Is Splunk PA-DSS validated?

[maverick]

Is Splunk for PCI app considered a "PA-DSS validated" app?

[jgoldberg_splun]

The PCI Standards Council does operate programs to certify organizations and technologies (like vulnerability scanners). To see the list go to the main PCI security standards web site and then click on the "Approved companies and providers" tab. (I cannot post the URL)

BUT, notice that SIEM/logging technologies like Splunk are not part of these programs and thus there is no "PCI validation" for these technologies. So, no, Splunk is not "PCI validated", but then again no SIEM/logging tool is even though they play a key role in PCI compliance.

[maverick]

According to Wikipedia, "The Payment Application Data Security Standard (PA-DSS) is the global security standard created by the Payment Card Industry Security Standards Council (PCI SSC).[1] PA-DSS was implemented in an effort to provide the definitive data standard for software vendors that develop payment applications. The standard aims to prevent developed payment applications for third parties from storing prohibited secure data including magnetic stripe, CVV2, or PIN. In that process, the standard also dictates that software vendors develop payment applications that are compliant with the Payment Card Industry Data Security Standards (PCI DSS)."

Therefore, since Splunk or the Splunk for PCI app is not a "payment application" itself and does not store secured payment card data, I believe this validation is not applicable.

Now, I'm certain that Splunk could be setup to index, search, and notify you if such security type data was being stored when/where it should NOT be doing so, in a monitoring type fashion.

hope this helps.