You are here

Home › Installing Theatre Manager › PCI DSS Cross Reference/Index › Build and Maintain a Secure Network

Requirement 2: Change Vendor Passwords

Subscribe to Syndicate
Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters

The easiest way for hackers to access your internal network is to try default passwords or exploits based on default system software settings in your payment card infrastructure. Far too often, merchants do not change default passwords or settings when they deploy the software. This is the same as leaving your store physically unlocked when you go home for the night. Default passwords and settings for most network devices are widely known. This information, combined with hacker tools showing them what devices are on your network, can make unauthorized entry a simple task – if you have failed to change the defaults.

Section PCI Requirement Comments Provided by Artsman Cloud
2.1 Always change vendor-supplied defaults and remove or disable unneccessary default accounts before installing a system on the network

This applies to ALL default passwords, including but not limited to those used by operating systems, software that provides security services, application and system accounts, point-of-sale (POS) terminals, Simple Network Management Protocl (SNMP), community strings, etc.

Change the Master User password when setting up the system.

Change any other vendor supplied passwords as described.

 NO
2.1.1 For wireless environments connected to the cardholder data environment or transmitting cardholder data, change ALL wireless vendor defaults at installation, including but not limited to default wireless encryption keys, passwords, and SNMP community strings. Theatre Manager does NOT needs wifi for operation. Refer to venue lan setup for network diagram and what to do when placing wireless devices is a separate VLAN NO
2.2 Develop configuration standards for all system components. Assure that these standards address all known security vulnerabilities and are consistent with industry-accepted hardening standards.

Sources of industry-accepted system hardening standards may include, but are not limited to:

Arts Management regularly reviews industry information and implements the latest components and security patches in installers as soon as possible. SPLIT
  • Artsman: Web sales and database
  • Customer: Workstations
2.2.1 Implement only one primary function per server to prevent functions that require different security levels from co-existing on the same server. For example, web servers, database servers and DNS servers should be on separate servers.

Note: Where virtualization technologies are in use, implement only one primary function per virtual system component.

Refer to Network Diagram for components. Also, refer to postgres setup on windows servers YES
2.2.2 Enable only necessary and secure services, protocols, daemons, etc., as required for the function of the system. refer to Disable SNMP service on Practical Automation Ticket Printers SPLIT
  • Artsman: Web sales and database
  • Customer: Workstations
2.2.3

Implement additional security features for any required services, protocols, or daemons that are considered to be insecure—for example, use secured technologies such as SSH, S-FTP, TLS, or IPSec VPN to protect insecure services such as NetBIOS, file-sharing, Telnet, FTP, etc.

Note: SSL, TLS 1.0 and TLS 1.1 are not considered strong cryptography and cannot be used as a security control after June 30, 2016.

Effective immediately, new implementations must use TLS 1.2 or later.

POS POI terminals (and the SSL/TLS termination points to which they connect) that can be verified as not being susceptible to any known exploits for SSL and early TLS may continue using these as a security control after June 30, 2016.

The NGINX Server config disables all SSL protocols and enables only TLS 1.2

Theatre Manager will connect to service providers using the latest TLS that they support and have been verified to connect via TLS 1.2 when available.

 YES
2.2.4 Configure system security parameters to prevent misuse   SPLIT
  • Artsman: Web sales and database
  • Customer: Workstations
2.2.5 Remove all unnecessary functionality, such as scripts, drivers, features, subsystems, file systems, and unnecessary web servers.   SPLIT
  • Artsman: Web sales and database
  • Customer: Workstations
2.3 Encrypt all non-console administrative access such as browser/web-based management tools. Use technologies such as SSH, VPN, or TLS for web-based management and other non-console administrative access. Theatre manager does not provide or require web based management tools

We suggest that customer use RDC, Teamviewer or equivalent internally for remote access management.

and that strong security be implemented similar to the password requirements for PCI compliance and use of SSH or VPN's for conection		 N/A
2.4 Maintain an inventory of system components that are in scope for PCI DSS For Theatre Manager, this includes You may need to include other point of sale terminals that you obtained from your bank. N/A
2.5 Ensure that security policies and operational procedures for managing vendor defaults and other security parameters are documented, in use, and known to all affected parties.   NO
2.6 Shared hosting providers must protect each entity's hosted environment and cardholder data. These providers must meed specific requirements as detailed in Appendix A: "Additional PCI DSS Requirements for Shared Hosting Providers." Not Applicable. Theatre Manager is not typically installed in a shared environment. N/A