Event Log Monitoring for the PCI DSS

This article has been produced to assist anyone concerned with ensuring their organization can meet PCI DSS obligations for event log management - "PCI DSS Section 10.2 Implement automated audit trails for all system components..."

There are typically two concerns that need to be addressed - first, "what is the best way to gather and centralize event logs?" And second, "what do we need to do with the event logs once we have them stored centrally? (And how will we cope with the volume?)"

To the letter of the PCI DSS, you are obliged to make use of event and audit logs in order to track user activity for any device within scope i.e. all devices which either 'touch' cardholder data or have access to cardholder data processing systems. The full heading of the Log Tracking section of the PCI DSS is as follows -

"PCI DSS Requirement 10: Track and monitor all access to network resources and cardholder data"

Logging mechanisms and the ability to track user activities are critical in preventing, detecting, or minimizing the impact of a data compromise. The presence of logs in all environments allows thorough tracking, alerting, and analysis when something does go wrong. Determining the cause of a compromise is very difficult without system activity logs.

Given that many PCI DSS estates will be geographically widespread it is always a good idea to use some means of centralizing log messages, however, you are obliged to take this route anyway if you read section 10.5.3 of the PCI DSS -

"Promptly back up audit trail files to a centralized log server or media that is difficult to alter"

The first obstacle to overcome is the gathering of event logs. Unix and Linux hosts can utilize their native syslogd capability, but Windows servers will need to use a third party Windows Sylog agent to transfer Windows Event Logs via syslog. This will ensure all event log messages form Windows servers are backed up centrally in accordance with the PCI DSS standard. Similarly, Oracle and SQL Server based applications will also require a Syslog Agent to extract log entries for forwarding to the central syslog server. Similarly, IBM z/OS mainframe or AS/400 systems will also need platform-specific agent technology to ensure event logs are backed up.

Of course, Firewalls and Intrusion Protection/Detection System (IPS/IDS), as well as the majority of switches and routers all natively generate syslog messages.

File-Integrity Monitoring and Vulnerability Scanning

While we are on the subject of deployment of agents to platforms for event log monitoring, it is worth considering the other dimensions of the PCI DSS, namely file-integrity monitoring and vulnerability scanning/assessment.

Both of these functions can be addressed using an agent on board your servers and workstations. File-Integrity monitoring (see section 11.5 of the PCI DSS) is necessary to ensure key program and operating system files are not infiltrated by Trojans or other malware, and that 'backdoor' code is not inserted within applications. File-Integrity Monitoring should be deployed to all PCs and Epos systems, Windows Servers, Unix and Linux hosts.

Vulnerability Scanning is a further element of the PCI DSS and requires all devices to be scanned regularly for the presence of security vulnerabilities. The key benefit of an agent based approach is that vulnerability scans can be performed continuously and any configuration changes rendering your PCs/Epos/Servers less secure or less 'hardened' will be identified and alerted to you. The agent will need valid PCI Security Settings/Vulnerability Assessment/PCI Hardening Checklists to be applied.

Event Log Backup to a Centralized Server

Once assembled, the Audit trail history must be backed up in a way that is "difficult to alter". Traditionally, write-once media has been used to ensure event histories cannot be altered but most centralized log server solutions now employ file-integrity monitoring as a means of detecting any attempt to change or edit the event log backup.

So in terms of our two initial questions, we have fully covered the first, but what about the next logical question of 'What do we do with - and how do we cope with - the event logs gathered?'

"PCI DSS Section 10.6 Review logs for all system components at least daily"

This is the part of the standard that causes most concern. If you consider the volume of event logs that may be generated by a typical firewall this can be significant, but if you are managing a retail estate of 800 stores with 7,500 devices within scope of the PCI DSS, the task of reviewing logs from devices is going to be impossible to achieve. This may be a good time to consider some automation of the process...?

The Security Information and Event Management or SIEM market as defined by Gartner covers the advanced generation of solutions that harvest audit and event logs, and then parse or interpret the events e.g. store events by device, event type and severity, and analyze the details within event logs as they are stored. In fact, the PCI DSS recognizes the potential value of this kind of technology

"Log harvesting, parsing, and alerting tools may be used to meet compliance with Requirement 10.6 of the PCI DSS"

SIEM technology allows event logs to be automatically and intelligently managed such that only genuinely serious security events are alerted. The best SIEM technology can distinguish between true hacker activity running a 'brute force' attack and a user who has simply forgotten their password and is repeatedly trying to access their account. Naturally there is an amount of customization required for each environment as every organization's network, systems, applications and usage patterns are unique as are the corresponding event log volumes and types.

The PCI Event log management process can be approached in three stages, ensuring that there is a straightforward progression through becoming compliant with the PCI DSS standard and becoming fully in control of your PCI Estate. The tree phases will assist you in understanding how your PCI Estate functions normally and, as a result, placing all genuine security threats into the spotlight.

1. GATHER - Implement the SIEM system and gather all event logs centrally - the SIEM technology will provide a keyword index of all events, reported by device type, event severity and even with just the basic, pre-defined rules applied, the volumes of logs by type can be established. You need to get familiar with the types of event log messages being collected and what 'good' looks like for your estate.

2. PROFILE - Refinement of event type identification and thresholds - once an initial baselining period has been completed we can then customize rules and thresholds to meet the profile of your estate, with the aim of establishing a profiled, 'steady-state' view of event types and volumes. Even though all logs must be gathered and retained for the PCI DSS, there is a large proportion of events which aren't significant on a day-to-day basis and the aim is to de-emphasize these in order to promote focus on those events which are significant.

3. FOCUS - simple thresholding for event types is adequate for some significant security events, such as anti-virus alerts or IPS signature detections, but for other security events it is necessary to correlate and pattern-match combinations and sequences of event. SIEM only becomes valuable when it is notifying you of a manageable number of significant security events.

It is important to note that even when certain events are being de-emphasized, these are still being retained in line with the PCI DSS guidelines which are to retain logs for 12 months. At least 3 months of event logs must be in an on-line, searchable format for at least 3 months, and archived for 12 months.
Again, the archived and on-line log repositories must be protected from any editing or tampering so write-once media and file integrity monitoring must be used to preserve log file integrity.

Ten Reasons Your Company Needs an Event and Conference Planner

A well-planned, well-organized and well-run conference is utmost necessary to produce a remarkable outcome. It is an event of getting individuals together for the purposes of motivating, brainstorming, and other business-related concerns. To handle this substantial job, companies are looking for help from third parties for their corporate conferences or meeting planning rather than choosing someone from their employees to achieve the task. It is because there is one major problem of choosing an event planner from the company's employees because employees are actually taking on two things - the planning of the conference as well as their other assigned responsibilities with the company. Hence often companies prefer to hire professional event planners to organize meeting, conferences, seminars and other corporate events. Here are top ten reasons, you company should hire a professional event & conference organizer.

1. A corporate event & conference organizer is fully responsible & accountable for all details. They manage the event from start to finish focusing on things such as site selection, contract, negotiations, and the entire booking process.

2. With professional event organizer, you company can organize events more often in different venues. Your company can even decide to take the gatherings to another country.

3. With the help of corporate event planners, company can hold meeting for only ten participants and meeting for a large number of participants, efficiently and professionally.

4. Your company will be benefited greatly on logistical needs with help of professional corporate meeting of conference organizer.

5. With the help of professional event organizer, your company can organize meetings, seminars or conferences at prices significantly lower the whole budget cost of the company's annual conference.

6. You company can provide meeting specification to a professional conference planner and get the information when needed.

7. An event planner can also help you hiring entertainers or vendors which are best-suited for any of your corporate events or conferences.

8. If a company has a short amount of time to plan for a conference, a professional conference planner can get al the details done in time still delivery you best venue & services for your important meeting.

9. Professional organizers will to do all details appropriately in time. They will execute their services to provide best ambiance for conferences, meetings, seminars or other corporate events.

10. Corporate event and conference organizers have professionally trained workers and staffs to handle the situations in most convenient and lucrative ways.

Event Planners And Clients Must Communicate Fully

In my over three decades of event planning, coordination and management, I have observed and been involved in events that seemed to go off without even a minor hitch, as well as those that have had certain challenges from their inception to their conclusion. While event planners must meticulously plan for any contingency, and should actually over plan and over analyze all details, the main stumbling block to most events success is how effectively the meeting planner communicates with the client. Many meeting planners believe that they are not always given the necessary access to the client, so that communication is limited. I believe, however, than any effective professional event planner should and must realize that there can be very little chance of an optimum result for any event where communication is not open.

In my three decades of planning events of all sorts, for both corporations and organizations, and for small, medium sized, and large groups, I have developed a certain set of rules, and a personal checklist to assure the best chance of success. Certainly, even with the best planning, something might go wrong, but I believe that if a meeting and event planner make one of his rules that there always must be both back up plans and contingencies, transitions can appear seamless to the casual observer and typical attendee.

Some of the items included in my checklist include:

1. Who is the client's primary point of contact? Does that person have decision making authority? What are all the contact numbers for anyone that I might need to be in touch with?

2. What is the primary objective of this event? What are the secondary and tertiary purposes, if any?

3. What is the budget? Without a budget, no professional can effectively plan and manage any event, nor should they.

4. What is the client's vision for the event? Do they merely want an event planner to implement their vision, or do they want the planner to incorporate their vision into a viable plan of action, to create a successful and well received event?

5. At which stage is the event planner getting involved? Is he negotiating everything from the beginning, or is there already a contract with the venue, and the planner is simply working within the constraints of that contract to develop, organize and produce a successful event?

Since I am a full-service, full-cycle event planner, who is also a professional negotiator, I can almost always negotiate a better contract than the client can, and the client ends up with a better "deal." Obviously, the better the initial contract, the better the terms will be, and the more "bang for the buck" the client is able to receive. Professional event planners must always insist on a pre-meeting with the client, where the entire situation is fully explained, all ramifications and expectations are reviewed, all terms, fees, costs, etc., are fully explained and agreed to, and any possible misunderstanding is discussed before it becomes one. I believe that is a major factor that differentiates between a true professional event planner, and someone who merely claims to be.

Event Management 101 - Managing Your Event

The fundamentals of Event Management involve learning the intricacies of systems like supply chain, food, and emergency management. It also involves event registration and security. These components power this complex social business machine.

Facility Management

Perform site inspection to make sure environmental service requirements can be met. Timing between groups must allow for initial setup and closing clean up.

Industry standards for floor space are required by law. Try to obtain a facility that has abundant mass transit to and from airports and hotels. Discounts may be used to encourage smooth wrapping up of financial obligations.

Emergency Management

Applying effective emergency management for Mass Crowd Events is regulated by government agencies and can be out-sourced to companies with experience dealing with the risks involved and are trained to provide a safe environment.

Listing emergency information in appropriate places at your event can help reduce confusion and prevent emergencies.

Food Management

Communicate location and availability of food. Decide whether to charge for meals - it rarely affects attendance. Appropriate cuisine, cleanliness, health and safety measures must be accounted for. References must be verified if using a caterer. Dividing your budget by expected number of guests, supplies, equipment and clean up costs will result in your being sufficiently prepared.

Event Security

Attendees are confident and relaxed when they see ticket taking, crowd control, door monitoring, ushering, and staff that is working barricaded areas, etc.

Adequate staffing, supervision, advance planning of security strategies and thoughtful emergency preparedness are all components to ensuring the well being of participants at your events. All this and a little common sense constitutes a well organized event.

Successful event management is about rolling with the punches. Although no two events will ever be the same, learning from one's mistakes by keeping a report of names, locations, invoices, number of participants, final costs of each element of the process, copies of marketing materials, lists of competent staff and volunteers, suppliers, goals and objectives met, etc. will all serve as valuable ammunition towards your next event. The more organized your final report, the better head start you will have for future events.

Baby Shower Party Favors Your Guests Will Love

One of the most delightful but challenging parts of planning baby showers is selecting the ideal keepsakes for the event. Far too many people underestimate the thought and effort that goes into selecting baby shower party favors. As many events planners and organizers know, sometimes, it is the smallest details that can color a guest's impression of a celebration, be it at first glance or in retrospect.

The most effective baby shower party favors often serve as more than just gaudy, disposable trinkets. One must bear in mind that these are not just simple giveaways: they are tokens of gratitude intended to thank the guest for lending his or her support to the expectant mother on her and her baby's special day. If the baby shower is a smashing success, the party favor may also double as a souvenir to honor the happy memories gathered from the event.

These days, a growing number of hosts and celebrants will not just settle for cutesy porcelain figures that one can get in every other shower. More practical-minded planners are now opting for baby shower party favors that are either elegant or functional. With the wide selection of trinkets available today, the baby shower host is guaranteed to find that perfect memento to reflect either the event's theme or the guest of honor's personal preferences.

Classic and elegant-looking baby shower party favors have been a longtime favorite of party planners. These souvenirs are made recognizable by their subtle and timeless designs, making them a joy to cherish and display. Plain, traditional shapes like teddy bears, cherubs and baby bottles are not uncommon. Stuffed animals and crystal figurines in shapes like carousel horses, pacifiers and pea pods for twin babies are also becoming easy to find.

With the growing demand for souvenirs made not just for show, practical and functional giveaways can now be readily ordered via most trusted party supply channels. Choosing the right functional keepsakes most often depend on your baby shower's theme. Personalized seed packets can be given away at garden-themed showers, while gingerbread cookie cutters and egg timers are great for people who love to bake. Mint tins and old-fashioned glass jars are also major crowd-pleasers. Other party favors available in this vein include custom key chains, candles, soaps, picture frames, notepads, candy dispensers, shot glasses, bowls, lotions, mugs and playing card decks.

Edible favors are also growing in demand. Many bakeries and party suppliers now offer souvenir packages that include customized cookies, cupcakes, lollipops, chocolate bars, jam preserves and even miniature fondant cakes. Edible mementos are becoming the preference of more attentive shower hosts who know how much guests dislike clutter accumulating in their homes.

One ingenious suggestion gaining popularity today is giving out invitations that double as baby shower party favors. In addition to conserving funds and resources, party favor invites are also a time-saving way to guarantee that no guests will come home empty-handed. This can also provide a unique answer to the problem of prompt RSVPs.

Flexibility Is Key to Strategic Business Planning

Many firms are intimidated by the massive changes underway in the global marketplace. While global business expansion presents significant risks, innovative managers can transform these risks into opportunities with proper strategic planning. Managers must be flexible enough to both set a plan in place, and adapt to changes should it not work properly.

While risks gestate for many reasons, the most significant challenges occur when a firm is either changing rapidly, or failing to adapt to a volatile environment. Strategy changes typically happen because a company attempts different paths to satisfying demand.

While it is necessary to be flexible, many firms make the mistake of jumping the gun, and implementing change without proper due diligence. These changes often fail to live up to expectations as a manager's rush to judgement can doom a small business operating in a competitive environment. Innovative strategic planning within a company provides a plan as managers focus on employees, and can help with adaptation to any surprising business issue that may possibly spring up.

Strategy planning should not be viewed as a one-off event, but rather a steady process that not only guarantees the holistic development of the enterprise, but also helps reach new targets and objectives. The best plans are those that are developed with both the future goals and current business needs in mind. This will help managers avoid any possible service disruptions that may arise. It is also important to take into consideration factors such as improvements in technology, expanding competition, or changing customer behavior while drawing up an effective plan.

Innovative strategic planning must outline a specific direction for development while acknowledging all of the regular hindrances that can possibly be expected. Moreover, it helps align every individual in a company towards the pursuit of corporate goals or missions, and provides a sense of accountability and participation to the workers. Thus, strategic planning can project an organization on a sure path and trajectory en-route to the specified objective.

A ideal strategy doesn't have to be written in stone. In fact it's quite possible, if not likely, for managers to discover a very broad range of alternatives should the initial plan not come to fruition. While strategy planning performs an important position in an enterprise, it is critical to remember that it isn't always a cure-all, and managers must stay on task with day to day activities. All aspects of an organization must be considered along the path to innovative strategic management, and to be successful, managers must be ready and willing to shift gears when necessary.

How to Reap the Awards from Corporate Events

Holding a successful corporate event can have many benefits, from the obvious, such as team building and problem solving, to the not so obvious, such as increased productivity and morale. But what is the best way to go about this sometimes daunting task?

Define your goals, e.g. team building.

Before you think about the event itself, you need to identify what you want to achieve from it. You may want to reward your employees for a job well done, or perhaps have a fun day to increase staff motivation. Many events are designed to enhance skills such as team building, problem solving or leadership, and most events can be a combination of fun and learning. Compile a list of goals in order of importance so you can stay focussed on the aims of the day when deciding which event to run.

Organise internally or out-source to an event management company?

The next decision to make is whether to organise the event internally or to out-source the event to an event management or training company. Organising a corporate event internally is time consuming and costly, but it could be given as a development task to suitable staff. One of the pitfalls of organising corporate events yourself, is using an inexperienced facilitator, as they may not be capable of keeping the event on track or preventing things getting out of hand. Not only could an event management company provide an experienced facilitator, there is also the advantage of having an independent presence (or referee in some instances).

Many companies have been shocked at the amount of time organising an event actually takes, from designing the event, sourcing the venue, booking the venue, sourcing and organising the equipment, preparing the venue, sorting out transport, organising the food and refreshments and obtaining public liability insurance, to paying the bills to various companies. An event management company will quote you one price covering everything, which leaves you free to enjoy the event, rather than worry about it.

Choose your event

So you know what you want from an event, and you know who will be organising it, but what exactly will you be doing on the day? The event needs to be chosen carefully to ensure you meet your desired goals whilst getting the most from the participants. Consider your audience. If one of your goals is to give people new experiences then you may want to run a very creative event for IT people or a chaotic event for auditors, but otherwise you may not get the best out of the staff if they are feeling way out of their depth and uncomfortable. Event management companies will offer a list of events to suit your goals and people, leaving you to choose the most appropriate one. They will also tailor events to your requirements, and will have run these events many times before, so you can be sure of the outcome.

If you are organising the event yourself, you need to ensure it does actually give you the required benefits. It is all too easy to get carried away with an idea, and later realise it changed so much that the event did not achieve many of the original goals. If you are organising it internally, you will also need a practice run, preferably at the actual venue, to iron out any practical problems before the big day.

Analyse the outcome

Particularly if the event had goals other than just having fun, it is important to analyse the outcome. You, or the event management company, can obtain feedback from the participants in the form of questionnaires. You also need to consider the less tangible benefits from the event, for example, are the team now gelling better together, is productivity up due to a better team morale, or has sickness reduced? Think about what you can learn from the feedback, such as understanding your staff better, making changes to the workplace/procedures, or shaping future events. An event management company will often help with this analysis if required, and even facilitate follow-on sessions if necessary.

Good luck with your event!