PCI DSS 8.3 is stated as follows
8.3 Incorporate two-factor authentication for remote network access originating from outside the network by personnel (including users and administrators) and all third parties, (including vendor access for support or maintenance). Two-factor authentication requires that two of the three authentication methods (see Requirement 8.2 for descriptions of authentication methods) be used for authentication. Using one factor twice (for example, using two separate passwords) is not considered two-factor authentication. Examples of two-factor technologies include remote authentication and dial-in service (RADIUS) with tokens; terminal access controller access control system (TACACS) with tokens; and other technologies that facilitate two-factor authentication.
8.2 lists example authentication methods:
- Something you know, such as a password or passphrase
- Something you have, such as a token device or smart card
- Something you are, such as a biometric.
We are a service provider and if we have a web-application that non-consumer users will use to manage their account, will this need to be protected by 2FA? The testing procedure specifies that this is to protect the Cardholder Data Environment (emphasis mine):
8.2 To verify that users are authenticated using unique ID and additional authentication (for example, a password/phrase) for access to the cardholder data environment, perform the following:
- Examine documentation describing the authentication method(s) used.
- For each type of authentication method used and for each type of system component, observe an authentication to verify authentication is functioning consistent with documented authentication method(s).
As the web application does not provide access to the CDE (nor is situated in the CDE), do we need to protect this with 2FA under PCI DSS?
For security it would be a good idea to do this, however are we required to?
If so I guess the easiest option would be to issue client certificates.