I was wondering if anyone is using Kerberos for their 2FA solution into their CDE for PCI DSS compliance. Also what does PCI DSS say about SSO once 2FA has occured through Raduis Server.
Thanks for any suggestion or comments
(2FA = Two Factor Authentication, for those just tuning in)
I was wondering if anyone is using Kerberos for their 2FA solution into their CDE for PCI DSS compliance.
Kerberos is an authentication mechanism most commonly used to grant access based on password credentials. As such, it doesn't provide 2FA; it provides 1FA. I have seen Kerberos used as a 1FA in CDE environments.
There are 2FA systems which incorporate Kerberos, such as RedHat's Identity Management server, but in those cases Kerberos is used for "something you know" and glued to "something you have" (Software or Hardware OTP) using LDAP and possibly RADIUS. And MIT appears to have integrated Duo OTP more directly with Kerberos, at some cost of client support.
So - Kerberos may be part of a valid 2FA solution for your CDE, but in general it only provides one factor, so additional lifting is required.
Also what does PCI DSS say about SSO once 2FA has occured through Radius Server.
The DSS does not address Single Sign-On per se, however, it does state:
Multi-factor authentication can be performed either upon authentication to the particular network or to the system component.
(DSS 3.2 section 8.3)
I'm not a QSA, but I think one could make a legitimate case that that language could be used to argue that 2FA is not required upon each system component sign-on, as long as it's used for the initial login to the CDE network. Which is to say that the DSS does not appear to prohibit SSO when it requires 2FA.