In order to prevent impersonation and unauthorized access to your Dove POS system, the following guidelines should be followed. This is not an exhaustive list. You are responsible for reading, and following all guidelines under PCI DSS 8.5:
• PCI DSS 8.5.1 Control addition, deletion, and modification of user IDs, credentials, and other identifier objects
• PCI DSS 8.5.2 Verify user identity before performing password resets
• PCI DSS 8.5.3 Set first-time passwords to a unique value for each user and change immediately after the first use
• PCI DSS 8.5.4 Immediately revoke access for any terminated users
• PCI DSS 8.5.5 Remove inactive user accounts at least every 90 days
• PCI DSS 8.5.6 Enable accounts used by vendors for remote maintenance only during the time period needed
• PCI DSS 8.5.7 Communicate password procedures and policies to all users who have access to cardholder data
• PCI DSS 8.5.8 Do not use group, shared, or generic accounts and passwords
• PCI DSS 8.5.9 Change user passwords at least every 90 days
• PCI DSS 8.5.10 Require a minimum password length of at least seven characters
• PCI DSS 8.5.11 Use passwords containing both numeric and alphabetic characters
• PCI DSS 8.5.12 Do not allow an individual to submit a new password that is the same as any of the last four passwords he or she has used
• PCI DSS 8.5.13 Limit repeated access attempts by locking out the user ID after not more than six attempts
• PCI DSS 8.5.14 Set the lockout duration to thirty minutes or until administrator enables the user
ID
• PCI DSS 8.5.15 If a session has been idle for more than 15 minutes, require the user to re-enter the password to re-activate the terminal
• PCI DSS 8.5.16 Authenticate all access to any database containing cardholder data. This includes access by applications, administrators, and all other users
Dove_POS_PA-DSS_Implementation_Guide_v1.3.doc – 2011-11-11 Page 10
Teleflora Point of Sales PA-DSS Implementation Guide
Administrative Users
Teleflora does not recommend you login to your Dove POS workstations as an Administrative user, unless you have a specific administrative task which needs to be accomplished. As a normal matter of practice, you and your employees should use the Dove POS workstations as a non-administrative user.
In order to be PCI compliant, you must ensure that all Administrative accounts be assigned a complex password
Administrator Account:
Every windows computer on your Dove POS network will have an administrative user account with the user name “Administrator”. For each of these computers which Teleflora Customer support manages,
Teleflora retains and maintains the password for this account. Furthermore, Teleflora may use this account for remotely managing your system.
Non-administrative Usernames:
Teleflora strongly advises that, for all non-administrative access, a username and a strong password be used for each end user. Teleflora recommends you rotate passwords every forty-five days. Please see the appendix for specific instructions on adding and removing non-administrative users from your Dove
POS systems.
Password Complexity:
PCI DSS specifies a number of requirements defining a “strong” password. These may be found in PCI
DSS section 8.5. Teleflora has provided a password generation tool which you can use to create PCI compliant passwords, please see the appendix “How to create a PCI compliant password” for details on this tool. You are advised to assign a strong password to any account created on your Dove POS system(s), even if the account is not used often.
Default system logging should never be disabled, if you believe that system level access has changed please contact the support desk to have them verify the logging is correct.
NOTE: Making any changes to the “Out of the Box” installation settings for unique usernames and secure authentication may result in non compliance with PCI DSS.
Dove_POS_PA-DSS_Implementation_Guide_v1.3.doc – 2011-11-11 Page 11
