CompTIA CySA+ (CS0-003)Reporting and CommunicationMedium
A security team is preparing a compliance report for the Payment Card Industry Data Security Standard (PCI DSS). They need to demonstrate that all system components that store, process, or transmit cardholder data are protected from malware. Which of the following would be the MOST effective metric to include in their report to satisfy this requirement?
- APercentage of cardholder data environment (CDE) systems with up-to-date anti-malware software.
- BAverage time to patch critical vulnerabilities on CDE systems.
- CNumber of unique malware signatures detected per month.
- DTotal volume of network traffic to and from the CDE.
Show answer & explanationAnswer & explanation
Correct answer: A. Percentage of cardholder data environment (CDE) systems with up-to-date anti-malware software.
PCI DSS requirement 5 focuses on protecting all systems from malware. Demonstrating the percentage of CDE systems with up-to-date anti-malware software directly addresses this requirement by showing the coverage and currency of the protection mechanisms.
Why the other options are wrong
- B. This metric relates to vulnerability management (PCI DSS Req. 6), not specifically malware protection (Req. 5).
- C. While related to malware, this metric focuses on detection rather than the proactive protection required by PCI DSS.
- D. Network traffic volume is a general network metric and does not directly demonstrate malware protection compliance.
PCI DSS Requirement 5 Compliance Metric
PCI DSS Requirement 5 mandates protecting all systems from malware and regularly updating anti-malware software. Relevant metrics demonstrate the deployment, currency, and effectiveness of these controls.
- Focuses on anti-malware deployment and updates.
- Applies to all systems, especially those in the CDE.
- Crucial for preventing compromise of cardholder data.
Memory trick: Payment Card Industry Demands Security Standards: Protect Systems from Malware.