crowmoor.se

Susan Bradley, a Microsoft Small Business Server MVP, wrote a blogentry regarding if you could get a SBS server compliant. She concludes that it is more or less impossible due to requirment 2.2.1 Implement only one primary function per server (for example, web servers, database servers, and DNS should be implemented on separate servers) and gives a good solution that is true not only for SBS servers: Keep your servers out of scope by letting someone else handle the payment.

That said it is not always possible for a company to solve the problem this way. What are then the possibilites to be PCI DSS compliant and still use a SBS-server? The reason for requirement 2.1.1. is to minimise the surface that could be attacked. If this is not possible then a compensating control has to be created. PCI DSS should be seen from a risk perspective so to handle the possible risk the first thing to do is to solve all other requirements. When everything is patched, proctected by antivirus, all processes are in place and so forth we focus on the compensating control. First thing is to divide all user accounts so that one account could not affect another. This could be handled within Active Directory and extensive monitoring should be implemented on user account creation, change and you should also implement safe guarding of administration account by letting them only login on the console and only by using multifactor authentication.

You should make sure that least privilage is implemented for all services. No service should have administration rights or run as local system. As for logging on to the SQL server where the data most possibly is saved you should not use an AD-account but a SQL Server account. All AD-accounts should be removed from SQL Server.

This goes for a starter. The rest has to be discussed with the auditor and througly tested. You should of course use the hardening guides from NSA to make sure your system is always up do date. It could be tough to be compliant but sometimes this is the only way.