OSSEC is an open source host-based intrusion detection system that can help merchants meet PCI DSS compliance requirements. It provides advanced system monitoring and real-time alerts. Key benefits include supporting multiple platforms, configurable alerts, integration with existing infrastructure, centralized management, and both agent-based and agentless monitoring. OSSEC addresses requirements around detecting unauthorized file system changes and monitoring log files from applications and systems that store, process, or transmit cardholder data.
OSSEC is an open source host-based intrusion detection system that can help merchants meet PCI DSS compliance requirements. It provides advanced system monitoring and real-time alerts. Key benefits include supporting multiple platforms, configurable alerts, integration with existing infrastructure, centralized management, and both agent-based and agentless monitoring. OSSEC addresses requirements around detecting unauthorized file system changes and monitoring log files from applications and systems that store, process, or transmit cardholder data.
OSSEC is an open source host-based intrusion detection system that can help merchants meet PCI DSS compliance requirements. It provides advanced system monitoring and real-time alerts. Key benefits include supporting multiple platforms, configurable alerts, integration with existing infrastructure, centralized management, and both agent-based and agentless monitoring. OSSEC addresses requirements around detecting unauthorized file system changes and monitoring log files from applications and systems that store, process, or transmit cardholder data.
OSSEC is an open source host-based intrusion detection system that can help merchants meet PCI DSS compliance requirements. It provides advanced system monitoring and real-time alerts. Key benefits include supporting multiple platforms, configurable alerts, integration with existing infrastructure, centralized management, and both agent-based and agentless monitoring. OSSEC addresses requirements around detecting unauthorized file system changes and monitoring log files from applications and systems that store, process, or transmit cardholder data.
Introduction PCI Security Standards Council is an open global forum for the ongoing development, enhancement, storage, dissemination and implementation of security standards for account data protection. As a part of this initiative the council has published a set of standards, called the Payment Card Industry Data Security Standard (PCI DSS). These standards apply to all payment card network members, merchants and service providers that store, process or transmit cardholder data, and affect all payment channels, including retail (brick and mortar), mail/telephone order and ecommerce. PCI DSS version 1.2 published on Oct 1’ 2008 is the latest version of the standard available today. This document will describe how OSSEC can help merchants meet some of the requirements stated in PCI DSS 1.2.
Key Benefits OSSEC helps merchants meet PCI DSS 1.2 compliance and help them implement a defense-in- depth strategy. It is an open source Host Based Intrusion Detection System that provides advanced visibility into malicious behavior on systems.
Some of the key benefits of OSSEC are:
a) Compliance Requirements – OSSEC helps customers meet specific compliance requirements as outlined in PCI DSS 1.2. It lets customers detect and alert on unauthorized file system modifications and malicious behavior based on entries in the log files of COTS products as well as custom applications. b) Multi-Platform Support – OSSEC lets customers implement a comprehensive host based intrusion detection system with fine grained application/server specific policies across multiple platforms such as Linux, Solaris, AIX, HP-UX, BSD, Windows, Mac and Vmware ESX. c) Real-time and Configurable Alerts – OSSEC lets customers configure incidents they want to be alerted on which lets them focus on raising the priority of critical incidents over the regular noise on any system. Integration with smtp, sms and syslog allows customers to be on top of alerts by sending these on to e-mail and handheld devices such as cell phones and pagers. d) Integration with current infrastructure – OSSEC will integrate with current investments from customers such as SIM/SEM (Security Incident Management/Security Events Management) products for centralized reporting and correlation of events. e) Centralized Management – OSSEC provides a simplified centralized management server to manage policies across multiple operating systems. Additionally, it also lets customers define server specific overrides for finer grained policies. f) Agent and Agentless Monitoring – OSSEC offers the flexibility of agent based and agentless monitoring of systems and networking components such as routers and firewalls. It lets customers who have restrictions on software being installed on systems (such as FDA approved systems or appliances) meet security and compliance needs.
Third Brigade Page 3
PCI Compliance Started as a security tool, OSSEC has been influenced by PCI to a large extent. The parts of PCI DSS 1.2 that OSSEC can help address are summarized below:
Third Brigade Page 4
Note: It is highly recommended that customers share this document with their auditors for further guidance.
