Logs – A double-edged sword? Beating PCI Fines by bad security practices?

Posted on April 23rd, 2008 by Drazen Drazic

By Declan Ingram

PCI clearly states in requirement 10: “Track and monitor all access to network resources and cardholder data” And rightly so. It goes on to say “Determining the cause of a compromise is very difficult without system activity logs.”

It certainly is. Infact, for nearly all attacks where card data is at stake, it can border on impossible. Enterprise log management is hard. It is expensive, and there are few organisations that do it well. Not only that, but the organisations that do it well are also much more likely to have their general state of security much higher – meaning that (all things being equal) they are less likely to suffer a breach in the first place.

On the other hand however, organisations that do not have a good handle on their security, and do not have good logging processes and practices in place ARE more likely to be breached.

The problem arises when the investigation starts: there are no or no useful logs, there is no trusted information, there is little or no evidence of attack. Your expensive forensic tools are too focused on disk, and most attacks on card data are in memory.

The situation seems thus:

The acquiring bank/PCI will only issue fines if it can be proven that a compromise has occurred, but a non compliant company is also pretty unlikely to have logs that can be trusted, and so determining the details of an attack to provide definite evidence of exactly how a breach may have occurred to a level that could hold up under a legal scenario and to justify the fine from the bank would be even more difficult. ie; while all investigation may show that company X is bleeding card information through numerous sources, no logs means that it could be impossible to pinpoint exactly where the breach may have occurred.

Or in less words: Could a company deliberately hinder evidence gathering to avoid fines? Especially when they know they are non-compliant anyway.

I hope I’m wrong.