All Apps and Add-ons

Is Splunk PA-DSS validated?

maverick
Splunk Employee
Splunk Employee

Is Splunk for PCI app considered a "PA-DSS validated" app?

0 Karma

jgoldberg_splun
Splunk Employee
Splunk Employee

The PCI Standards Council does operate programs to certify organizations and technologies (like vulnerability scanners). To see the list go to the main PCI security standards web site and then click on the "Approved companies and providers" tab. (I cannot post the URL)

BUT, notice that SIEM/logging technologies like Splunk are not part of these programs and thus there is no "PCI validation" for these technologies. So, no, Splunk is not "PCI validated", but then again no SIEM/logging tool is even though they play a key role in PCI compliance.

0 Karma

maverick
Splunk Employee
Splunk Employee

According to Wikipedia, "The Payment Application Data Security Standard (PA-DSS) is the global security standard created by the Payment Card Industry Security Standards Council (PCI SSC).[1] PA-DSS was implemented in an effort to provide the definitive data standard for software vendors that develop payment applications. The standard aims to prevent developed payment applications for third parties from storing prohibited secure data including magnetic stripe, CVV2, or PIN. In that process, the standard also dictates that software vendors develop payment applications that are compliant with the Payment Card Industry Data Security Standards (PCI DSS)."

Therefore, since Splunk or the Splunk for PCI app is not a "payment application" itself and does not store secured payment card data, I believe this validation is not applicable.

Now, I'm certain that Splunk could be setup to index, search, and notify you if such security type data was being stored when/where it should NOT be doing so, in a monitoring type fashion.

hope this helps.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...