crd1985
commented
5 years ago @santiago-bassett
This is the result of comparing PCI DSS 3.2 versus HIPAA security standards:
{
"pci_dss_1.1.1": "hipaa_164.312.a.1",
"pci_dss_1.3.4": "hipaa_164.312.a.1",
"pci_dss_1.4": "hipaa_164.312.a.1",
"pci_dss_10.1": "hipaa_164.312.b",
"pci_dss_10.2.1": "hipaa_164.312.b",
"pci_dss_10.2.2": "hipaa_164.312.b",
"pci_dss_10.2.4": "hipaa_164.312.b",
"pci_dss_10.2.5": "hipaa_164.312.b",
"pci_dss_10.2.6": "hipaa_164.312.b",
"pci_dss_10.2.7": "hipaa_164.312.b",
"pci_dss_10.4": "hipaa_164.312.b",
"pci_dss_10.5.2": "hipaa_164.312.b",
"pci_dss_10.5.5": "hipaa_164.312.b",
"pci_dss_10.6": "hipaa_164.312.b",
"pci_dss_10.6.1": "hipaa_164.312.b",
"pci_dss_11.4": "#N/A",
"pci_dss_11.5": "hipaa_164.312.c.1,hipaa_164.312.c.2",
"pci_dss_2.2": "#N/A",
"pci_dss_2.2.3": "#N/A",
"pci_dss_4.1": "hipaa_164.312.a.2.IV,hipaa_164.312.e.1,hipaa_164.312.e.2.I,hipaa_164.312.e.2.II",
"pci_dss_5.1": "#N/A",
"pci_dss_5.2": "#N/A",
"pci_dss_6.2": "#N/A",
"pci_dss_6.5": "#N/A",
"pci_dss_6.5.1": "#N/A",
"pci_dss_6.5.10": "#N/A",
"pci_dss_6.5.2": "#N/A",
"pci_dss_6.5.5": "#N/A",
"pci_dss_6.5.7": "#N/A",
"pci_dss_6.5.8": "#N/A",
"pci_dss_6.6": "#N/A",
"pci_dss_8.1.2": "hipaa_164.312.a.2.I,hipaa_164.312.a.2.II",
"pci_dss_8.1.4": "hipaa_164.312.a.1",
"pci_dss_8.1.5": "hipaa_164.312.a.1",
"pci_dss_8.1.6": "hipaa_164.312.a.1",
"pci_dss_8.1.8": "hipaa_164.312.a.2.III",
"pci_dss_8.2.4": "hipaa_164.312.d",
"pci_dss_8.7": "hipaa_164.312.d,hipaa_164.312.e.1,hipaa_164.312.e.2.I,hipaa_164.312.e.2.II"
}Some of the sections in PCI standard cannot be matched to a HIPAA one which could be OK because PCI DSS is much wider than HIPAA (considering only Technical Safeguards which are the ones regarding Wazuh).
@AdriiiPRodri is working on the script to automatically edit rules files using the mapping above.
AdriiiPRodri
Taking advantage of current PCI DSS mapping and HIPAA equivalences, we can map the current ruleset to the HIPAA Technical Safeguards, according to the following table:
164.310(c): Workstation Security - R
6.2
11.2
164.310(c): Workstation Security - R
7.1 - 7.3
8.1 - 8.3
8.7
164.310(c): Workstation Security - R
2.3
6.2
11.5
164.310(c): Workstation Security - R
164.308(a)(5): Security Awareness and Training - Log-in Monitoring A
2.3
6.2
11.5
164.310(c): Workstation Security - R
164.310(d)(1): Device and Media Controls - Accountability A
164.310(b): Workstation Use - R
164.310(c): Workstation Security - R
164.310(c): Workstation Security - R
9.5 - 9.7
164.308(a)(7): Contingency Plan - Disaster Recovery Plan R
164.308(a)(7): Contingency Plan - Testing and Revision Procedure A
164.310(d)(1): Device and Media Controls - Data Backup and Storage A
4.1 - 4.3
164.310(d)(1): Device and Media Controls - Accountability A
164.312(a)(1): Access Control - Encryption and Decryption A
164.312(e)(1): Transmission Security - Integrity Controls A
164.312(e)(1): Transmission Security - Encryption A
4.3
7.1 - 7.3
8.7
164.308(a)(4): Information Access Management - Isolating Health care Clearinghouse Function R
164.308(a)(4): Information Access Management - Access Authorization A
164.312(a)(1): Access Control - Encryption and Decryption A
164.312(c)(1): Integrity - Mechanism to Authenticate Electronic Protected Health Information A
164.312(a)(1): Access Control - Automatic Logoff A
164.312(d): Person or Entity Authentication - R
164.312(e)(1): Transmission Security - Integrity Controls A
164.312(e)(1): Transmission Security - Encryption A
8.7 - 8.8
164.308(a)(4): Information Access Management - Access Authorization A
164.308(a)(4): Information Access Management - Access Establishment and Modification A
164.308(a)(5): Security Awareness and Training - Password Management A
164.312(a)(1): Access Control - Unique User Identification R
164.312(a)(1): Access Control - Automatic Logoff A
164.312(d): Person or Entity Authentication - R
164.312(e)(1): Transmission Security - Integrity Controls A
164.312(e)(1): Transmission Security - Encryption A
164.308(a)(5): Security Awareness and Training - Protection from Malicious Software A
164.308(a)(5): Security Awareness and Training - Log-in Monitoring A
164.308(a)(5): Security Awareness and Training - Password Management A
Tasks: