Timeline for PCI DSS Compliance and Firewalling Dynamic Hosts with MITM Certificates
Current License: CC BY-SA 4.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 17, 2021 at 1:05 | comment | added | gowenfawr | @jmurphyau I see, you're questioning whether this inspection makes sense for outbound legs. That's a reasonable question, but to take this back to PCI, nothing in the DSS has an opinion on that. | |
| Aug 17, 2021 at 0:33 | comment | added | jmurphyau | I think the point I was trying to get at is this is being used as a mechanism to allow access to websites - instead of whitelisting thousands of IPs for example for Office 365.. So this isn't a potential external threat accessing our systems, this is an internal system (trusted, could be web app could be something else) accessing an external system (trusted), like the payment provider themselves or a trusted third party.. In this example, the provider would have a WAF but it doesn't make sense to consider our end also to have a WAF for that traffic? thats where im seeing the difference | |
| Aug 16, 2021 at 23:23 | comment | added | gowenfawr | @jmurphyau if the device "can inspect the requests" it's WAF-like... it may call itself a next generation firewall, an application-aware firewall, a content-inspection engine, or something like that. WAF is just our most succinct term for "device that inspects content before passing it on," even if the WAF is protecting something like OLTP or batch processing or something that isn't technically 'Web'. "Application firewall" is the closest match to what you're looking for in DSS. | |
| Aug 16, 2021 at 21:37 | comment | added | jmurphyau | This info is very useful, thank you! In this context, I think a WAF might refer to something ele. The firewall is not between the client and the application, it's between the application and the card provider.. The client is actually an IVR (telephone call, pressing DTMF digits), this then talks to a web application internally and that internal app talks to the card provider. The firewall would be between app and card provider (and/or other internet endpoints required by the app) | |
| Aug 16, 2021 at 18:45 | history | answered | gowenfawr | CC BY-SA 4.0 |