Requirement 8: Identify Users and Authenticate Access to System Components
Authentication factors: 1) something you know (password/passphrase), 2) something you have (token/smart card), 3) something you are (biometric).
All users should have unique user IDs for logging into systems. Shared or group accounts are discouraged, though PCI DSS permits them on a documented exception basis. Unique IDs are a critical part of establishing audit trails with individual accountability. Inactive user accounts should be disabled within 90 days, and user accounts for terminated users should be disabled (or deleted) immediately. User accounts should be locked out after no more than 10 failed login attempts, and the automated lockout should last for at least 30 minutes unless an administrator enables the account.
If any login session is idle for more than 15 minutes, the user must be required to re-authenticate to access to the system.
In addition to a username, each user must provide at least one of the following during authentication:
• A complex password that is a minimum of 12 characters (8 characters only if the system cannot support 12), combining numeric and alphabetic characters (something you know)
• A smartcard or other hardware authentication device (something you have)
• Biometric authentication such as a fingerprint or retina scan (something you are)
Multi-factor authentication (at least two of the three items above) is required for all non-console access into the cardholder data environment (CDE) — not just administrative access (such as SSH access from another server at the same location). All remote users (administrative or non-administrative, accessing the CDE from an outside network) must also provide two of the above items for authentication.
Passwords must be changed at least every 90 days when the password is the sole authentication factor. If account security posture is instead analyzed dynamically in real time, with access granted only when that analysis confirms the factor has not been compromised, periodic rotation is not required (Requirement 8.3.9). Users should not be allowed to repeat any of the last four passwords used.
If passwords are assigned, each user must be given a unique password and the user must be required to change their password immediately after the first use.
For any database that contains cardholder data, only database administrators must have direct access to query the database (Requirement 7.2.6). Other users must use programs and applications that perform only the database queries necessary for the user’s job function.
Go on to Requirement 9 - Physical Access.
Go back to Requirement 7 - Restricting Access.