RE: PCI-DSS and IPS

Requirement 11.4 of PCI DSS 1.2:

Use intrusion-detection systems,
and/or intrusion-prevention systems to
monitor all traffic in the cardholder data
environment and alert personnel to
suspected compromises. Keep all
intrusion-detection and prevention
engines up-to-date.

The goal here is to monitor traffic for anything that might present a
threat to PCI scoped data. I doubt an auditor will fault you for using a
UTM appliance as opposed to standalone firewall and IPS devices. Keep in
mind UTM signature sets are frequently leaner than those used by dedicated
IDS/IPS appliances. If you do go with a UTM at the edge, you might consider
utilizing open source IDS/IPS solutions at key locations on the inside as
well.

https://www.pcisecuritystandards.org/security_standards/pci_dss_download.html


Steve


-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx] On
Behalf Of raimarm@xxxxxxxxx
Sent: Friday, February 20, 2009 4:20 AM
To: security-basics@xxxxxxxxxxxxxxxxx
Subject: PCI-DSS and IPS

Hi All,
I am a technical orientated guy and not sure about my following question.
Is a IPS system in regards to PCI-DSS obligatory ?
If yes, would it be possible to take a FW with IPS functionality
rather to buy a dedicated IPS (like deep-inspection, smart-defense and
the like).
Many Thanks
rm

Relevant Pages

  • Re: intrusion detection
    ... intrusion-detection systems. ... Samhain is the daemon that runs on the clients being monitored, yule is the server that maintains ... web app you can use to monitor changes. ... Also, my setup is simple, with no web servers, mail servers: ...
    (Debian-User)
  • Need advice on flat panel monitor for photo editing
    ... My office is looking to buy all flat panels for our next round of monitor ... And then I started hearing about MVA, IPS and TN ... technology and that IPS is a lot better. ...
    (alt.graphics.photoshop)
  • Re: MRTG and Multihomed NIC
    ... I multihome my NIC on FC4 box to have about 10 IPs. ... Could I set up MRTG to monitor by those IPs rather than just a single IP or NIC? ...
    (Fedora)
  • MRTG and Multihomed NIC
    ... I multihome my NIC on FC4 box to have about 10 IPs. ... Could I set up MRTG to ... monitor by those IPs rather than just a single IP or NIC? ...
    (Fedora)
Quantcast