Access Control & Authentication Flashcards

What is the principle of least privilege in PCI compliance?

Answer: Granting users only the minimum access necessary to perform their job functions

The principle of least privilege ensures that users, processes, and systems have only the minimum access needed to perform their functions, reducing the risk of unauthorized access to cardholder data.

What is multi-factor authentication (MFA) and when does PCI DSS require it?

Answer: Authentication using two or more independent factors, required for all remote network access and administrative access to the CDE

PCI DSS requires MFA for all remote access to the cardholder data environment and all administrative access, using at least two of three factors: something you know, have, or are.

What is role-based access control (RBAC)?

Answer: Assigning access permissions based on job roles rather than individual users, simplifying management and ensuring consistency

RBAC assigns permissions to roles (e.g., 'payment processor,' 'database administrator') and then assigns users to roles, ensuring consistent, manageable access that aligns with job functions.

What are the PCI DSS requirements for password security?

Answer: Minimum 7 characters (12 recommended), complexity requirements, 90-day rotation, and prohibition of default passwords

PCI DSS v4.0 recommends passwords of at least 12 characters with complexity, requires changing every 90 days, prohibits sharing, and mandates changing all vendor defaults before deployment.

How should access to cardholder data be monitored?

Answer: Through comprehensive logging of all access to cardholder data, reviewed regularly for unauthorized activity

PCI DSS requires logging all access to network resources and cardholder data, with daily log review processes to identify anomalies, unauthorized access attempts, or suspicious activity.

What physical security controls does PCI DSS require?

Answer: Restricted physical access to cardholder data areas, visitor logs, media destruction procedures, and POS device inspection

PCI DSS requires physical access controls including badge readers, visitor management, surveillance, and secure storage for media containing cardholder data, with regular POS terminal inspection.