Windows 10: LAPS vs PCI DSS

I wanted to implement LAPS in my organization but it stores passwords in plaintext and I have to comply with PCI DSS requirements such as "Req. 8.2.1: Make all authentication information unreadable using **strong encryption** during transmission and **storage** on all system components."I need to confirm if this will no put my compliance at risk.

:)

 

DSS

The DSS of which I am (only too) aware are the Data Security Standards of the Payment Card Industry, often abbreviated as PCI-DSS. There are mounds of information about this on the web. PCI-DSS is very detailed. Windows 10 supports DSS, but it's likely that
many DSS devices (card readers, POS terminals, etc.) are not supported on Windows 10.

Is this what you had in mind when you asked your question?

 

DSS

Any guides online about DSS and Windows 10 ?

 

Newegg data breach exposed customer credit card info, says report

The article states that this hack involved Magecart, which requires admin or other high level of access to be able to add the malicious javascript code.

Newegg is a PCI level 2, or possibly level 1 merchant and as such, it is required to comply with PCI Data Security Standard, PCI DSS for short. The following is just a short list of Newegg's non-compliance to PCI DSS:

1. No SSH/2FA for a limited number of production support
2. Control inbound production access with Web Application Firewall (explicit web pages whitelist)
3. Restrict outbound access to explicit whitelist
4. Monitor and alert/block website source code changes

I also question how the outside PCI DSS auditor could certify Newegg as "compliant" to PCI DSS requirement.

Nowadays, data breaches are daily occurences and all companies are excusing themselves by blaming "APT" (Advanced Persistent Threat) for the breach, instead of admitting that they had messed up. It's hard to blame them, when the regulatory agencies accept this bogus excuse and there's really no consequences for the companies. Except to their customers, of course...