Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've read this nice question:

Should SSL be terminated at a load balancer?

And I have the same question, but with PCI-DSS compliance in mind.

Is SSL terminated at the load balancer, with clear communication between the load balancer and the web servers, PCI compliant?

I'm using AWS Elastic Beanstalk, which under the hood uses EC2 instances and load balancers.

share|improve this question
1  
What threat are you eliminating by having SSL between the Load Balancer and the target host? Thinking though this may guide you to an answer. (I'm not a PCI guru) –  makerofthings7 Sep 27 '13 at 23:26

2 Answers 2

up vote 5 down vote accepted

According to section 4.1 of the PCI Data Security Standard any merchant handling credit card data should:

"...use strong cryptography and security protocols such as SSL/TLS or IPSEC to safeguard sensitive cardholder data during transmission over open, public networks.”

This means that Front End SSL is allowed, as once the data reaches the LB, it is considered to have entered a secure private network.

Also, the PCI Approved Scanning Vendors Program Guide states that all servers behind a load balancer are exempt from internal scans if they share a similar configuration.

share|improve this answer
4  
you are still responsible for securing the network between the load balancer and the servers. One possibility is to isolate that segment on its own VLAN. You could also secure it with IPSec. I'd check with the QSA to see if he has any special requirements. (A big negative to the IPSec approach is managing yet another set of keys.) –  John Deters Sep 28 '13 at 4:30
    
@JohnDeters In AWS terms, would that mean using their Virtual Private Cloud? –  Benjamin Sep 28 '13 at 10:43
1  
I'm working in a top notch PCI compliant company. And we only have SSL between browser and netscalar LB. –  Novice User Sep 28 '13 at 14:21
1  
@Benjamin, it has to be secure enough to assure your assessor that it won't be the source of a breach. Your assessor may not notice; he may notice but decide it's a low risk; or he may require you to put compensating controls around it (such as IPSec or an isolated segment.) It's a judgement call on his part. It's also a call you can voluntarily choose to make even if your QSA doesn't require it. (Sorry, I'm not familiar enough with AWS to answer that for you.) –  John Deters Sep 28 '13 at 15:22
    
@JohnDeters That helps anyway, thanks. –  Benjamin Sep 28 '13 at 17:11

The answer isn't a very good one. This is one of those Grey areas of PCI and it really depends on your QSA...

At companies I've worked at in the past, we have gotten away with it, although we worked to re-establish SSL on the back end of the load balancers because it's general best practice and minimal overhead. This comes down to the "open, public networks" portion of PCI DSS 4.1 (version 2.0).

4.1 Use strong cryptography and security protocols (for example, SSL/TLS, IPSEC, SSH, etc.) to safeguard sensitive cardholder data during transmission over open, public networks.

Your internal network is not consider an "open, public network" and therefore is not subject to the encryption requirement. Honestly, I would still suggest encrypting on the back end, especially if you're using a public cloud.

Keep in mind that PCI DSS 3.0 is slated to come out soon, and compliance will be slated for 2015 in most cases (draft here). There does not seem to be any chances in the spec to require SSL on the back end.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.