Systems that usePCI DSS Requirements 6.1 and 6.2 address the need to keep systems up to date with vendor-supplied security patches in order to protect systems from known vulnerabilities. Where operating systems that are no longer supported with new security patches by the vendor, OEM, or developerare not necessarily out of compliance. Compensating, security patches might not be available to protect the systems from known exploits, and these requirements would not be able to be met.
However, it may be possible to implement compensating controls couldto address risks posed by using olderunsupported operating systems . Exploit of legacy code is the main risk posed by an older operating system. Since well-known exploits are typically included as signatures to anti-virus, IDS/IPS and firewall filtering, a compensating control to consider is performing an exhaustive searchin order to meet the intent of the requirements. To be effective, the compensating controls must protect the system from vulnerabilities that may lead to exploit of the unsupported code. For example, exhaustive reviews may need to be regularly performed to ensure that all known exploits for that operating system are continually identified, and that system configurations, anti-virus, IDS/IPS, and firewall rules are allcontinually updated to address those exploits. Other compensating controls could include monitoring IDS/IPS and firewall logs more frequently than required (for example, the requirement is for daily log reviews, so more frequently may be continuously and automated), or isolating and segmenting their POS systems via firewalls from the Internet and other systems in the cardholder data environment. TheExamples of controls that may be combined to contribute to an overall compensating control include active monitoring of system logs and network traffic, properly-configured application whitelisting that only permits authenticated system files to execute, and isolating the unsupported systems from other systems and networks. Note that these examples may complement an overall compensating control, but these examples alone would not provide sufficient mitigation.
Additionally, if an unsupported operating system is Internet-facing, it will be detected and reported as an automatic failure by an ASV scan. Detection of unsupported operating systems in an ASV scan will need to be addressed according to Addressing Vulnerabilities with Compensating Controls section of the ASV Program Guide_._
The use of compensating controls should be considered a temporary solution only, as the eventual solution is to upgrade to a new and supported operating system, and the entity should have an active migration plan for doing so. For more helpassistance with compensating controls, and for questions about whether a specific implementation is consistent with the standard or is ‘compliant’meets PCI DSS requirements, please contact a Qualified Security Assessor.
