View source for PCI 2:

== Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters. ==

* Hackers (external and internal to a company) often use vendor default passwords and other vendor default settings to compromise systems. These passwords and settings are well known in hacker communities and easily determined via public information.<br>
<br>
----
<br>
:'''PCI-2.1 Always change the vendor-supplied defaults before you install a system on the network (e.g., passwords, SNMP community strings, and elimination of unnecessary accounts).'''<br>
<br>
::[[Image:Key-control.jpg]][[PCI-2.1.1:|PCI-2.1.1 For wireless environments, change wireless vendor defaults, including but not limited to, WEP keys, default SSID, passwords, and SNMP community strings, and disabling of SSID broadcasts. Enable Wi-Fi Protected Access (WPA) technology for encryption and authentication when WPA-capable.]]<br>
<br>
----
<br>
:'''PCI-2.2 Develop configuration standards for all system components. Make sure these standards address all known security vulnerabilities and industry best practices.'''<br>
<br>
::[[Image:Key-control.jpg]][[PCI-2.2.1:|PCI-2.2.1 Implement only one primary function per server (e.g., web servers, database servers, and DNS should be implemented on separate servers).]]<br>
<br>
::[[Image:Key-control.jpg]][[PCI-2.2.2:|PCI-2.2.2 Disable all unnecessary and insecure services and protocols (services and protocols not directly needed to perform the devices’ specified function).''']]<br>
<br>
::[[Image:Key-control.jpg]][[PCI-2.2.3:|PCI-2.2.3 Configure system security parameters to prevent misuse.]]<br>
<br>
::[[Image:Key-control.jpg]][[PCI-2.2.4:|PCI-2.2.4 Remove all unnecessary functionality, such as scripts, drivers, features, subsystems, file systems (e.g., unnecessary web servers).]]<br>
<br>
----
<br>
::[[Image:Key-control.jpg]][[PCI-2.3:|PCI-2.3 Encrypt all non-console administrative access. Use technologies such as SSH, VPN, or SSL/TLS for web-based management and other non-console administrative access.]]<br>
<br>

--[[User:Mdpeters|Mdpeters]] 08:33, 26 June 2006 (EDT)