Security Basics mailing list archives
Re: Re: PCI Gurus?
From: krymson () gmail com
Date: 18 Jan 2011 19:58:19 -0000
PCI questions always scare me, because while PCI DSS and QSA materials try very hard to take the guesswork out of interprating the requirements, there is still a huge disconnect between various QSAs (which is a function of how different IT practices are in different companies as well as technical aptitude in QSAs...). Bottomline: You'll need to talk to real QSAs. For what prompted my post: 1) From my understanding, if you push cardholder data over network A, then network A is in scope. This also means that anything in network A is in scope. So, yes, while your devices may not have anything directly to do with cardholder data, they are still in scope by being part of the security posture of the network that is in scope. 2) Be very careful with your definition of that "private" network. If by private you simply mean internal to a company where anyone local to the "private" network is in the same network as this unencrypted transmission of cardholder data, you may be forced by your QSA to treat that as an "open" network. It is not unheard of for a QSA to suggest just encrypting transmission all the time, even inside your "private" network. <- snip -> Transactions of credit card or cardholder data that're taking place within the company private network need not be encrypted in transit. It however, should be encrypted in rest. Transactions that take place over the WAN or over the public network should be encrypted using ciphers such as HTTPs, FTPS and SFTP etc. If company A sells a networking appliance such a router or switch to company B and company B installs and places the appliance in a segment of network where creditcard processing servers and applications are hosted, company A is not in scope of PCI. If company A sells an equipment to company B which will be used by company B for swiping and accepting the credit card payments, then company A's equipment should be certified and approved by PCI or should be PA-DSS certified. Thanks, V On Fri, Jan 14, 2011 at 11:36 AM, <shankl (at) hotmail (dot) com [email concealed]> wrote:
Heres a little scenario that I wanted to throw out there and get an opinion on by someone who knows PCI. I am starting to learn but couldn't help with this problem because I've never assisted in a PCI audit... (I would think this problem has been encountered by many small companies that make network appliances) ====== Background ======= 1) Company A is a small company (only 5 employees) 2) They provide a service which requires their customer, Company B, to install a small network appliance on their LAN in order to collect data from their onsite mechanical equipment. 3) Operating data is then pulled from these mechanical systems and then dumped to a remote server which processes the data and provides a dashboard for the customer to view (via SSL). 4) Company B bought a license for this service and was also handed over the keys to administer accounts and decide which employees it would like to give access to. 5) Now let?s say that Company B typically processes credit card payments locally and sends transaction data through their local LAN on its way out to their payment processor. ====== Problems ======= 1) Company A does not take credit cards and is not required to be PCI compliant however they do provide a service which requires their network appliance to be installed on Company B?s network. 2) In recent days Company A has come to the conclusion that in some of Company B?s newly acquired satellite offices, credit card data is being forwarded across the LAN in a variety of ways (some of which do not look to be secure/encrypted). 3) In addition, several of these satellite offices are running consumer grade routers (ie: Linksys, Netgear) providing little in the way of segmentation. 4)Company A would like to avoid being ?In Scope? and having to charge the client for consulting fees. ====== Questions ======= 1) For the smaller satellite offices what might be a simple fix? 2) Does segregation provide an easy way to kick devices out of scope for PCI audits? 3) Would it be recommended/possible to have a firm produce a report which could be handed to an auditor and prove ?Out of Scope? prior to being dragged into one of these audits? 4) Could the network appliance be designed/situated in such a way as to be ?out of scope? or at least easily verifiable as compliant even if it was sitting on the same logical subnet where the card data traffic was moving across? ------------------------------------------------------------------------
------------------------------------------------------------------------ Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates. http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1 ------------------------------------------------------------------------
Current thread:
- PCI Gurus? shankl (Jan 14)
- Re: PCI Gurus? Venkatesh Selvaraju (Jan 18)
- RE: PCI Gurus? Simon Thornton (Jan 18)
- RE: PCI Gurus? Matthew Reed (Jan 18)
- PCI Gurus? daniel svartman (Jan 18)
- Re: PCI Gurus? Joseph Saselli (Jan 18)
- Re: PCI Gurus? John Morrison (Jan 21)
- RE: PCI Gurus? Jon Spiers (Jan 18)
- Re: PCI Gurus? Joseph Saselli (Jan 18)
- <Possible follow-ups>
- Re: Re: PCI Gurus? krymson (Jan 18)