A Technical Guide to Achieving Unix & Linux Compliance for Financial Services Or

Security and compliance audits are a fact of life for all organizations, and especially in highly-regulated ones like financial services. Look no further than recent data breaches to validate the risks of failed practices. Even though a security or compliance audit can be a valuable ally in identifying vulnerabilities in your critical systems, knowing that before an audit will save you the inevitable time, cost, and distraction that comes with audits like these.

Let’s focus on Unix and Linux systems first since they house some of the most important data, applications and processing systems in use by financial services organizations today. It stands to reason that these platforms should be protected at all costs. But unfortunately, results from our latest survey of privileged access management professionals don’t necessarily show that. The survey results tell us that 68% of respondents consider least privilege on Unix & Linux an important PAM function. But, 86% of respondents believe their Unix/Linux environments have the highest level of protection, with 54% of respondents still running sudo on at least one Unix/Linux server and 39% still running it on workstations. Something’s amiss here.

Ready to start protecting organization? Download "A Technical Guide to Achieving Unix & Linux Compliance for Financial Services Organizations". download now

I won’t get into all the ways that sudo can’t help you meet your most stringent compliance requirements – we’ve written other blogs on that. Instead, I want to zero-in on the Unix/Linux-related compliance requirements in major financial services regulations, and summarize best practices for meeting those requirements.

Summary of Unix/Linux Privilege Management Concerns in Major Financial Services Regulations

We’ve put together this handy-dandy table that summarizes the major financial services-related regulations and the Unix/Linux concerns you should address. This table is by no means comprehensive, but we have mapped certain PowerBroker for Unix & Linux capabilities into these mandates. At the very least, if your security and compliance audits are showing material weaknesses to a Unix/Linux estate, it’s probably because of this.

Requirement	Regulations/Mandates	PowerBroker Support
Security Planning and Process	HIPAA, NISPOM, PCI	PowerBroker can be used to create, document, review, and modify Unix task authorization policies for specified users, groups of users, or job functions/roles, enabling specific Unix tasks under a variety of environmental conditions. PowerBroker logs can be used in security planning by identifying insecure behaviors that leave access to Unix/Linux resources vulnerable.
Strong Authentication	HIPAA, NISPOM, PCI, 21 CFR Part 11	PowerBroker can require password authentication, including root or other special passwords. Additionally, PowerBroker provides PKI support using OpenSSL which offers additional public/private key authentication for PowerBroker components. PowerBroker supports Kerberos, SecurID, Smartcards, and LDAPv2. PowerBroker also supports LAM.
Access Control: System	GLBA, PCI, SOX, 21 CFR Part 11, SWIFT CSCF	PowerBroker policies provide granular controls over which users may access which Unix/Linux system commands, directories, and files.
Access Control: Data	GLBA, NISPOM, PCI, SOX, 21 CFR Part 11	PowerBroker policies provide granular controls over which users may access which commands, directories, and files. PowerBroker can also delegate privileges for third-party application generic accounts, like Oracle, SAP, etc.
Access Control: Media	HIPAA	PowerBroker can allow or deny access to media devices, or to specific related commands (e.g., mount).
Data Integrity	HIPAA, NISPOM, PCI, 21 CFR Part 11	PowerBroker logs all Unix/Linux task requests, acceptances, and rejections, including all I/O down to the keystroke, in order to verify data integrity or what modifications may have taken place.
Task Authorization	GLBA, 21 CFR Part 11	PowerBroker provides granular delegation of Unix/Linux task privileges across more than 30 Unix/Linux platforms.
Encryption (both transmission and storage)	GLBA, HIPAA, PCI, SB1386, SOX, 21 CFR Part 11	All task requests made by a user are encrypted as they are communicated to the PowerBroker Master, as are communications between the PowerBroker Master and executing Local host, the PowerBroker log server, etc. PowerBroker supports several algorithms including AES and TripleDES.
Intrusion Monitoring and Response	GLBA, SB1386, SOX, SWIFT CSCF	PowerBroker policies and logs can be used to monitor suspicious activities by setting specified alerts and notifications. PowerBroker can secure specified tasks with policies requiring secondary authentication, and administrator alerts on rejected tasks.
Auditing	HIPAA, NISPOM, PCI, SB1386, SOX, 21 CFR Part 11, NYC CRR500, SWIFT CSCF	PowerBroker logs all Unix/Linux task requests, acceptances, and rejections, including all I/O down to the keystroke. PowerBroker logs can be encrypted and secured by mandatory authentication techniques.

For more on how PowerBroker can address multiple compliance requirements, please visit our compliance page.

What now? Download the Technical Guide!

We’ve written a technical guide that explains

Security issues in protecting financial data from being altered
Best practice security requirements for Unix/Linux
How to fill the gaps between the design of Unix/Linux systems and financial services compliance requirements

… and reviews the major security concerns involved with managing a large Unix/Linux IT estate, and what steps can be taken to improve the confidentiality, integrity and availability of key systems and data house on Unix/Linux systems. I encourage you to download the guide and compare your current Unix/Linux security and audit practices against it.

Ready to start protecting organization? Download "A Technical Guide to Achieving Unix & Linux Compliance for Financial Services Organizations". download now

Also, be sure to check out our recorded webinar that summarizes what Unix/Linux privilege management concerns a financial services CISO really cares about.

For more information on how BeyondTrust can help you address your Unix/Linux security and compliance challenges, contact us today.