Compliance and standards
Compliance with PCI-DSS
Thales’s STA service can be leveraged by customers looking to comply with PCI-DSS to provide a strong and reliable authentication method to systems containing or processing card payment data.
Below are highlighted a number of key requirements for PCI-DSS that need to be met to obtain compliance that can be achieved using STA. However, action is required by an administrator during the simple configuration process to enable the required functionality. For more information about PCI-DSS, see the PCI Security Standards Council website.
Requirement 8.1.6b
Thales recommends the implementation of built-in system policies to protect customer login credentials from brute force attack methods. For customers leveraging STA for use with PCI-DSS compliance, it is recommended that the STA Server policy be configured for the Account Lockout/Unlock Policy to enforce that no more than six attempts can be made to access an account with incorrect credentials before that account is disabled. See Account lockout and unlock policies.
Requirement 8.2.3b
Thales recommends the use of a PIN in conjunction with a token policy of
at least six digits to provide strong multi-factor authentication for
your users. When customers look to leverage STA to comply with PCI DSS,
it is recommended that a “Server-Side” PIN be selected for the token and
the associated complexity for this PIN be alphanumeric.
For customers looking to not leverage a PIN, we recommend that the token
template for your specific token be updated prior to deployment to at
minimum a seven character OTP which is alphanumeric in its display. See
Configure server-side PINs and Token templates.
Requirement 8.2.4b
Thales recommends to never use a static password where a One Time Password (OTP) is available. When leveraging STA for PCI-DSS compliance customers must implement at least a periodically changing password and notify the user under what circumstances this must be changed (for example, every X days). The simplest way to comply with this action is to leverage an OTP which automatically changes the passcode at every login attempt. It is also recommended that the Temporary Password Policy be configured to force a change of Temporary passwords to maintain compliance for any non-OTP users. See Temporary password policy.
Requirement 8.2.5b
Thales recommends to never use a static password where a One Time Password (OTP) is available. For customers whom wish to leverage STA to comply with PCI-DSS, it is recommended that temporary passwords be disabled within the system to enforce an OTP-based authentication. See Temporary password policy.
