In the following PCI 2.0 requirement, I am not sure how to interpret computer access to internal machines (not remotely accessible):
Requirement 8: Assign a unique ID to each person with computer access 8.2 In addition to assigning a unique ID, employ at least one of the following methods to authenticate all users: - Something you know, such as a password or passphrase - Something you have, such as a token device or smart card - Something you are, such as a biometric
In our system, we have a remotely accessible gateway machine and we authenticate users as per the PCI-DSS requirements.
But for various tasks, we need to access one or more internal machines and usually, this is fully automated (e.g. system upgrades). This is typically accomplished via SSH – using passwordless login.
The private key resides on the gateway server (either encrypted or non-encrypted).
My question is then if this is in violation with the 8.2 sub-requirement. The user is authenticated with the gateway machine, but does the requirement also apply for access to internal machines?
Note that the overall goal of requirement 8 is to uniquely identify computer access and not to put up "obscure security".