Ready to start protecting organization? Download "A Technical Guide to Achieving Unix & Linux Compliance for Financial Services Organizations". download nowI won’t get into all the ways that sudo can’t help you meet your most stringent compliance requirements – we’ve written other blogs on that. Instead, I want to zero-in on the Unix/Linux-related compliance requirements in major financial services regulations, and summarize best practices for meeting those requirements.
Summary of Unix/Linux Privilege Management Concerns in Major Financial Services RegulationsWe’ve put together this handy-dandy table that summarizes the major financial services-related regulations and the Unix/Linux concerns you should address. This table is by no means comprehensive, but we have mapped certain PowerBroker for Unix & Linux capabilities into these mandates. At the very least, if your security and compliance audits are showing material weaknesses to a Unix/Linux estate, it’s probably because of this.
|Security Planning and Process||HIPAA, NISPOM, PCI||PowerBroker can be used to create, document, review, and modify Unix task authorization policies for specified users, groups of users, or job functions/roles, enabling specific Unix tasks under a variety of environmental conditions. PowerBroker logs can be used in security planning by identifying insecure behaviors that leave access to Unix/Linux resources vulnerable.|
|Strong Authentication||HIPAA, NISPOM, PCI, 21 CFR Part 11||PowerBroker can require password authentication, including root or other special passwords. Additionally, PowerBroker provides PKI support using OpenSSL which offers additional public/private key authentication for PowerBroker components. PowerBroker supports Kerberos, SecurID, Smartcards, and LDAPv2. PowerBroker also supports LAM.|
|Access Control: System||GLBA, PCI, SOX, 21 CFR Part 11, SWIFT CSCF||PowerBroker policies provide granular controls over which users may access which Unix/Linux system commands, directories, and files.|
|Access Control: Data||GLBA, NISPOM, PCI, SOX, 21 CFR Part 11||PowerBroker policies provide granular controls over which users may access which commands, directories, and files. PowerBroker can also delegate privileges for third-party application generic accounts, like Oracle, SAP, etc.|
|Access Control: Media||HIPAA||PowerBroker can allow or deny access to media devices, or to specific related commands (e.g., mount).|
|Data Integrity||HIPAA, NISPOM, PCI, 21 CFR Part 11||PowerBroker logs all Unix/Linux task requests, acceptances, and rejections, including all I/O down to the keystroke, in order to verify data integrity or what modifications may have taken place.|
|Task Authorization||GLBA, 21 CFR Part 11||PowerBroker provides granular delegation of Unix/Linux task privileges across more than 30 Unix/Linux platforms.|
|Encryption (both transmission and storage)||GLBA, HIPAA, PCI, SB1386, SOX, 21 CFR Part 11||All task requests made by a user are encrypted as they are communicated to the PowerBroker Master, as are communications between the PowerBroker Master and executing Local host, the PowerBroker log server, etc. PowerBroker supports several algorithms including AES and TripleDES.|
|Intrusion Monitoring and Response||GLBA, SB1386, SOX, SWIFT CSCF||PowerBroker policies and logs can be used to monitor suspicious activities by setting specified alerts and notifications. PowerBroker can secure specified tasks with policies requiring secondary authentication, and administrator alerts on rejected tasks.|
|Auditing||HIPAA, NISPOM, PCI, SB1386, SOX, 21 CFR Part 11, NYC CRR500, SWIFT CSCF||PowerBroker logs all Unix/Linux task requests, acceptances, and rejections, including all I/O down to the keystroke. PowerBroker logs can be encrypted and secured by mandatory authentication techniques.|
- Security issues in protecting financial data from being altered
- Best practice security requirements for Unix/Linux
- How to fill the gaps between the design of Unix/Linux systems and financial services compliance requirements
Ready to start protecting organization? Download "A Technical Guide to Achieving Unix & Linux Compliance for Financial Services Organizations". download nowAlso, be sure to check out our recorded webinar that summarizes what Unix/Linux privilege management concerns a financial services CISO really cares about. For more information on how BeyondTrust can help you address your Unix/Linux security and compliance challenges, contact us today.
Scott Lang, Sr. Director, Product Marketing at BeyondTrust
Scott Lang has nearly 20 years of experience in technology product marketing, currently guiding the product marketing strategy for BeyondTrust’s privileged account management solutions and vulnerability management solutions. Prior to joining BeyondTrust, Scott was director of security solution marketing at Dell, formerly Quest Software, where he was responsible for global security campaigns, product marketing for identity and access management and Windows server management.