Source
r/pcicompliance•
NotAgain2011

Is Antivirus software necessary on Windows 2012 server

I've found various discussions of this but no real answer. Our Server transmits CHD to Paypal Vault and from then on uses a Token to charge the account. No CHD is every stored for any time on our server. The particular question in PCI SAQ D 3.2 is "Is anti-virus software deployed on all systems commonly affected by malicious software?". I guess the question is: Is Windows Server 2012 a system that is commonly affected by malicious software?

Posted May 24, 2017, 4:27 PM UTC

26
archimidas•

Yes, without a doubt.

3
NotAgain2011OP•

Thanks, any chance you have a favorite antivirus program for this?

1
perpetual_C000009A•

Something with a central reporting feature, so you can show your auditor that you're keeping all the definition files up to date.

1
[deleted]•

Don't forget PCI deals with store, transmit AND processing CHD. Not just storing. But yes, without a doubt you need AV

2
NotAgain2011OP•

Thanks! Yes, it's the transmitting that gets us :) we just pass it off to Paypal but that's touching it so we have to comply. Is there an antivirus that you could recommend for this?

1
[deleted]•

Personally I can't recommend certain products over others as my company is vendor agnostic. Any of the top AV providers should be sufficient so long as your settings are configured according to the standard.

1
jimscard•

Just to note, if you transmit chd, you receive it too - and receiving is categorized as processing.

2
NotAgain2011OP•

Thanks, those designations need to be clear.

1
jimscard•

Yeah, it's a really old usage of the term that dates way back into the last century, when "Information Systems" were called "data processing" and the term "processing" was used in a pretty broad manner. It's still used that way today in standards, regulations & laws world-wide, even though it's rarely defined. One place you see the term "processing" clearly defined is in the UK Data Protection Act, where "processing" is defined as "Processing, in relation to information or data, means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, ...." https://ico.org.uk/for-organisations/guide-to-data-protection/key-definitions/ I always point this out to clients, as most people these days tend to think of processing as requiring more than just "receiving", but the reality is that even if some equipment received cardholder data and then did absolutely nothing with it, say, just zeroed it out, that would still be "processing" and still part of a CDE, still in scope (and everything "connected to" it would be in scope as well), because an attacker could modify it to store, or transmit the CHD elsewhere. Ultimately, PCI DSS scoping of technology is all about the questions, "can someone steal CHD from this system?" and "can someone use this system to directly attack a system that has CHD on it, even momentarily, and thereby be able to steal CHD?"

1