Can some one help me to confirm that End of Life hardware complies with PCI DSS 3.2 or not?

I only see requirements for software but no mention of hardware? Any guidance would be greatly appreciated.

6.2: Protect all system components and software from known vulnerabilities by installing applicable vendor-supplied security patches. Install critical security patches within one month of release.

  • The wording seems to answer you. The goal is to ensure it is patched. – schroeder Mar 6 '19 at 20:02
  • Does a third-party count as the vendor? That I think is the real question. – DarkMatter Mar 6 '19 at 20:19

I worked for a PCI ASV for five years. This isn't compliant - you can't ensure that you're patched against security vulnerabilities if there are no security patches to apply.

However, your PCI ASV may, at their own discretion, choose not to fail you for it. I have seen clients in situations where changing the software would cost multiple millions, or where there's literally no other option. The way this is usually resolved is that they apply secondary security controls to mitigate the risk, for example isolating a Windows application inside a well-configured Citrix XenApp instance on a terminal services server, with AV installed (and up to date!) and OS lockdown in place. Or, for a web application, installing a WAF and making custom WAF rules to prevent exploitation of known vulnerabilities (e.g. XSS) as and when they come to light. In all cases this involves an in-depth security assessment of the EoL'd product in order to ascertain its security posture and risk. In most cases it also involves providing your ASV with a long-term plan to replace or move away from the EoL'd product.

Your ASV absolutely must mark non-compliant components of your network or system as non-compliant, but they may also mark it as an exception (with justification) and give you an overall pass on the assessment.

  • Thank you all for your input. This has been a battle for me against our business heads and word smiths within our organization. – engam Mar 7 '19 at 16:33
  • @engam My advice would be to try to set up a call with your QSA and ask them for advice. Ultimately it's their signature on the dotted line. – Polynomial Mar 7 '19 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.