I have a requirement to force MFA for all non-console administrative access to our Windows AD servers. I've sorted out log ins with RSA, but that does not prevent a domain admin from mapping a drive or connecting via \servername\share and making changes that way.

This is the PCI MFA requirement 8.3.1, for those that are familiar with PCI. I've been beating my head against a wall over this for months; I've grilled Windows admins, googled until my fingers bled, and asked for input from several QSAs. None have been able to pose even a potential solution.

Any thoughts, suggestions, or directions to look would be greatly appreciated. I'm stuck.

  • Theoretically you could enable EFS for the shares and force admins to have their keys on smart-cards. – SEJPM Sep 8 '17 at 8:34

I know, two answers to one question isn't cool - but after I posted the first answer I discussed this with some friends in the industry because it really is a question that I believe wasn't thought about when the standard was drafted (and if you think htf can you say this then look at my profile).

So I think the intent of the standard would be met if an administrator who had the rights to NET USE a drive in the CDE was made to use MFA when they first logged into the domain, even if they had no desire or intent to access the CDE. What's important is that if the admin's password is compromised (malware, MITM, packet capture etc), that captured username and password would provide no privileged access into the CDE.

| improve this answer | |
  • Thank you for asking around and coming back with this answer. So, I spoke to my QSA and he agrees with you: it meets the intent of the control. Now comes the best part: I need to figure out some way of getting the Domain Admins to go along w/ this... – afrogg Sep 21 '17 at 19:53

That's a really great question. My guess is that to allow this you must be trusting domains between the CDE and non-CDE, in which case I’d expect the admin to have logged in initially using MFA.

But it is a great question and I’d actually encourage you to submit it to the PCI SSC - I don't expect you will get a quick answer but it is the sort of question that would generate an FAQ in due course.

| improve this answer | |

[Full disclosure] I am a CEO of Systola GmbH, a company developing a 2FA solution for Windows.

We have (at least for now) the only solution on the market, apart from smartcards, that works natively with Windows shares, provides true MFA and is PCI 8.3.1 compliant.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.