0

In the answer to my question: Two factor authentication for web application under PCI DSS gowenfawr stated:

I have seen other methods used for 2FA than those you mention; IP whitelisting and adaptive authentication specifically. If you can convince your auditor it qualifies, you're all set.

I am wondering if we can use IP whitelisting for access to our servers as the second method of authentication. Requirement 8.6 of PCI DSS states:

8.6 Where other authentication mechanisms are used (for example, physical or logical security tokens, smart cards, certificates, etc.), use of these mechanisms must be assigned as follows:

  • Authentication mechanisms must be assigned to an individual account and not shared among multiple accounts.

Would IP whitelisting be allowed as the 2FA method in this situation as sysadmin users may share IPs when connecting to our CDE and other in scope servers (i.e. the public IP address of our office)?

Improve this question
8
  • 1
    Unfortunately, as with so many things in the PCI DSS, "would X be allowed" can only be answered by your QSA. Where it's not explicitly spelled out in the DSS, it's a matter of (QSA) judgement.
    – gowenfawr
    Jan 26, 2015 at 13:52
  • @gowenfawr: Thanks. What happens in the case of SAQ, as there is no QSA?
    – SilverlightFox
    Jan 26, 2015 at 13:53
  • @gowenfawris right, but we all know how easy it is to spoof an IP address...
    – nowen
    Jan 26, 2015 at 14:39
  • Then whoever you hand your SAQ to has to accept it - your processor or acquirer.
    – gowenfawr
    Jan 26, 2015 at 14:48
  • @nowen, spoofing an IP is easy. Spoofing an IP for full-duplex TCP connectivity is much harder and requires a more limited set of network conditions. Most spoofing is for things like UDP where you can do it "blind" or for DDoS / reflection attacks.
    – gowenfawr
    Jan 26, 2015 at 14:50

1 Answer 1

Reset to default
2

IP whitelisting might be accepted by a QSA this year and it may not be accepted by the same QSA or another QSA next year. If you use certificate, token or OTP 2FA, it'll pretty much be accepted by any QSA anytime.

It may be worth having a chat with your QSA about scope, segmentation, jump servers and remote access and agreeing exactly when 2FA is required. Depending on your setup, you might not need 2FA from your office to a jump server for managing the CDE if the office is segmented, not in scope but also does not constitute remote access.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .