Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 8 replies
  • Subscribers 4 subscribers
  • Views 43051 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to pass PCI Compliance scan when RED (tcp/3400) uses a weak cipher?

JonZgoda

Our recent PCI Compliance scan came back failed because the RED service uses RC4-SHA. This is also one of the issues that the scanning company (Trustwave, who is used by our credit card processor, FirstData) will not allow to be overridden. If this is the opinion of a major credit card processor such as FirstData, you can assume that this is the opinion that much of the industry is going to have soon.

The ciphers used by RED aren't configurable, and the RED service is conspicuously absent from Sophos' SSLv3 mitigation document (https://community.sophos.com/kb/en-US/121509). I've already contacted premium support, and their response was basically, "we're aware of the issue." (Of course they're still selling RED devices as a secure means of extending your network.) They offered no advice on mitigation, other than the implied advice to wait for the patch...which any long time customer know could mean anything.

Since my remote locations that use RED have static IPs, I attempted to just add firewall rules to fix this (only allowing my IPs, drop all others). Except that RED communication must be handled prior to firewall rules, so they're completely ignored.

So the only thing left I can think of, is to go out and purchase another firewall to put in front of the UTM. Certainly not the conversation I'd like to have with those that approve large purchases such as that.



This thread was automatically locked due to age.
Parents
  • 0
    Almost all PCI compliance scans have a process to exclude results where the traffic is not used to process credit info.
    This is common practice. You'll need submit a request to exclude the RED traffic (as Credit Info can be submitted via the RED port)

    We do this all the time for our customers.
Reply
  • 0
    Almost all PCI compliance scans have a process to exclude results where the traffic is not used to process credit info.
    This is common practice. You'll need submit a request to exclude the RED traffic (as Credit Info can be submitted via the RED port)

    We do this all the time for our customers.
Children
  • 0 in reply to MW
    That is typically the case, but Trustwave has stated for this particular issue, "Please note that this vulnerability CANNOT be disputed using a Risk Mitigation and Migration plan."

    On top of that, credit card info does go over the RED links, from point-of-sale PCs back to a main server that processes the transactions.

    Their position makes since, this is a vulnerability that causes RED to be somewhat insecure, not a false-positive. Sophos has to have been aware of this issue for a long time, since they have a fix for every other SSL service, and a timeframe of "months away" for a security company to fix a well known vulnerability isn't comforting.
Unfiltered HTML