0

PCI DSS 8.3 is stated as follows

8.3 Incorporate two-factor authentication for remote network access originating from outside the network by personnel (including users and administrators) and all third parties, (including vendor access for support or maintenance). Two-factor authentication requires that two of the three authentication methods (see Requirement 8.2 for descriptions of authentication methods) be used for authentication. Using one factor twice (for example, using two separate passwords) is not considered two-factor authentication. Examples of two-factor technologies include remote authentication and dial-in service (RADIUS) with tokens; terminal access controller access control system (TACACS) with tokens; and other technologies that facilitate two-factor authentication.

8.2 lists example authentication methods:

  • Something you know, such as a password or passphrase
  • Something you have, such as a token device or smart card
  • Something you are, such as a biometric.

We are a service provider and if we have a web-application that non-consumer users will use to manage their account, will this need to be protected by 2FA? The testing procedure specifies that this is to protect the Cardholder Data Environment (emphasis mine):

8.2 To verify that users are authenticated using unique ID and additional authentication (for example, a password/phrase) for access to the cardholder data environment, perform the following:

  • Examine documentation describing the authentication method(s) used.
  • For each type of authentication method used and for each type of system component, observe an authentication to verify authentication is functioning consistent with documented authentication method(s).

As the web application does not provide access to the CDE (nor is situated in the CDE), do we need to protect this with 2FA under PCI DSS?

For security it would be a good idea to do this, however are we required to?

If so I guess the easiest option would be to issue client certificates.

Improve this question

1 Answer 1

Reset to default
1

What does the web application do? Ask the following questions:

  • Does it "store, process, or transmit cardholder data"?
  • Is it on the same network as a server that does?
  • Can it connect to database(s) which store cardholder data for other applications?
  • If compromised, would it "impact the security of the CDE"?

If so, it's in your CDE "in scope" for your DSS assessment and is subject to 8.2. If not, then not.

You're supposed to determine what's in and out of scope every year:

the assessed entity should confirm the accuracy of their PCI DSS scope by identifying all locations and flows of cardholder data and ensuring they are included in the PCI DSS scope.

and

The entity retains documentation that shows how PCI DSS scope was determined. The documentation is retained for assessor review and/or for reference during the next annual PCI DSS scope confirmation activity.

So, measure your web application server against the discussion on pages 10 and 11 of the PCI DSS 3.0. If you don't think it's in scope, you aren't required to have 2FA under DSS 3.0 8.2. Keep a record of you scope-determination for the audit, should you happen to qualify for one.

As to the implementation, I have seen other methods used for 2FA than those you mention; IP whitelisting and adaptive authentication specifically. If you can convince your auditor it qualifies, you're all set.

Improve this answer
5
  • Yes we have determined that it is in scope - it is not in the CDE, but it could impact the security of it.
    – SilverlightFox
    Commented Jan 26, 2015 at 13:23
  • I've also got another query about your answer - I've posted it as another question.
    – SilverlightFox
    Commented Jan 26, 2015 at 13:44
  • The only thing I would add is to think about where your users are managed and work that into the authentication process. Certs would be a separate identity management silo (in many cases). For corporate VPN deployments a radius server is typically used which can do authorization in your directory. One last tip: If your app supports http-auth and you can put it behind apache,the mod-radius, mod-ldap, etc are all possible solutions and quite simple to setup.
    – nowen
    Commented Jan 26, 2015 at 14:36
  • Is the server in scope because it can have a security impact on the CDE or is it that the web application can have a security impact on the CDE? If you're certain that the system is in scope, you may as well put it into the CDE? In terms of 2FA, this should certainly be in place for non-consumer or administrative access to the system component (i.e. the web server). It's difficult to say much without knowing more - e.g. how can this server/application impact the security of the CDE?
    – AndyMac
    Commented Jan 27, 2015 at 3:00
  • @AndyMac: The web application can have a security impact on the CDE. It is not in the CDE as there is network segregation between the server and the network where card data flows. There is no network connectivity into the CDE (except for consumer access over HTTP and HTTPS), but the web application can configure this CDE network in AWS.
    – SilverlightFox
    Commented Jan 27, 2015 at 10:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .