11.5: 1. Intrusion-detection and/or intrusion- prevention techniques are used to detect and/or prevent intrusions into the network as follows: (a) All traffic is monitored at the perimeter of the CDE, (b) All traffic is monitored at critical points in the CDE, (c) Personnel are alerted to suspected compromises, (d) All intrusion-detection and prevention engines, baselines, and signatures are kept up to date.
  • Examine system configurations and network diagrams to verify that intrusion-detection and/or intrusion-prevention techniques are in place to monitor all traffic:
  • • At the perimeter of the CDE.
  • • At critical points in the CDE.
  • Examine system configurations and interview responsible personnel to verify intrusion- detection and/or intrusion-prevention techniques alert personnel of suspected compromises.
  • Examine system configurations and vendor documentation to verify intrusion-detection and/or intrusion-prevention techniques are configured to keep all engines, baselines, and signatures up to date.

Description

Purpose

Intrusion-detection and/or intrusion-prevention techniques (such as IDS/IPS) compare the traffic coming into the network with known “signatures” and/or behaviors of thousands of compromise types (hacker tools, Trojans, and other malware), and then send alerts and/or stop the attempt as it happens. Without a proactive approach to detect unauthorized activity, attacks on (or misuse of) computer resources could go unnoticed for long periods of time. The impact of an intrusion into the CDE is, in many ways, a factor of the time that an attacker has in the environment before being detected.

Good Practice

Security alerts generated by these techniques should be continually monitored, so that the attempted or actual intrusions can be stopped, and potential damage limited.

Definitions

Critical locations could include, but are not limited to, network security controls between network segments (for example, between a DMZ and an internal network or between an in-scope and out- of-scope network) and points protecting connections between a less trusted and a more trusted system component.

11.5: 1.1. Additional requirement for service providers only: Intrusion-detection and/or intrusion-prevention techniques detect, alert on/prevent, and address covert malware communication channels.
  • Additional testing procedure for service provider assessments only: Examine documentation and configuration settings to verify that methods to detect and alert on/prevent covert malware communication channels are in place and operating.
  • Additional testing procedure for service provider assessments only: Examine the entity’s incident-response plan (Requirement 12.10.1) to verify it requires and defines a response in the event that covert malware communication channels are detected.
  • Additional testing procedure for service provider assessments only: Interview responsible personnel and observe processes to verify that personnel maintain knowledge of covert malware communication and control techniques and are knowledgeable about how to respond when malware is suspected.

Description

Purpose

Detecting covert malware communication attempts (for example, DNS tunneling) can help block the spread of malware laterally inside a network and the exfiltration of data. When deciding where to place this control, entities should consider critical locations in the network, and likely routes for covert channels.

When malware establishes a foothold in an infected environment, it often tries to establish a communication channel to a command-and- control (C&C) server. Through the C&C server, the attacker communicates with and controls malware on compromised systems to deliver malicious payloads or instructions, or to initiate data exfiltration. In many cases, the malware will communicate with the C&C server indirectly via botnets, bypassing monitoring, blocking controls, and rendering these methods ineffective to detect the covert channels.#### Good Practice Methods that can help detect and address malware communications channels include real- time endpoint scanning, egress traffic filtering, an ”allow” listing, data loss prevention tools, and network security monitoring tools such as IDS/IPS. Additionally, DNS queries and responses are a key data source used by network defenders in support of incident response as well as intrusion discovery. When these transactions are collected for processing and analytics, they can enable a number of valuable security analytic scenarios.

It is important that organizations maintain up-to- date knowledge of malware modes of operation, as mitigating these can help detect and limit the impact of malware in the environment.

11.5: 2. A change-detection mechanism (for example, file integrity monitoring tools) is deployed as follows: (a) To alert personnel to unauthorized modification (including changes, additions, and deletions) of critical files, (b) To perform critical file comparisons at least once weekly.
  • Examine system settings, monitored files, and results from monitoring activities to verify the use of a change-detection mechanism.
  • Examine settings for the change-detection mechanism to verify it is configured in accordance with all elements specified in this requirement.

Description

Purpose

Changes to critical system, configuration, or content files can be an indicator an attacker has accessed an organization’s system. Such changes can allow an attacker to take additional malicious actions, access cardholder data, and/or conduct activities without detection or record.

A change detection mechanism will detect and evaluate such changes to critical files and generate alerts that can be responded to following defined processes so that personnel can take appropriate actions.If not implemented properly and the output of the change-detection solution monitored, a malicious individual could add, remove, or alter configuration file contents, operating system programs, or application executables. Unauthorized changes, if undetected, could render existing security controls ineffective and/or result in cardholder data being stolen with no perceptible impact to normal processing.

Good Practice

Examples of the types of files that should be monitored include, but are not limited to:

• System executables.

• Application executables.

• Configuration and parameter files.

• Centrally stored, historical, or archived audit logs.

• Additional critical files determined by entity (for example, through risk assessment or other means).

Examples

Change-detection solutions such as file integrity monitoring (FIM) tools check for changes, additions, and deletions to critical files, and notify when such changes are detected.