Theo Solidcore, phan mem thdi gian chay chffdng trinh cd the ngan chan hinh thffc tan cdng bang each ngan chan "trojan" chay tren he thdng va sau dd tff chdi nhflng thay ddi kh[r]
(1)CONG NGHE & DICH VU THE
PCI DSS CHUAN BAO MAT DO LIEU THE THANH TOAN • •
Bo tieu chuan bao mat du" lieu the toan PCI DSS - La mot bo quy tac ve cac yeu cau ky thuat va van hanh giiip cac to chu'c xuf ly giao dich toan qua the, phong nguTa gian lan the tin dung, hanh vi xam nhap trai phep va nhffng nguy cd rui ro ve an ninh
Trudng Giang - Trong Khang I Qua trinh ddi PCI OSS
PCI DSS la tieng ndi chung thdng nhat cua td chQc phat hanh the tin dung qudc te ldn, gdm: Visa, MasterCard, Amercian Express, Discover va JCB Nd dupc xay difng tren cd sd hdp tQ chudng trinh nghien cQu ddc lap ve linh vffc bao mat dff lieu the cQa td chffc tren, dd la:
- ChiTdng trinh Bao mat Thong tin
The ciia Visa (Visa Card Information Security Program);
- Bao ve Dff lieu Hien trirdng cua MasterCard (MasterCard Site Data Protection);
- Chinh sach Van hanh Bao mat Dff lieu cua Amercian Express (Amer-cian Express Security Operating Policy);
- Yeu cau tuan thu va Thong tin ciia Discover (Discover Information and Compliance);
- Chffdng trinh Bao mat Dff lieu cua JCB (JCB Data Security Program)
Muc tieu cQa cac chffdng trinh la gidng nhau, nham giQp cho cac td chQc chQ ddng bao ve dfl lieu ve tai khoan the Theo ddi va kiem soat mpi truy nhap vao tai nguyen mang va dfl lieu the, chu ddng bao ve khach hang bang each quy dinh cac diem chap nhan toan phai dam bao muc dp bao mat tdi thieu luu trfl, xff ly va van chuyen dfl lieu chQ the Mat khac, xuat phat tQ yeu cau lien kSt cac mang toan the vdi nhau, cSn cd mdt chuan bao mat chung de tffdng thich ve he
thdng, de bao ve an toan tai san cho chQ the va nha cung cap djch vu qua trinh khai thac dich vu Vi cac ly tren, td chQc phat hanh the tin dung qudc te da lap Hdi ddng cac tieu chuan bao mat dfl lieu the toan (PCI SSC) Thang 12/2004, cac vien cua PCI da thdng nhat cac chinh sach rieng re va ban hanh bd tieu chuan bao mat toan cau, gpi la Bd Tieu chuan Bao mat Dfl lieu The Thanh toan (viit tat la PCI DSS)
II Noi dung PCI DSS la gi ?
PCI DSS la mdt bd tieu chuan da phffdng dien bao gdm cac yeu cau bao mat cho viec quan ly bao mat, chinh sach, quy trinh, kien trQc he thdng, thiet ke phan mem va cac bien phap phdng ve tdi thieu Bd tieu chuan phffc tap dffdc thiet ke vdi muc dich giup cho cac td chffc chQ ddng bao ve tai khoan khach hang Cd sd cQa PCI DSS la mpt loat nguyen tac va yeu cau di kem Ndi dung cQa PCI DSS gdm phan vdi nhffng yeu cau chi tiet:
1 Xay dffng va tri mdt mang lffdi an toan: Lap dat va tri cau hinh tudng lffa nham bao ve dfl lieu chQ the; Khdng sQ dung cac cau hinh he thdng mac dinh cQa nha cung cap cho mat khau truy cap he thdng va cac tham sd bao mat khac
2 Bao ve dfl lieu chQ the: Bao ve cac dfl lieu chQ the dffdc Iffu trfl; Ma hda viec van chuyen dfl lieu chQ the thdng qua mang lffdi md, cdng cdng
3 Duy tri chffdng trinh quan ly rQi ro: Sff dung va thudng xuyen cap nhat phan mem diet virus; Phat trien va tri cac he thdng va Qng dung bao mat
4 Trien khai cac bien phap kiem soat truy cap: Han che quyen truy nhap vao dfl lieu chQ the bang chinh sach "Khdng nhiem vu mien truy nhap"; Mdi ngffdi cd mdt mat ma rieng de truy nhap may tinh; Han che viec truy nhap vat ly cac dfl lieu chQ the
5 Thffdng xuyen kiem soat va kiem thff cac he thdng: Theo ddi va kiem soat mpi truy nhap vao tai nguyen mang va dff lieu chu the; Thffdng xuyen kiem tra cac he thdng va quy trinh bao mat
6 Duy tri chffdng trinh quan ly rQi ro: Duy tri chinh sach bao mat thdng tin
III Tuan thu va giam sat tuan thu PCI DSS
Cac tieu chuan ap dung cho tat ca cac td chffc Iffu trff, xff ly va van chuyen dff lieu chu the - vdi hffdng dan danh cho cac nha phat trien phan mem va nha san xuat cac ffng dung cung thiet bj sQ dung cac giao djch Mpi cdng ty thffc hien viec Iffu trfl, xQ ly va van chuyen dfl lieu chQ the phai tuan thQ PCI DSS Trong Uy ban PCI SSC chju trach nhiem quan Iy cac tieu chuan bao mat, viec tuan thu PCI DSS dffdc thffc hien d tit ca cac nha sang lap Cac td chffc khdng tuan thQ PCI DSS nhffng van tri quan he vdi mdt hoac cac thffdng hieu the qudc ti cua td chffc tren, hoac trffc tiSp hay thdng qua td chffc chap nhan toan (acquirer), se cd nguy cd mat kha nang xff ly giao djch the tin dung va bj kiem toan hoac bj phat Cac cdng ty thudc dien tuan thu bd tieu chuan se dffpc kiem chffng kha nang tuan thQ hang nam, mdt cdng ty kiem toan ve bao mat hoac thdng qua Bd Trac nghiem Tff danh gia Tuy thudc yeu
(2)CONG NGHE & DICH VU THE
cau cQa td chffc the tin dung khu vffc, bd trac nhiem tff danh gia cd the se phai thdng qua sff tham djnh cQa mdt cdng ty kiem toan ve bao mat dffdc chffng nhan
IV Mpt s6 phien han cua PCI DSS
Vao thang 9/2006, tieu chuin PCI da dffdc cap nhat Phien ban 1.1 de lam rd hdn mdt sd van de va sffa ddi nhd so vdi Phien ban 1.0
Thang 10/2008, Phien ban 1.2 dffdc dffa de thay the Phien ban 1.1 nhffng khdng thay ddi cac yeu cau ma chi lam rd hdn, tang them tinh linh hoat va xem xet tdi cac van de rui ro/nguy cd phat sinh Viec lam rd cac yeu cau se loai bd nhffng yeu cau phu khdng can thiet, ddng thdi hoan thien cac yeu ciiu ve pham vi va bao cao Dieu quan trpng nhat la Phien ban 1.2 khdng dffa bat ky cac yeu cau chinh nao ddi vdi 'Yeu cau 12' ke tff hpi ddng dffdc lap Bd tieu chuin PCI DSS 1.2 : Bob Russo, GDDH Hdi ddng PCI, cho biit y kiSn phan hdi cQa thi trffdng ve phien ban cap nhat la rat kha quan Tuy nhien, van cdn mpt vai trd ngai ddi vdi he thdng tieu chuan d Chau Au cac ddn vj ban hang d day tin rang viec sff dung cac bien phap bao mat nhff chip va ma PIN du kha nang bao ve dffdc dff lieu ca nhan cQa ngffdi tieu dung khdi nan trdm cap Mac dQ vay, dng Russo van cho rang nhflng chiec the sQ dung PIN va chip cung tdn tai nhieu ldi Theo dd Chip va PIN da giup giam sd lffdng the gian lan d cac lan giao djch trffc dien nhffng "bd tay" trffdc hinh thffc gian lan ddi vdi cac giao djch khdng trffc tiep sQ dung the (card-not-present transac- tion)
Chinh vi vay, PCI SSC se tiep tuc bd sung, tang cffdng cac yeu cau biio mat dff lieu the toan de dam bao rang bp tieu chuan bao gdm cac yeu cau mdi hoac yeu cau dffdc sffa ddi can thiet cho viec phdng tranh nhflng rui ro ve bao mat toan • (Theo: ICMA Card Manufacturing, Spring 2009, ATM marketplace vd Card Forum)
Solidcore: Giai pliap ngan ciian malware tren ATiVI, POS
Tran Tuan Minh
Solidcore Systems Inc., nha cung cap cdng nghe bao ve tang CNTT tff cac thiet bj tdi trung tam dfl lieu, cho biet phan mem kiem soat thdi gian chay chffdng trinh la giai phap da dffdc kiem chffng bao dam sff toan ven he thdng va ngan chan ma dpc (malware) tren ATM, POS, va cac he thdng CNTT doanh nghiep ao va thffc
Sohdcore cho biet nhusg vu hack ATM chan ddng dff luan gan day, nhff vu mdt sd may ATM bj tan cdng bdi malware, chffng td rang phan mem bao mat truyen thdng da bj xuyen thQng tff cac mdi de dpa tan cdng cQa cac hacker Cho den nay, bao mat cho ATM va nhflng thiet bi tff phuc vu chl tap trung vao nhflng bien phap kiem soat phan cffng de han che sif dot nhap va can thiep vao thiet bi Nhffng viec phd bien rdng rai nhffng he dieu hanh da chffc nang va ffng dung gia tri gia tang nham tang cffdng djch vu ngan hang tff phuc vu vd tinh da tao nhieu nguy cd an ninh cho nhffng chinh he thdng quan trpng Mdt doan ma ddc tinh vi se lpi dung che dp "dich vu" hoac "bao tri" cQa ATM de ddng het nhflng cdng cu bao mat truyen thdng nhff chdng virus va ma hda
Theo Solidcore, phan mem thdi gian chay chffdng trinh cd the ngan chan hinh thffc tan cdng bang each ngan chan "trojan" chay tren he thdng va sau dd tff chdi nhflng thay ddi khdng dffdc phep ddi vdi he thdng - sff thay ddi gay nen tinh trang "tdn thffdng" ma PIN va thdng tin tai khoan dffdc ma hda cQa khach hang trd nen de dang bj truy cap de phuc vu muc dich gian lan Cdng nghe bao mat diem cudi cua Solidcore chan diing nhffng thay ddi khdng hdp le va cho phep cac nha san xuit thiit bj, td chffc CNTT doanh nghiep cQng cd cac chinh sach thay ddi phan mem da thiit lap Solidcore cho phep thffc hien nhflng ban cap nhat hdp phap nhieu ben va Iffu gifl danh sach truy nhap chi tiet cua tat ca nhflng hang muc thay ddi Vi nhu'ng ly an ninh, rat khd de truy nhap vao ATM thdng qua mpt mang Iffdi trung tam hda va phan Idn can tdi sff hd trd tai chd Kha nang de dang tao lap va phan phdi nhflng ban cap nhat dffdc chffng nhan va uy quyen tdi td chffc dieu hanh boat ddng cua cac thiet bi nay, ddng thdi chap nhan nhflng thay ddi hpp le ban cap nhat Niu ky thuat vien cd cac dac quyen truy nhap quan trj (Admin) thi cung khdng dffdc phep tien hanh nhffng thay ddi Dac tinh gdp phan dam bao sff toan ven ben vQhg cua he thdng
Cdng nghe kiem soat thdi gian chay chffdng trinh ban quySn cQa Solid- core dang cung cip giai phap bao mat va hpp chuin PCI cho hdn 100.000 thiit bj toan diem cudi (ATM va POS) tren toan thi gidi, ddng thdi cung la giai phap bao ve dffdc nhiiu nha san xuit thiet bj hang diu Hien cd hdn 100 ngan hang d Chau Au, Bac My va Trung Qudc da trien khai ffng dung giai phap di bao ve cac diim cudi quan trpng •