The point of PCI 1.3.1 through 1.3.3

Question

In expansion to my previous question what qualifies as public access? I'm trying to wrap my head around the intent of the points 1.3.1 and 1.3.2 and 1.3.3 of the PCI standard.

I have four DMZs at my current job (using a sidearm setup), and this is smaller than my past implementations. These are always built in a top down security approach - a higher security box always reaches into the DMZ and pulls out the necessary bits of information it needs or pushes the bits which need to be publicly accessible.

I totally get the idea of stopping and analyzing the traffic before it goes on to an internal potentially squishy system. The language in use implies punching holes in the opposite direction. It also implies the use of an analysis engine within the DMZ.

Maybe what I don't get is how the term DMZ is being used. The functions outlined sound much more like what is done with an application level firewall:

Termination of IP connections at the DMZ provides opportunity for inspection and
restriction of source/destination, and/or inspection / blocking of content, thus
preventing unfiltered access between untrusted and trusted environments.

Termination of IP connections both inbound and outbound provides opportunity for
inspection and restriction of source/destination, and/or inspection / blocking of
content, thus preventing unfiltered access between untrusted and trusted
environments. This helps prevent, for example, malicious individuals from sending
data they've obtained from within your network out to an external untrusted server
in an untrusted network.

These descriptions sound exactly like what TMG does out of the box.

Taking this literally, I would have a second TMG box sitting inside the DMZ being provided by my first TMG box.. That just sounds nuts to me. It sounds like the standard was written for an older setup, something like having a PIX blocking all traffic and bouncing everything through a second server running something like ISA / Forefront that sits inside the DMZ.

As far as I can figure there would be no security benefit of having a separate box in the DMZ for this use my configuration, other than if I have an Apache box outside and IIS inside (or visa versa).

Please provide some insight as to how or why terminating these connections in a DMZ instead of within the firewall itself would be beneficial. I'm just not seeing it.

Answer 1

You are referring to the interpretation guide here in your question. The interpretation guide is meant to give insight into the justification for the requirement as well as some additional guidance if necessary. You are not evaluated against the Interpretation Guide, so if you see conflicting statements, it is always best to source from the Standard first and foremost.

Requirement (from the Standard)

1.3.1 Implement a DMZ to limit inbound traffic to only system components that provide authorized publicly accessible services, protocols, and ports.

Testing Procedures:
1.3.1 Verify that a DMZ is implemented to limit inbound traffic to only system components that provide authorized publicly accessible services, protocols, and ports.

Guidance statement (from the Interpetation Guide):

1.3.2 Limit inbound Internet traffic to IP addresses within the DMZ.

Termination of IP connections at the DMZ provides opportunity for inspection and restriction of source/destination, and/or inspection / blocking of content, thus preventing unfiltered access between untrusted and trusted environments.

So the standard doesn't say that you need to implement an analysis engine. It just says in the guidance document that you have the opportunity to analyse. Application firewalls are handled in section 6.6.

Answer 2

For reference design on DMZ- this working document has some good feedback:

http://www.opensecurityarchitecture.org/cms/en/library/patternlandscape/286-sp-016-dmz-module?utm_source=OSA_Subscriber_2011_Feb&utm_campaign=3d16426e9f-Open_Security_Architecture_Update_May_20105_3_2010&utm_medium=email

In addition - I agree with the poster above - its a guideline. It you are under a QSA audit level 1 PCI audit, your QSA can provide comments. If not and your under the self PCI audit but report up to the CIO, the recommendation for Dual FW and DMZ is standard architecture design in anyone doing business on the web.