2

We have a desktop app that downloads patch content via HTTP. The content is digitally signed and verified by client software after download.

Is HTTPS required to achieve PCI compliance if:

  1. No PII is transmitted
  2. Digital signatures are used to sign and verify

If HTTPS is required, is there a specific rule # or section in a specification that mandates this requirement?

Also, if so, is there any other way to achieve PCI compliance without employing HTTPS (more expensive)?

Any guidance appreciated.

1

Verifying the signatures gets you two out of the three main security features that HTTPS would provide: integrity and authenticity. It can be argued for this use that there is not a strict requirement for the third, confidentiality — though knowledge of specific patches could lead to disclosure of information possibly of use to an attacker, CWE-200.

If this is being permitted through a firewall which must meet PCI DSS, the use of an insecure protocol must be documented (PCI-DSS v3.0):

1.1.6 Documentation and business justification for use of all services, protocols, and ports allowed, including documentation of security features implemented for those protocols considered to be insecure.

The answer then is no, HTTPS is not required for this purpose. But, the process should be documented, and if required any manual steps such as maintaining certificates included, noting also that §6.2 requires you to patch, and that §6.4.5 and subordinates require change control processes for patching.

Further mitigative measures that could be recommended are

  • lock down outbound HTTP firewall rule to limited destinations if appropriate (delivery though CDNs makes this largely pointless though)
  • lock down the firewall rule to time-based, or manual enable/disable
  • instead use a HTTP proxy in a different network zone, in addition to auditable logging and future scope for DLP, this removes the need for outbound HTTP and DNS on the clients
1

As per my knowledge, https is not required if Card data is not present.

Thanks

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.