Privilege Escalation

PCIComplianceHubLast updated

The process of exploiting a vulnerability or misconfiguration to gain elevated access or privileges on a system or network. Preventing privilege escalation is an important part of PCI DSS compliance to protect cardholder data from unauthorized access.

Applies to. PCI DSS v4.0.1 does not name privilege escalation. The controls that limit it sit in four places: Requirement 7 confines each account to the privileges its job needs, so a compromised account has less to climb to; Requirement 6 patches the vulnerabilities that escalation exploits; Requirement 10 logs every action taken with administrative access; and Requirement 11 penetration tests look for the access control weaknesses it relies on.
Related. Least Privilege, Administrative Access, Privileged User, Exploit, Penetration Testing
Sources. PCI DSS v4.0.1 (June 2024)