1

In the following PCI 2.0 requirement, I am not sure how to interpret computer access to internal machines (not remotely accessible):

Requirement 8: Assign a unique ID to each person with computer access

8.2 In addition to assigning a unique ID, employ at least one of the 
    following methods to authenticate all users:
    - Something you know, such as a password or passphrase
    - Something you have, such as a token device or smart card
    - Something you are, such as a biometric

In our system, we have a remotely accessible gateway machine and we authenticate users as per the PCI-DSS requirements.

But for various tasks, we need to access one or more internal machines and usually, this is fully automated (e.g. system upgrades). This is typically accomplished via SSH – using passwordless login.

The private key resides on the gateway server (either encrypted or non-encrypted).

My question is then if this is in violation with the 8.2 sub-requirement. The user is authenticated with the gateway machine, but does the requirement also apply for access to internal machines?

Note that the overall goal of requirement 8 is to uniquely identify computer access and not to put up "obscure security".

Improve this question

2 Answers 2

Reset to default
0

I think this is fine, as long as each user has an individual key; a key is an example of "something you know".

I don't think PCI-DSS is prescriptive about whether it needs to be encrypted, but if it is not, I suggest you have a justification for that decision (e.g. system has whole disk encryption, or is kept in a physically secured location).

If multiple users share a key then this is a violation of 8.2 because effectively each person no longer has a unique ID.

Disclaimer: I am not a QSA and it is your QSA's word that will be final.

Improve this answer
4
  • But a key is something you have, not something you know.
    – malthe
    Commented Oct 25, 2013 at 12:44
  • Either way, it is still one of the three factors mentioned, so the distinction is irrelevant for this question. These terms are not used 100% consistently. My thinking is that unless a key is securely contained within a physical object (like a smart card) that forbids extraction then it is something you know. Some people say that to be something you know, you must know it in your head alone, but I don't agree with that.
    – paj28
    Commented Oct 25, 2013 at 12:57
  • I guess it's like the modern way of knowing things, i.e. I know how to find out really quick (using the internet).
    – malthe
    Commented Oct 25, 2013 at 17:07
  • Another way to think about this: if you write down your password on a post-it note, is that then "something you have"?
    – paj28
    Commented Oct 25, 2013 at 17:11
1

Every user should have a key for every machine he needs to work on. This key should password protected and NOT reside on the gateway server. You should not share keys among your different user. If this is too complicated you can have a look at centrify or SSO. Don't forget about accountability!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .