Gasboy CFN III Payment Application Best Practices Implementation Requirements - Manual (Page 3)

MDE-4759 CFN III Payment Application Best Practices Implementation Requirements · September 2008 Page 3
Application Best Practices
CFN III Key Management
System Keys are required to protect cardholder data against discloser and misuse. The
following should be implemented to meet PCI requirements:
• Strong keys should be generated, which are a mix of lower case letters, upper case letters,
and numerical data.
• Keys should be restricted to the fewest number of custodians necessary.
Note: A key custodian is a person who holds, maintains, controls, stores, and protects the
keys required by the CFN III system. Such keys encipher and protect customer card
data.
• Keys are to be stored in a secure manner preventing unauthorized personnel from access.
• Any old keys are to be destroyed to prevent unauthorized access.
• Keys are to be changed on a periodic basis as necessary. Changing of the keys is required to
occur at least on an annual basis.
• Keys must be changed if there is any known or suspected compromise to the system.
• Each key-custodian must sign a key-custodian form or document, which states that he or
she understands and accepts the responsibilities of key custodianship. Such a document, for
key custodianship, is to be produced, maintained, and controlled by the accessor company.
Services
XPE is set up with restricted services. The XPE system is not set up as a general PC computer
and must be used only for the purpose of housing the CFN embedded payment controller.
Microsoft XPE license states that an XPE system cannot be used as a general purpose PC. An
example of restrictions would include general software such as Microsoft Word, Microsoft
Excel, or other general applications.
The XPE system/image CD is set up for three users - administrator, guest, and gasboy. No other
users are to be added to the system. The guest user is disabled and must not be enabled. The
gasboy user is a hybrid user and the account type for the gasboy user must not be modified or
the system will not meet PCI requirements.
XPE system does not support networking and does not have the functionality for wireless
connections or other type of networking. The configuration of XPE serial ports is for
connecting to local equipment only. Using the serial ports for any other purpose may not meet
PCI security requirements. USB can be utilized to offload audit and other files to a separate
smart or thumb drive. The USB is a restricted service and will not support any other type of
device interface.