Ahoi,

Currently I'm looking into implementing mod_security on all our apache servers. The installation on CentOS 5.5 comes directly with the
"Core Rule Set" by the mod_security devs (curiously Debian and Ubuntu do not carry these)

They also offer the Enhanced Rule Set for mod_security in a commercial package
(info: http://www.breach.com/products/modsecurity.html )

The main point there in their info link is the first point
However acc. to this wiki article ( http://en.wikipedia.org/wiki/Payment...urity_Standard ) that specific requirement isn't stated anywhere, as well as my colleague who's working on the PCI-DSS compliance for our code/servers/etc. mentioned that he hasn't heard of this specific requirement either.

So my question would be if anyone has any experience with their ERS package and if it's needed for the PCI-DSS compliance compared to the requirements given in bullet points @ wiki article.

Any info is greatly appreciated, thanks

ERS specifically is not required for any PCI compliance, however, they do incorporate multiple PCI requirements into the ERS product.

The specific requirement that you address is a bit misleading (and not properly worded on the website). It is not a requirement for PCI-DSS compliance, however, I believe that they include it because it IS a requirement of the PA-DSS, which governs applications that process card payments. The specific PA-DSS requirement is to log payment application activity, which ERS does do; it will audit attempted card usage, logging date/time, source IP, complete request (minus card number), etc..

Since this is a product that is designed for web-servers and compliance, it is reasonable to assume that the destination server would accept card payments in some form; hence the inclusion of this functionality.

Hope this helps clear things up.

1 members found this post helpful.

Brilliant, thanks a lot!

Will mark thread as solved, as that pretty much clears it up.
Also, received the cert for compliance yesterday w/o the ERS stuff.
Might still get it though, acc. to Boss "additional security can never be bad"