PCI 2:

Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters.

• Hackers (external and internal to a company) often use vendor default passwords and other vendor default settings to compromise systems. These passwords and settings are well known in hacker communities and easily determined via public information.
  

---

PCI-2.1 Always change the vendor-supplied defaults before you install a system on the network (e.g., passwords, SNMP community strings, and elimination of unnecessary accounts).

PCI-2.1.1 For wireless environments, change wireless vendor defaults, including but not limited to, WEP keys, default SSID, passwords, and SNMP community strings, and disabling of SSID broadcasts. Enable Wi-Fi Protected Access (WPA) technology for encryption and authentication when WPA-capable.

---

PCI-2.2 Develop configuration standards for all system components. Make sure these standards address all known security vulnerabilities and industry best practices.

PCI-2.2.1 Implement only one primary function per server (e.g., web servers, database servers, and DNS should be implemented on separate servers).

PCI-2.2.2 Disable all unnecessary and insecure services and protocols (services and protocols not directly needed to perform the devices’ specified function).

PCI-2.2.3 Configure system security parameters to prevent misuse.

PCI-2.2.4 Remove all unnecessary functionality, such as scripts, drivers, features, subsystems, file systems (e.g., unnecessary web servers).

---

PCI-2.3 Encrypt all non-console administrative access. Use technologies such as SSH, VPN, or SSL/TLS for web-based management and other non-console administrative access.

--Mdpeters 08:33, 26 June 2006 (EDT)