My development staff is in the process of automating our end of month process. There is a small manual step that needs to be executed.
We have been thinking about the PCI ramifications for making this accessible over the net. Looking at the PCI standards, notably 1.1 blocking public access to cardholder environment from the public internet.
I read that this wouldn't be considered publicly accessible if I have client certificates in place. This would place this more into the realm of VPN access and the associated rules.
Does this sound correct? Are there any additional gotchas I should look out for?
Perfect. Many thanks. I do have a firewall / HIP / NDS / etc all in place. The way I'm thinking the certificate authentication ( in conjunction with normal password auth) would be being used in lieu of a full fledged VPN tunnel. The certificate authentication would occur at the firewall, before anything dangerous can get into the internal network.