Gasboy CFN III Fuel Management System PA-DSS - Manual (Page 11)

MDE-4870A CFN III Fuel Management System PA-DSS Implementation Guide Version 3.6 · June 2010 Page 7
CFN III Key Management Getting Started
Disabling and Enabling Remote Access
Remote access is disabled by setting the remote port channel to “None” in Sys_par page 8.
Instructions for setting this are documented in MDE- 4872 CFN III Configuration Manual for
Windows XP Version 3.6.
CFN III Key Management
System Keys are required to protect card holder data against disclosure and misuse. The
following must be implemented to meet PCI requirements:
• Strong keys must be generated, which are a mix of lower case letters, upper case letters,
and numerical data.
• The Master key and Pass key must be initially loaded by two separate personnel.
Note: A key custodian is a person who holds, maintains, controls, stores, and protects the
keys required by the CFN III system. Such keys encrypt and protect customer card
data.
• Keys are to be stored in a secure manner preventing unauthorized personnel from access.
• Any old keys are to be destroyed to prevent unauthorized access.
• Keys are to be changed on a periodic basis as required. Keys must be changed at least once
a year to maintain PCI compliance.
• Keys must be changed if there is any known or suspected compromise to the system.
• Each key-custodian must sign a key-custodian form or document, which states that he or
she understands and accepts the responsibilities of key custodianship. Such a document,
for key custodianship, is to be produced, maintained, and controlled by the accessor
company.
The CFN III system provides a menu for setting and loading the security keys. For additional
information, refer to MDE-4873 CFN Series Site Controller III Start-up Manual for CFN III
Version 3.6 and Later.
Audit Trail
CFN III creates an automated audit trail to meet the PCI requirements.
The audit journal contains information about system access, system actions executed, and
programs executed. The audit file contains the user ID, action taken by the user, the security
level of the user, and the channel device location of the user. This information is required to
allow traceability of user actions and must be protected to meet PCI requirements.
The audit journal is enabled by enabling journal.log in sys_par. Disabling this audit feature
will result in the system not being PCI-DSS compliant.
The disk journal in sys_par, item 10 must be set to “Yes”. New installs will already be
defaulted to run the disk journal. The journal is used to create system access audit information
and must be set to “Yes” to meet the PCI requirements.