PCI DSS 8.6.1: If accounts used by systems or applications can be used for interactive login, they
PCI DSS v4.0.1 control 8.6.1: the requirement in full, the 1 testing procedure an assessor uses to verify it, and the related controls in section 8.6.
Requirement 8: Identify Users and Authenticate Access to System Components › Section 8.6
If accounts used by systems or applications can be used for interactive login, they are managed as follows:
- Interactive use is prevented unless needed for an exceptional circumstance.
- Interactive use is limited to the time needed for the exceptional circumstance.
- Business justification for interactive use is documented.
- Interactive use is explicitly approved by management.
- Individual user identity is confirmed before access to account is granted.
- Every action taken is attributable to an individual user.
Summary
Accounts belonging to systems and applications may only be used interactively by exception, with the same conditions as a shared login.
What the assessor will examine
These are the testing procedures the standard defines for this control. They tell you what evidence to have ready.
| Procedure | |
|---|---|
| 8.6.1 | Examine application and system accounts that can be used interactively and interview administrative personnel to verify that application and system accounts are managed in accordance with all elements specified in this requirement. |
The companion to 8.2.2, applied to service accounts, and the reason it exists is that service accounts are usually far more privileged than the humans. Interactive use must be prevented unless needed, limited to the circumstance, justified, authorised, and attributable to an individual. Its practical partner is 8.6.2: if the credential is hard-coded in a script, anyone with the repository can use it interactively and none of these conditions can be enforced.
What to prepare
- The inventory of system and application accounts, marked by whether interactive login is possible at all.
- Justification and authorisation for any that permit it.
- Evidence of attribution when they are used interactively.
How to implement it
1. Disable the shell first. The cleanest answer to this control is that interactive login is not possible: no shell, no console access, no password. Then the conditions never need to be operated.
2. Separate the human path from the machine path. Where an engineer needs to act as a service, a personal account elevating into that role gives attribution for free; sharing the service credential does not.
3. Watch for the credential leaking into a repository. 8.6.2 and this control fail together, because a hard-coded password makes interactive use unpreventable and untraceable.
4. Review what changed after an incident. Service accounts get used interactively during outages, and that is exactly when the justification and authorisation are least likely to be recorded.
Where this commonly fails
- Service accounts with shells and passwords because that is how they were provisioned.
- Engineers logging in as the application to troubleshoot, with no record of who.
- Interactive use permitted permanently rather than for a circumstance.
- The account credential in configuration, so the control cannot be enforced at all.
Related controls
Others in section 8.6:
| Control | What it requires |
|---|---|
| 8.6.2 | Passwords/passphrases for any application and system accounts that can be used for interactive… |
| 8.6.3 | Passwords/passphrases for any application and system accounts are protected against misuse… |
← 8.5.1 · All controls · 8.6.2 →
Source
The requirement text and testing procedures above are reproduced from PCI DSS v4.0.1 (June 2024), ©2006-2024 PCI Security Standards Council, LLC. All rights reserved. The commentary is our own.
The official standard is authoritative and also contains the Customized Approach Objective, applicability notes and guidance for this control. Download it from the PCI Security Standards Council document library. PCI DSS is a registered standard of the PCI Security Standards Council, LLC, which does not endorse this site. Nothing here is a substitute for advice from a Qualified Security Assessor.