Ensuring Endpoint Central MSP Compliance to Payment Card Industry (PCI) Data Security Standard

• Install and maintain a firewall configuration to protect cardholder data
• Do not use vendor-supplied defaults for system passwords and other security parameters

• Protect stored cardholder data
• Encrypt transmission of cardholder data across open, public network

• Protect all systems against malware and regularly update anti-virus software or programs
• Develop and maintain secure systems and applications

• Restrict access to cardholder data by business need to know
• Identify and authenticate access to system components
• Restrict physical access to cardholder data

• Track and monitor all access to network resources and cardholder data
• Regularly test security systems and processes

• Maintain a policy that addresses information security for all personnel

Install personal firewall software on any mobile and/or employee-owned devices that connect to the Internet when outside the network (for example, laptops used by employees), and which are also used to access the network.

Endpoint Central MSP’s software deployment helps IT admin install any kind of .exe or .msi applications, including firewall software. It will allow the IT admin to manage and monitor applications. This feature is supported for both Windows and Mac.

For mobile devices, Endpoint Central MSP Mobile Device Management provides the ability to install firewall applications and allows IT admins to monitor the status of applications through an inventory console. Also, application management will restrict users from uninstalling applications deployed by Endpoint Central MSP, regardless of whether they are employee-owned or corporate-owned devices.

Endpoint Central MSP allows creating and configuring strong passwords to secure devices and prevent intruders from hacking the devices.

Encrypt all non-console administrative access using strong cryptography. Use technologies such as SSH, VPN, or TLS for web-based management and other non-console Administrative access.

Maintain an inventory of system components that are in scope for PCI DSS.

Endpoint Central MSP allows IT admin to create a custom group (in this case, commonly affected systems) of systems and deploy anti-virus application to that particular group, ensuring system security.

For systems considered to be not commonly affected by malicious software, perform periodic evaluations to identify and evaluate evolving malware threats in order to confirm whether such systems continue to not require anti-virus software.

Endpoint Central MSP helps streamline the anti-virus definition update process and keeps a check on associated bandwidth costs. It also automates definition updates, which saves the administrator's time. These anti-virus definition updates include malwares and spywares in addition to traditional malicious software like viruses, trojans, and worms.

Ensure that all anti-virus mechanisms are maintained as follows:

Are kept current

Perform periodic scans

Generate audit logs which are retained per PCI DSS Requirement 10.7.

Endpoint Central MSP can detect and update outdated anti-virus software or patches.

Also, Endpoint Central MSP provides exclusive support for MS Forefront Client Security Definitions.

Endpoint Central MSP periodically scans the systems in the organization's network, identifies missing patches, and installs them based on system risk ranks such as healthy, vulnerable, and highly vulnerable. And, IT admin can use Endpoint Central MSP to customize these ranks.

As a remediation action, IT admin can deploy patches based on the rank and ensure systems are secured with the latest patches.

Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor supplied security patches. Install critical security patches within one month of release.

Using its vulnerability scanning and patch detection capabilities, Endpoint Central MSP Patch Management takes care of patch deployment based on missing Microsoft patches or system vulnerability. Also, Automatic Patch Deployment scheduler helps deploy security patches within one month of release (i.e. automation can be done to meet this requirement).

After the patches are deployed, the agent applies relevant Windows and security patches in the system and updates the status in Endpoint Central MSP. The status can be downloaded in the form of reports for verification.

Define access needs for each role, including:

System components and data resources that each role needs to access for their job function

Endpoint Central MSP’s RBAC (Role Based Access Control) lets IT personnel to delegate routine activities to chosen users with well-defined permission levels. The IT manager can tailor make any number of roles and assign permissions based on policy needs and then associate these roles with Endpoint Central MSP Users.

Remove/disable inactive user accounts at least every 90 days.

Endpoint Central MSP notifies IT admins if the system is not active for the specified number of days. This notification ensures that the IT admin is updated about the status of the system in the enterprise network. The inactive users information can be viewed in the form of reports.

Endpoint Central MSP’s Mobile Device Management helps the IT admin set permissible limits for the number of password attempts for the user. If the number of password attempt exceeds the limitation, the data present in the device will be wiped; this is only to maintain data confidentiality.

Also,Endpoint Central MSP MSP helps trace the number of failed password attempts.

Set the lockout duration to a minimum of 30 minutes or until an administrator enables the user ID.

Endpoint Central MSP Mobile Device Management lets the IT admin specify the time limit for the device screen to be locked. If the device is idle for more than the allowed time, the system gets locked automatically.

Endpoint Central MSP’s power management helps configure systems by enabling an option to prompt for password when the system is on Standby. The user can authenticate when the system resumes. The set configurations can be deployed to multiple systems from a central location, which gives the IT admin complete control.

Also, remote session settings allow IT admin to configure maximum idle session time out, i.e. if the session exceeds the idle time, the session is disconnected, and the remote machine is locked automatically.

Passwords/phrases must meet the following:

Require a minimum length of at least seven characters

Contain both numeric and alphabetic characters.

Endpoint Central MSP Mobile Device Management lets IT admins define parameters to create a passcode policy and configure passcode settings, such as numeric, alphabetic, password length, etc.

For systems, Endpoint Central MSP provides an option to read the complexity of passwords.

Endpoint Central MSP Mobile Device Management provides an option to specify the number of days for the passcode to be reset.

For systems, the IT admin can configure alerts at specified dates in Endpoint Central MSP MSP to notify the IT team based on which the team can take actions.

Do not allow an individual to submit a new password /phrase that is the same as any of the last four passwords /phrases he or she has used.

Endpoint Central MSPMobile Device Management allows several passcodes to be maintained in the history, which means an IT admin can specify the number of previous passwords to be maintained, so that users do not reuse them.

Addresses multi-factor authentication for all personnel with non-console administrative access/remote access to the CDE.

Endpoint Central MSP lets you enable two-factor authentication to prompt the user to enter the One Time Password (OTP) along with their default password. Endpoint Central MSP supports two-factor authentication in two modes, using email and Google authenticator.

Properly maintain inventory logs of all media and conduct media inventories at least annually.

Endpoint Central MSP helps maintain hardware device usage logs, including USB device logs. This log information can be downloaded in the form of reports for audits and to find “who did what and when.”

Perform quarterly internal
vulnerability scans and rescans as needed, until all “high-risk” vulnerabilities
(As identified in requirement 6.1) are resolved. Scans must be performed by qualified personnel.

Patch Manager can perform system scanning with Endpoint Central MSP; it scans the entire system for missing patches in the operating system. The level of vulnerability is reported with details such as system vulnerability level, missing and applicable patches, task status, etc.

Implement a risk assessment process that:
Is performed at least annually and upon significant changes to the environment.

Endpoint Central MSP provides vulnerability scanning and Patch Management solution. The scanning results are also available as reports, which help to identify threats and keeps administrator updated.

Develop usage policies for critical technologies and define proper use of these technologies.

Endpoint Central MSPlets IT admin implement policies such as configuring password and restricting the usage of Camera, YouTube, Safari Browser, etc. It also provides access to corporate accounts like email, Wi-Fi, VPN, and much more.

Endpoint Central MSP helps secure and standardize desktops and devices across the network. 

Endpoint Central MSP's Inventory module provides comprehensive details about hardware and software details of the systems and devices present in the network.

This includes hardware inventory details such as memory, operating system, manufacturer, device types, peripherals, etc. Software inventory includes details such as blacklisted application, license compliance, and software metering.

Automatic disconnect of sessions for remote-access technologies after a specific period of inactivity.

Endpoint Central MSP’s Idle session settings in the remote control tool can enhance security by specifying idle session time out.

An IT admin can specify the maximum time limit for the remote session to be idle. When the idle time limit exceeds the specified time, the session gets disconnected and the remote machine will be locked automatically.

With Endpoint Central MSP, the IT admin can create a separate login as and when needed. After the required troubleshooting or session is completed, the session can be deactivated.

Monitor and analyze security alerts and information, and distribute to appropriate personnel.

With Endpoint Central MSP’s announcement feature, the IT admin can communicate information to the appropriate user as and when required.

Administer user accounts, including additions, deletions, and modifications.

Endpoint Central MSP’s RBAC (Role Based Access Control) will enable to configure user roles, which includes role creation, modification, and deleting.

Monitor and Control all access to data.

Endpoint Central MSP enables the IT admin to restrict media devices such as USB for systems and SD card for mobile devices to ensure data is protected from leakage.