Requirement 1 Install and Maintain a Firewall Configuration to Protect Data
You must establish firewall configuration standards that include such things as
• A formal change control process for approving and testing all external network connections and changes to the firewall configuration.
• A current network diagram showing all connections to cardholder data, including wireless networks.
• Requirements for a firewall to be deployed at each Internet connection and between any demilitarized zone (DMZ) and the intranet.
• Descriptions of groups, roles, and responsibilities for logical management of network components.
• Documented lists of all services and ports necessary for business.
• Justification and documentation for any available protocols besides HTTP and SSL (HTTPS), Secure Shell (SSH), and VPN.
• Justification and documentation for any risky protocols in use, such as FTP, Telnet, or any cleartext protocol. The justification must include the reason for using the protocol and all measures taken to secure its use.
• Periodic review of firewall and router rules.
• Configuration standards for routers.
Build a firewall configuration that denies all traffic from untrusted networks except for the following:
• Web protocols such as HTTP and HTTPS.
• System administration protocols such as SSH and VPN.
• Other protocols needed for business. Typically, these other protocols inherently use secure transport. An example might be Transport Layer Security-encrypted (TLS-encrypted) e-mail, or proprietary communications required by a PC-based banking or financial software application.
Build a firewall configuration that restricts connections between publicly accessible servers and any system components that contain cardholder data, including connections from wireless networks. The configuration should include the following:
• Ingress filters to restrict inbound Internet traffic to systems within the DMZ.
• Restricting inbound and outbound traffic to HTTP (TCP port 80) and HTTPS (TCP port 443).
• Not allowing internal addresses to pass from the Internet to the DMZ.
• Stateful inspection, which is also known as dynamic packet filtering. This type of firewall maintains an internal table in memory to track the state of connections.
• Placing the database in an internal network zone that is separate from the DMZ.
• Restricting outbound connections to those that are necessary for the payment card environment.
• Securing and synchronizing router configuration files.
• Denying all inbound and outbound traffic not explicitly permitted.
• Installation of perimeter firewalls between any wireless networks and the payment card environment.
• Installation of personal firewall software on mobile or employee-owned personal computers that access the organization's network.
Prohibit any direct public access between external networks and any systems that store cardholder information, such as databases, by doing the following:
• Implementing a DMZ to filter and screen all traffic, to prohibit direct routes for inbound and outbound traffic.
• Restricting outbound traffic from payment card applications to IP addresses within the DMZ.
Implement IP masquerading to prevent internal addresses from being translated and revealed on the Internet. Use technologies that utilize private IP address space (RFC 1918) such as network address translation and port address translation.
Continue reading here: Local and Standalone Controllers
Was this article helpful?