Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 9 replies
  • Subscribers 4 subscribers
  • Views 2787 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

PCI Scan Failure - SPX TLS 1.0

ETFan

We're failing our PCI scan  after enabling and allowing the port for SPX email encryption. 

 

Details: A service supporting outdated versions of TLS or SSL was detected. TLS 1.0 and SSLv3 are affected by known flaws which could allow
man-in-the-middle attacks, such as
BEAST and
POODLE.

Information From Target:
Service: [port number]:TCP
Server accepted TLS 1.0 handshake with TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA cipher

 

How do we disable these weak ciphers for SPX?

SG 330 9.311-3

 

Thanks!



This thread was automatically locked due to age.
Parents Reply
  • 0 in reply to ETFan

    For what its worth, deprecated/insecure crypto protocols aside, any "proper" security audit (be it external or self-assessed depending on which flavor your required to run) for PCI-DSS compliance, should have flagged up several years outdated firmware on a security appliance and edge network equipment that is within the card data environment long since.  Being that it is one of the principal tenants of the PCI-DSS standards.

    If it were me, I would question what value these automated scans are bringing.

    Just my 2p worth.

Children
  • 0 in reply to ELHIT

    The purpose of PCI DSS is to ensure that the banks can blame you if a breach occurs.   You will go bankrupt or go to jail, not them.    They make you sign an affidavit that you have a perfect network.  If you say that you had a perfect network, and then you have a breach, and then the forensics indicates that your network was imperfect, guess who is in trouble?

    External scanning helps plug some of the obvious holes, but it also raises questions.   If the scanning services can tell so much about what products I am using and what versions of those products, the first priority should be to plug the information leakage.   But I have not figured out how to plug the leak and they have not told me.   So instead they tell me to figure out if my vendor has backported a patch for CVE-x-x on my product P version x.x.

  • 0 in reply to DouglasFoster

    Guys, my guess is that most of the people that run PCI scans really know very little.  They're clerks that simply keep track of whether their client has gotten assurance from his supplier that CVE-x-y has been mitigated when their imperfect scanning flags a potential vulnerability.  I'd have to agree that if the latest scan was done by the same company that's been doing them  before, it's time to find a better PCI scanner.  That's my $0.02 worth. ;-)

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Unfiltered HTML