Security and compliance audits are a fact of life for all organizations, and especially in highly-regulated ones like financial services. Look no further than recent data breaches to validate the risks of failed practices. Even though a security or compliance audit can be a valuable ally in identifying vulnerabilities in your critical systems, knowing that before an audit will save you the inevitable time, cost, and distraction that comes with audits like these.
Let’s focus on Unix and Linux systems first since they house some of the most important data, applications and processing systems in use by financial services organizations today. It stands to reason that these platforms should be protected at all costs. But unfortunately, results from our latest survey of privileged access management professionals don’t necessarily show that. The survey results tell us that 68% of respondents consider least privilege on Unix & Linux an important PAM function. But, 86% of respondents believe their Unix/Linux environments have the highest level of protection, with 54% of respondents still running sudo on at least one Unix/Linux server and 39% still running it on workstations. Something’s amiss here.
Ready to start protecting organization? Download "A Technical Guide to Achieving Unix & Linux Compliance for Financial Services Organizations". download nowI won’t get into all the ways that sudo can’t help you meet your most stringent compliance requirements – we’ve written other blogs on that. Instead, I want to zero-in on the Unix/Linux-related compliance requirements in major financial services regulations, and summarize best practices for meeting those requirements.
Summary of Unix/Linux Privilege Management Concerns in Major Financial Services Regulations
We’ve put together this handy-dandy table that summarizes the major financial services-related regulations and the Unix/Linux concerns you should address. This table is by no means comprehensive, but we have mapped certain PowerBroker for Unix & Linux capabilities into these mandates. At the very least, if your security and compliance audits are showing material weaknesses to a Unix/Linux estate, it’s probably because of this.| Requirement | Regulations/Mandates | PowerBroker Support |
| Security Planning and Process | HIPAA, NISPOM, PCI | PowerBroker can be used to create, document, review, and modify Unix task authorization policies for specified users, groups of users, or job functions/roles, enabling specific Unix tasks under a variety of environmental conditions. PowerBroker logs can be used in security planning by identifying insecure behaviors that leave access to Unix/Linux resources vulnerable. |
| Strong Authentication | HIPAA, NISPOM, PCI, 21 CFR Part 11 | PowerBroker can require password authentication, including root or other special passwords. Additionally, PowerBroker provides PKI support using OpenSSL which offers additional public/private key authentication for PowerBroker components. PowerBroker supports Kerberos, SecurID, Smartcards, and LDAPv2. PowerBroker also supports LAM. |
| Access Control: System | GLBA, PCI, SOX, 21 CFR Part 11, SWIFT CSCF | PowerBroker policies provide granular controls over which users may access which Unix/Linux system commands, directories, and files. |
| Access Control: Data | GLBA, NISPOM, PCI, SOX, 21 CFR Part 11 | PowerBroker policies provide granular controls over which users may access which commands, directories, and files. PowerBroker can also delegate privileges for third-party application generic accounts, like Oracle, SAP, etc. |
| Access Control: Media | HIPAA | PowerBroker can allow or deny access to media devices, or to specific related commands (e.g., mount). |
| Data Integrity | HIPAA, NISPOM, PCI, 21 CFR Part 11 | PowerBroker logs all Unix/Linux task requests, acceptances, and rejections, including all I/O down to the keystroke, in order to verify data integrity or what modifications may have taken place. |
| Task Authorization | GLBA, 21 CFR Part 11 | PowerBroker provides granular delegation of Unix/Linux task privileges across more than 30 Unix/Linux platforms. |
| Encryption (both transmission and storage) | GLBA, HIPAA, PCI, SB1386, SOX, 21 CFR Part 11 | All task requests made by a user are encrypted as they are communicated to the PowerBroker Master, as are communications between the PowerBroker Master and executing Local host, the PowerBroker log server, etc. PowerBroker supports several algorithms including AES and TripleDES. |
| Intrusion Monitoring and Response | GLBA, SB1386, SOX, SWIFT CSCF | PowerBroker policies and logs can be used to monitor suspicious activities by setting specified alerts and notifications. PowerBroker can secure specified tasks with policies requiring secondary authentication, and administrator alerts on rejected tasks. |
| Auditing | HIPAA, NISPOM, PCI, SB1386, SOX, 21 CFR Part 11, NYC CRR500, SWIFT CSCF | PowerBroker logs all Unix/Linux task requests, acceptances, and rejections, including all I/O down to the keystroke. PowerBroker logs can be encrypted and secured by mandatory authentication techniques. |
- Security issues in protecting financial data from being altered
- Best practice security requirements for Unix/Linux
- How to fill the gaps between the design of Unix/Linux systems and financial services compliance requirements
Ready to start protecting organization? Download "A Technical Guide to Achieving Unix & Linux Compliance for Financial Services Organizations". download nowAlso, be sure to check out our recorded webinar that summarizes what Unix/Linux privilege management concerns a financial services CISO really cares about. For more information on how BeyondTrust can help you address your Unix/Linux security and compliance challenges, contact us today.
Scott Lang, Sr. Director, Product Marketing at BeyondTrust
Scott Lang has nearly 20 years of experience in technology product marketing, currently guiding the product marketing strategy for BeyondTrust’s privileged account management solutions and vulnerability management solutions. Prior to joining BeyondTrust, Scott was director of security solution marketing at Dell, formerly Quest Software, where he was responsible for global security campaigns, product marketing for identity and access management and Windows server management.