®

Retail Chain Ensures
PCI DSS Compliance
Large retailer aces its annual PCI DSS audits and maintains strong
security enterprise-wide with Quest and One Identity solutions.

Country: United States
Industry: RetailModern retail organizations need to maintaincompliance with the Payment Card Industry
Data Security Standard (PCI DSS) and provethat compliance during annual audits. A failedaudit could lead to being banned from accepting
credit card payments altogether — which would
jeopardize the entire business. One PCI DSS
requirement in particular can be tough to meet:producing a complete IT audit trail for thepreceding year. But one large retail chain collects
all required log data from across its entire retail
IT environment and stores it cost-effectively as
mandated, and also maintains strong security inits business IT environment, with solutions from
Quest Software and One Identity.

PCI DSS compliance is critical toany modern retail business
Retailers need to maintain PCI DSS complianceby collecting log data across their regulated IT
environments. But modern IT ecosystems are busy
places, with many different systems collecting
huge volumes of critical log data. The IT team at
one large retail chain recognized that scripting
and other manual methods were simply not a
viable approach to passing audits. Instead, theyneeded an enterprise-quality solution that could
collect all the required data from a wide range ofsystems, including some 4,000 point-of-sale (POS)

About this case study
To pass annual PCI DSS audits and ensure
security, a large retail chain needed
enterprise-class log management with costeffective long-term data storage, as well as
advanced Active Directory monitoring andchange auditing.

SolutionWith Quest® InTrust®, the company can now
collect data from its 4,000 POS endpoints
and other systems in its regulated retail ITenvironment and store all the data in a highly
compressed format for years while retaining
easy, secure access for compliance audits
and security investigations. Meanwhile, Quest
Change Auditor and One Identity Active
Roles provide comprehensive security for thecompany’s business IT environment, thanks tofeatures such as secure delegation of administrative responsibilities and object protection.

Benefits• Enables efficient collection and costeffective storage of all data required for
PCI DSS audits• Improves security by enabling strong
control over Active Directory• Saves time by ensuring consistency
and enabling secure delegation ofadministrative tasks

endpoints across dozens of remote locations — andstore all that data cost effectively for at least a year,
as required by PCI DSS.
Beyond the regulated POS environment, the ITteam is also responsible for the systems that
handle the normal business operations that every
modern organization has, such as its Exchange andHR systems. With the threat landscape evolving
rapidly, they were eager to better secure theirActive Directory (AD) against external attacks,malicious insiders and mistakes or misdeeds byadministrators. To deliver that tight security, theyneeded a way to keep their AD in order and closely
monitor all changes to AD objects, including users
and groups.

“The policies we have in Active
Roles keep our Active Directoryorganized and ensure thateverything is done consistently,
which simplifies things for theadmins and for me.
Enterprise Administrator
Large Retail Chain”

Active Directory and Change Auditor for Windows
File Servers enable you to track, audit, reportand alert on all key configuration changes — andeven proactively protect critical objects, such asadministrative accounts and groups, from beingchanged in the first place.

20:1

Data compression enables you
to store those event logs costeffectively for years.
Ensuring and proving PCI DSS
compliance with InTrustThe company quickly set up InTrust to collectdata from multiple systems across its regulated
retail IT environment. “Every single one of ourPOS endpoints has InTrust,” says the enterpriseadministrator. “And we also use InTrust to collectlogs from our SQL servers, terminal servers, FTPand IIS. I also pull custom text logs from one server,
and we collect some syslogs as well.”After careful evaluation of the options on themarket, the retailer selected four Quest solutions.
InTrust® is a smart, scalable event log management
tool that empowers you to monitor all user
workstation and administrator activity acrossWindows, UNIX/Linux, databases, applications,network devices and more. Moreover, its 20:1 datacompression enables you to store those event logs
cost-effectively for years. InTrust even delivers realtime alerting with automated actions to ensureimmediate response to suspicious activity.

All of that data is highly compressed and stored in acentral InTrust repository, where it can be kept costeffectively for as long as required for complianceand security needs. “For PCI DSS compliance, wehave to have turn on all native logging and provide
auditors with complete logs for the past year,”
explains the admin. “Because we have so many
endpoints and so much activity, that’s a lot ofdata — we have roughly 800 gigs worth of logs at
any time. Without InTrust, we would have run outof space a long time ago. That would have been
disastrous for the business: If we couldn’t meet PCI
requirements, in the long run, we wouldn’t be able
to take credit cards.”

One Identity Active Roles streamlines user andgroup management to dramatically improvesecurity. You can easily manage all systems acrossyour on-prem or hybrid AD environment from asingle pane of glass in an automatic, consistentand comprehensive way. Change Auditor for

Thanks to the advanced compression offered byInTrust, however, the company no longer needs toworry about not being able to supply the data thatauditors require. “InTrust has a really high compression rate,” reports the enterprise administrator. “Itdefinitely saves us a lot of space, so we can store

Best-in-class solutions from theActive Directory expert

2®

all the log data we need for PCI DSS compliance. Infact, I don’t know that it would even be possible tocollect all the data, let alone store it, without InTrust
because of the amount of bandwidth that would berequired to transmit so much uncompressed data.”“For PCI DSS compliance, wehave to have turn on all native
logging and provide auditorswith complete logs for the pastyear…. Without InTrust, we
would have run out of space along time ago.

”Enterprise Administrator
Large Retail Chain

Easy searches, pre-built reports
and advanced alerting
Moreover, InTrust ensures that the IT team canquickly access the specific data they need toconduct security investigations, promptly answer
questions from auditors and maintain security.
“With the advanced indexing in the InTrust
repository, searches are very fast and easy,” theadmin says. “And the canned reports cover nearly
everything I need; I don’t go looking for anythingthat isn’t already configured.”
Proactive alerts are also essential to both security
and compliance, and the company is very pleased
with the real-time alerting functionality in InTrust.
“I have alerts set up in InTrust for pretty much
everything that gets done in Active Directory,
whether it’s creating a new user or joining amachine,” notes the admin. “That’s critical for
passing audits. For example, if a tech replaces an
endpoint, it will get rejoined, and we will get an alerton that action. The auditor will want to see that alert
to prove that we replaced the endpoint as requiredby the corresponding helpdesk ticket. With theInTrust alerts, I get everything that I need, including
all the information that the auditor requires.”

Keeping AD orderly and secure with
Active Roles and Change Auditor
In the IT environment used for office andwarehouse business operations such as Exchange
messaging, the company relies on Active Roles tomaintain tight security. “We have been using Active
Roles for five or six years,” the admin says. “Before,
Active Directory was a mess and everything wasdone differently by so many different admins.
Now, about a dozen admins have access to Active
Directory and Active Roles is the only way they
can get into it. The policies we have in Active
Roles keep our Active Directory organized andensure that everything is done consistently, whichsimplifies things for the admins and for me. For
instance, Active Roles now forces admins to create
all computer accounts in the proper OU right fromthe get go, so I don’t have to use PowerShell tomove them around later.”
Active Roles also enables the lead administrator to
granularly delegate permissions to other admins,
so he can spread out the workload without losing
control. “Active Roles saves me a lot of time, which
is important because I wear many different hats
and I’m on call 24/7/365,” he explains. “Before,I could delegate tasks to only a very few admins
because I couldn’t, for instance, have helpdesk staff
changing things in Active Directory. Active Roles
empowers me to delegate more tasks because I
can control what each person can and cannot do.
For instance, we have a director at each store. If
one them were to call the helpdesk and ask them toreset a password, the helpdesk could not do it; only
the regional managers, who can verify the identityof the person who’s make the request, can change adirector’s password.”
The two Change Auditor solutions add even moresecurity to the environment. “Change Auditor object
protection is a lifesaver,” the administrator says. “Ihave it set up to prevent changes to the ACLs on
certain directories on our file servers, as well as toprotect all administrative accounts. We’ve had pen
testers come in and be very surprised that they could
not get past the Change Auditor object protection.”3®

“We’ve had pen testers come inand be very surprised that theycould not get past the Change
Auditor object protection.
Enterprise Administrator
Large Retail Chain

World-class support”

The enterprise administrator also volunteered aresounding shout-out to Quest Support. “Evenwith all the licenses we have, I hardly ever call for
support; it’s maybe once a year,” he notes. “Butwhen I do call, the support team is always very
helpful and gets me through the issue I’m having.
The support forums on the Quest communities
are also quite useful — we’ve gotten good ideas
and suggestions about features that weren’t reallytaking full advantage of before.”

SOLUTIONS AT A GLANCE
Microsoft Platform Management
Active Roles

About Quest
Quest creates software solutions that make thebenefits of new technology real in an increasingly
complex IT landscape. From database and systems
management, to Active Directory and Office 365
management, and cybersecurity resilience, Quest
helps customers solve their next IT challenge now.
Quest Software. Where next meets now.

About One Identity
One Identity delivers unified identity security
solutions that help customers strengthen theiroverall cybersecurity posture and protect
the people, applications and data essential
to business. Our Unified Identity Security
Platform brings together best-in-class Identity
Governance and Administration (IGA), Identityand Access Management (IAM), Privileged
Access Management (PAM) and Active DirectoryManagement and Security (ADMS) capabilities toenable organizations to shift from a fragmented
to a holistic approach to identity security. One
Identity is trusted and proven on a global scale –managing more than 250 million identities for morethan 5,000 organizations worldwide. For more
information, visit www.oneidentity.com.

SYSTEM REQUIREMENTS
Active Roles
Change Auditor for Active Directory
Change Auditor for Windows File Servers
InTrust4®