Source: https://www.scribd.com/doc/54800338/PCI-DSS-Wireless-Guidelines
Timestamp: 2016-09-26 05:28:26
Document Index: 384271956

Matched Legal Cases: ['art.1', 'art.2', '§ 11', '§ 1', '§ 9', '§ 2', '§ 11', '§ 4', '§ 4', '§ 12', 'art 1', '§3', '§4', '§4', '§4', '§4', '§3', '§4', '§3', '§3', '§ 5', '§ 5', '§ 5', '§ 314', '§ 314', '§ 3', '§ 5', '§ 3', '§ 3']

BrowseBrowseInterestsBiography & MemoirBusiness & LeadershipFiction & LiteraturePolitics & EconomyHealth & WellnessSociety & CultureHappiness & Self-HelpMystery, Thriller & CrimeHistoryYoung AdultBrowse byBooksAudiobooksComicsSheet MusicBrowse allUploadSign inJoinBooksAudiobooksComicsSheet MusicWelcome to Scribd! Start your free trial and access books, documents and more.Find out moreStandard: Version: Date: Author:
Data Security Standard (DSS) 1.2 July 2009 Wireless Special Interest Group
Prepared by the PCI SSC Wireless Special Interest Group (SIG) Implementation Team
Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
1 Document Overview .................................................................................................................3 1.1 Document purpose ............................................................................................................. 3 1.2 Document scope ................................................................................................................ 3 1.3 Audience ........................................................................................................................... 3 2 Wireless Operational Guide for Complying with PCI DSS ......................................................4 2.1 Defining the Cardholder Data Environment (CDE) .................................................................. 4 2.1.1 The “rogue” WLAN Access Point (AP) .............................................................................. 5 2.1.2 Adding a known WLAN to the CDE ................................................................................. 6 2.1.3 Adding a known WLAN outside of the CDE ...................................................................... 7 2.2 How to use this guide ......................................................................................................... 7 3 Applicable Requirements Pertaining to Wireless for All Networks.........................................9 3.1 Maintain a hardware inventory............................................................................................. 9 3.1.1 Summary of recommendations ...................................................................................... 9 3.2 Wireless scanning to look for rogue APs .............................................................................. 10 3.2.1 Summary of recommendations: ................................................................................... 11 3.3 Segmenting wireless networks ........................................................................................... 11 3.3.1 3.3.1. Summary of recommendations: ......................................................................... 12 4 Applicable Requirements for In-Scope Wireless Networks ..................................................13 4.1 Physical security of wireless devices ................................................................................... 13 4.1.1 4.1.1. Summary of recommendations: ......................................................................... 14 4.2 Changing the default settings of the APs ............................................................................. 14 4.2.1 Summary of recommendations: ................................................................................... 16 4.3 Wireless intrusion prevention and access logging ................................................................. 16 4.3.1 4.3.1. Summary of recommendations: ......................................................................... 18 4.4 Strong wireless authentication and encryption ..................................................................... 18 4.4.1 Summary of recommendations: ................................................................................... 20 4.5 Use of strong cryptography on transmission of cardholder data over wireless .......................... 21 4.5.1 Summary of recommendations: ................................................................................... 24 4.6 Development and enforcement of wireless usage policies ...................................................... 24 4.6.1 Summary of recommendations: ................................................................................... 25 5 Authority Documents and External References ................................................................... 26 6 Glossary of Acronyms ......................................................................................................... 28 7 PCI DSS v1.2 Cross Reference ............................................................................................. 29 8 Acknowledgments ............................................................................................................... 32
The intent of this document is to provide supplemental information. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. Special interest groups are made up of Participating Organization, Qualified Security Assessor, and Approved Scanning Vendor subject matter experts.
This document provides guidance and installation suggestions for testing and/or deploying 802.11 Wireless Local Area Networks (WLAN) for organizations that require Payment Card Industry’s Data Security Standard (PCI DSS) v1.2 compliance. The goal is to help organizations understand how PCI DSS applies to wireless environments, how to limit the PCI DSS scope as it pertains to wireless, and practical methods and concepts for deployment of secure wireless in payment card transaction environments.
This document will focus on suggestions about how 802.11 WLAN can be deployed in accordance with PCI DSS v1.2 within the Cardholder Data Environment (CDE). It will also briefly review possible installation suggestions and greater operational procedures required to make WLAN part of an overall PCI DSS compliant network. This document will not cover any networks using Bluetooth or GPRS.
This document is intended for organizations that store, process or transmit cardholder data that may or may not have deployed wireless LAN (WLAN) technology as well as assessors that audit for PCI DSS compliance as it pertains to wireless.
namely the Cardholder Data Environment (CDE). Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. These are the Point of Sale terminals wherein the cardholder data enters the network.
2. and Approved Scanning Vendor subject matter experts. in very simple and generic terms. They apply to organizations regardless of their use of wireless technology and regardless of whether the wireless technology is a part of the CDE or not. The CDE is defined as the computer environment wherein cardholder data is transferred.
The intent of this document is to provide supplemental information. These requirements apply in addition to the universally applicable set of requirements. or stored. Generally applicable wireless requirements: These are requirements that all organizations should have in place to protect their networks from attacks via rogue or unknown wireless access points (APs) and clients. and any networks or devices directly connected to that environment. they are generally applicable to organizations that wish to comply with PCI DSS. processed. Requirements applicable for in-scope wireless networks: These are requirements that all organizations that transmit payment card information over wireless technology should have in place to protect those systems. As a result.
Figure 1: Cardholder Data Environment
A. Qualified Security Assessor. Special interest groups are made up of Participating Organization. They are specific to the usage of wireless technology that is in scope for PCI DSS compliance. In Figure 1 we see a CDE consisting of a cabled network.1 Defining the Cardholder Data Environment (CDE)
Let’s begin by defining. the CDE.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
2 Wireless Operational Guide for Complying with PCI DSS
PCI DSS wireless requirements can be broken down into the following two primary categories.
A rogue wireless device is an unauthorized wireless device that can allow access to the CDE. or by various other means. E.1 The “rogue” WLAN Access Point (AP)
A rogue Access Point (AP) is any device that adds an unauthorized (and therefore unmanaged and unsecured) WLAN to the organization’s network. C.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
. This is a back office server that is within the CDE by the fact that it is connected to the same cabled network. D. process or transmit cardholder data and therefore must adhere to the PCI DSS. Traffic leaving the firewall and traversing an open or public network is encrypted to restrict the scope of the CDE to the end-points of the encryption and decryption process. A rogue AP could be added by inserting a WLAN card into a back office server (C).
2. Even if an organization that must comply with PCI DSS does not use wireless networking at all.
The intent of this document is to provide supplemental information. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. attaching an unknown WLAN router to the network (F). Special interest groups are made up of Participating Organization. it transmits cardholder data.1. This could be a hub. Wireless networking is a concern for all organizations that store. and Approved Scanning Vendor subject matter experts. this CDE is in scope for PCI DSS and this guide. in that the organization must verify and continue to ensure that there are no WLANs attached to the network. the organization must verify that wireless networking has not been introduced into the CDE over time. switch or other network device that acts to connect all devices to the same data environment. In this case. This is a firewall that demarcates the edge of the organization’s CDE. This is because there are validation requirements that extend beyond the known wireless devices and require monitoring of unknown and potentially dangerous rogue devices. Qualified Security Assessor. Therefore. whether it stores cardholder data or not.
Figure 2: Rogue APs added to the CDE
Figure 3: A CDE with an added WLAN
The intent of this document is to provide supplemental information.1. Special interest groups are made up of Participating Organization. and connect the WLAN to the CDE. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. and Approved Scanning Vendor subject matter experts.2 Adding a known WLAN to the CDE
In the case where an organization has decided to deploy a WLAN for any purpose whatsoever. then that WLAN is now a part of the CDE and is therefore in scope within the PCI DSS and within the scope of this document. 6
. Qualified Security Assessor.
or is connected to a network that is connected to the firewall on the CDE. Even though the organization is only using WLAN technology for inventory control.
. even though the AP is outside of the scope of both PCI DSS and this document. However. This guide will follow the path set forth in the flow chart.1.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
In this case. the WLAN is nevertheless within the CDE by the fact that the network traffic is not segmented away.3 Adding a known WLAN outside of the CDE
In the case where a WLAN is added outside of the CDE. the WLAN Access Point (AP) is connected directly to the wired network within the CDE. and no cardholder data is being passed back and forth. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard.
Figure 4: WLAN outside the CDE
2. then the firewall’s configuration is in scope for both the PCI DSS and this document. so that no traffic whatsoever from the WLAN passes into the CDE. beginning with scanning the network for the potential existence of a WLAN and proceeding through the rest of the steps outlined in the chart.2 How to use this guide
Figure 5 shows a step-by-step decision process for complying with PCI DSS wireless requirements. then that WLAN can be considered out of scope for the PCI DSS.
The intent of this document is to provide supplemental information. and Approved Scanning Vendor subject matter experts. if the WLAN is connected to the firewall on the CDE. Special interest groups are made up of Participating Organization. Qualified Security Assessor.
Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
Figure 5: Complying with PCI DSS wireless requirements
The intent of this document is to provide supplemental information. Qualified Security Assessor. Special interest groups are made up of Participating Organization. and Approved Scanning Vendor subject matter experts.
1 Maintain a hardware inventory
Answering the question “is a known WLAN deployed?” within the organization’s network depends upon the organization knowing the boundaries of the network and having an accurate networking inventory and hardware inventory. periodic monitoring is needed to keep unauthorized or rogue wireless devices from compromising the security of the CDE. related documents imply that such an inventory should exist while authority documents outside of the PCI DSS realm mandate it. Regardless of whether wireless networks have been deployed. process or transmit cardholder data and therefore must adhere to the PCI DSS. Threats and vulnerabilities of wireless systems are discussed in multiple authority documents found in the list at the end of this document. While there are no specific PCI DSS related authority documents that call for such an inventory. and Approved Scanning Vendor subject matter experts. Therefore. 9
3. other authority documents that call for the i management of a networking environment mandate such an inventory .
The intent of this document is to provide supplemental information. Segmenting wireless networks out of PCI DSS scope requires a firewall between the wireless network and the CDE. while not specifically mandated by PCI DSS. Note that risks in wireless networks are essentially equal to the sum of the risk of operating a wired network plus the new risks introduced by weaknesses in wireless protocols. the organization must verify that its wireless networks have been segmented away from the CDE and that wireless networking has not been introduced into the CDE over time. therefore. the organization would not know they existed and. Although the PCI DSS outlines requirements for securing existing wireless technologies. Wireless networks can be considered outside of PCI DSS scope if (i) no wireless is deployed or (ii) if wireless has been deployed and segmented away from the CDE. Even if an organization that must comply with PCI DSS does not use wireless networking as part of the Cardholder Data Environment (CDE). Special interest groups are made up of Participating Organization. Others even go as far as to mandate a hardware inventory to ensure that rogue WLAN access cards are not added to ii existing computing devices . It is strongly recommended that the organization scan all CDE locations for known WLAN devices and maintain an up-to-date inventory. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard.1 Summary of recommendations
Ensure that the organization maintains an up-to-date hardware inventory so that known APs can easily be distinguished from rogue APs. Without such an inventory.
3. any that were found would have to be initially treated as rogue devices. there are validation requirements that extend beyond the known wireless devices and require monitoring of unknown and potentially dangerous rogue devices.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
3 Applicable Requirements Pertaining to Wireless for All Networks
Wireless networking is a concern for all organizations that store. Qualified Security Assessor. A rogue wireless device is an unauthorized wireless device that can allow access to the CDE.
Wireless analyzers can range from freely available PC tools to commercial scanners and analyzers. Organizations must ensure that they scan all sites quarterly to comply with the standard.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
3. it is acceptable to use a wireless analyzer or a preventative control such as a Wireless Intrusion Detection/Prevention System (IDS/IPS) as defined by the PCI DSS. Using this method. If a wireless IDS/IPS is implemented. The goal of all of these devices is to “sniff” the airwaves and “listen” for wireless devices in the area and identify them. process or transmit cardholder data are either scanned regularly or that wireless IDS/IPS is implemented in those locations. it is important that all locations that store. the organization or its assessor may choose to validate compliance with requirement 11.1 is to ensure that an unauthorized or rogue wireless device introduced into an organization’s network does not allow unmanaged and unsecured WLAN access to the CDE.9) includes a response in the event unauthorized wireless devices are detected. during a PCI DSS assessment. or that a wireless IDS/IPS is implemented and configured to identify all wireless devices.1 Test for the presence of wireless access points by using a wireless analyzer at least quarterly or deploying a wireless IDS/IPS to identify all wireless devices in use. The person would then manually investigate each device
The intent of this document is to provide supplemental information. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. An organization may not choose to select a sample of sites for compliance. As part of the validation.
. In order to combat rogue WLANs. The intent is to prevent an attacker from using rogue wireless devices to negatively impact the security of cardholder data.g. Special interest groups are made up of Participating Organization. Qualified Security Assessor. for the purposes of validation. and Approved Scanning Vendor subject matter experts. tools that scan suspicious hardware MAC addresses on switches) may identify some unauthorized wireless devices. Verify the organization’s Incident Response Plan (Requirement 12. The PCI Security Standards Council leaves sampling.1 by selecting a sample of all locations.1
Since a rogue device can potentially show up in any CDE location. Wired scanning also fails to detect many instances of rogue wireless clients. PCI DSS requirement 11. they tend to have high false positive/negative detection rates. The organization’s responsibility is to ensure that the CDE is compliant at all times.1 clearly specifies the use of a wireless analyzer or a wireless IDS/IPS system for scanning. With that said. verify the configuration will generate alerts to personnel. at the discretion of the assessor. Testing Procedure Verify that a wireless analyzer is used at least quarterly. a technician or auditor can walk around each site and detect wireless devices. the assessor should check that the organization has the appropriate processes and technology in place to comply at all locations.
Table 1: PCI DSS § 11.
PCI DSS Requirement 11. however.2 Wireless scanning to look for rogue APs
The purpose of PCI DSS requirement 11. Wired network scanning tools that scan for wireless devices often miss cleverly hidden and disguised rogue wireless devices or devices that are connected to isolated network segments. Relying on wired side scanning tools (e. A rogue wireless client is any device that has a wireless interface that is not intended to be present in the environment.
Enable automatic alerts and containment mechanisms on the wireless IPS to eliminate rogues and unauthorized wireless connections into the CDE. the list of wireless devices should clearly identify all rogue devices connected to the CDE. The intent is to prevent unauthorized users from being able to access the CDE via a wireless network deployed for purposes other than credit card transactions. reviewed.3 Segmenting wireless networks
PCI DSS requires that wireless networks that do not store. companies should immediately remediate the rogue threat in accordance with PCI DSS requirement 12. Qualified Security Assessor. To comply with the intent of PCI DSS requirement 11. Although the PCI DSS standard does not directly state what the output of wireless analysis should be. and used to mitigate the risk of unauthorized or rogue wireless devices. Although this method is technically possible for a small number of locations. For large organizations. Special interest groups are made up of Participating Organization.
. At a minimum. it is recommended that wireless scanning be automated with a wireless IDS/IPS system.9.1. process or transmit card holder data must be isolated from the CDE using a firewall as shown in Figure 6.
Figure 6: Illustration of AP outside of PCI DSS Scope
The intent of this document is to provide supplemental information.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
to determine if it allows access to CDE and classify them as rogues or just friendly neighboring wireless devices. error-prone. Create an “Incident Response Plan” to physically eliminate rogue devices immediately from the CDE in accordance with PCI DSS requirement 12.
3.2. it does imply that it should be created. and Approved Scanning Vendor subject matter experts. C.9 and rescan the environment at the earliest possible opportunity. it is often operationally tedious. a centrally managed wireless IDS/IPS to detect and contain unauthorized/rogue wireless devices is recommended.5. For large organizations having several CDE locations.1 Summary of recommendations:
A. and costly for organizations that have several CDE locations. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. B. Use a wireless analyzer or a wireless IDS/IPS to detect unauthorized/rogue wireless devices that could be connected to the CDE at least quarterly at all locations.
.1 Summary of recommendations:
A. and Approved Scanning Vendor subject matter experts. Use a stateful packet inspection firewall to block wireless traffic from entering the CDE. a hacker can hop across VLANs using several known techniques if adequate access controls between VLANs are not in place. Monitor firewall logs daily and verify firewall rules at least once every six months.
PCI DSS Requirement 1.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
The wireless firewall should perform the following general functions: A. As a general rule. having the CDE on one VLAN and the WLAN on a separate VLAN does not adequately segment the WLAN and take it out of PCI DSS scope. and that these firewalls deny or control (if such traffic is necessary for business purposes) any traffic from the wireless environment into the cardholder data environment. This approach is more secure than another approach used often: permit all connections and traffic by default and then block specific traffic and connections.
The intent of this document is to provide supplemental information. Testing Procedure Verify that there are perimeter firewalls installed between any wireless networks and systems that store cardholder data. Wireless traffic should explicitly be blocked. should be blocked. any protocol and traffic that is not necessary in the CDE.
3. VLANs were designed for managing large LANs efficiently.. Perform stateful inspection of connections.
Table 2: PCI DSS § 1. Monitor and log traffic allowed and denied by the firewall in accordance with PCI DSS requirement 10.3 Install perimeter firewalls between any wireless networks and the cardholder data environment. the default policy for the firewall for handling inbound traffic should be to block all packets and connections into the CDE unless the traffic type and connections have been specifically permitted. Augment the firewall with a wireless IDS/IPS. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. B. This will result in reduced risk of attack and will create a CDE that has less traffic and is thus easier to monitor. Organizations should consider using outbound traffic filtering as a technique for further securing their networks and reducing the likelihood of internally based attacks. Relying on Virtual LAN (VLAN) based segmentation alone is not sufficient. and configure these firewalls to deny or control (if such traffic is necessary for business purposes) any traffic from the wireless environment into the cardholder data environment. If a firewall is being shared between wireless and other protocols/applications.2. C.11 protocol. For example. Special interest groups are made up of Participating Organization. As such. C. not used or needed for credit card transactions. Qualified Security Assessor.2.3
PCI DSS compliance requires that all firewall rules should be audited and reviewed at least every 6 months. B. Completely isolate wireless network traffic from entering the CDE by filtering wireless packets based on the 802.e. Do not use VLAN based segmentation with MAC address filters for segmenting wireless networks.
This section will cover each of these requirements sequentially. Changing default passwords and settings on wireless devices. E. Development and enforcement of wireless usage policies.
Table 3: PCI DSS § 9. These require physical access and PCI DSS requires that adequate mechanisms need to be in place to prevent unauthorized physical access to wireless devices. This includes using a firewall (requirement 1. The default settings generally do not require an administrative password. The reset function poses a particular problem because it allows an individual to negate any security settings that administrators have configured in the AP.3 Restrict physical access to wireless access points. and Approved Scanning Vendor subject matter experts. D. for example. It does this by returning the AP to its default factory settings. Physical security of wireless devices.2. many ways exist to implement physical security. gateways. An individual can reset the configuration to the default settings simply by inserting a pointed object such as a pen into the reset hole and pressing. that individual can exploit the reset feature and cancel out any security settings on the device. Additionally. Special interest groups are made up of Participating Organization. The focus of this requirement is on securing publicly accessible or risky devices. B. Obvious risks to physical security (other than theft) include the ability of an unauthorized person to reset the AP to factory defaults. gateways. Logging of wireless access and intrusion prevention.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
4 Applicable Requirements for In-Scope Wireless Networks
Wireless networks that are part of the CDE must comply with all PCI DSS requirements. one would not put a physical cage around every AP or chain down every handheld device. If a malicious user gains physical access to the device. and may disable encryption.1. For example. Qualified Security Assessor.3
Although the requirements do not state how to secure such devices. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard.1).
4. PCI DSS compliance for systems that include WLANs as a part of the CDE requires extra attention to WLAN specific technologies and processes such as: A. Testing Procedure Verify that physical access to wireless access points. and handheld devices. C.
.3) and making sure that additional rogue wireless devices have not been added to the CDE (requirement 11. Use of strong cryptography and security protocols. and F.1 Physical security of wireless devices
PCI DSS promotes the need for physical security surrounding wireless devices. In addition.
The intent of this document is to provide supplemental information. reset can be invoked remotely over the management interface or by using a serial console interface on the AP. and handheld devices is appropriately restricted.
PCI DSS Requirement 9. but one should secure those devices that are generally accessible to the public or at risk of being lost or compromised. Strong wireless authentication and encryption.1.
Secure handheld devices with strong passwords and always encrypt PSKs if cached locally.e. 14
. automatic network connection functions.1.1 Summary of recommendations:
A. For example. and are changed anytime anyone with knowledge of the keys leaves the company or changes positions Default SNMP community strings on wireless devices were changed Default passwords/passphrases on access points were changed Firmware on wireless devices is updated to support strong encryption for authentication and transmission over wireless networks (for example WPA/WPA2) Other security-related wireless vendor defaults. by mounting APs high up on the ceiling) and disabling the console interface and factory reset options by using a tamper-proof chassis. Inventory management of wireless devices and being able to track and report missing devices is recommended. D. Use a wireless monitoring system that can track and locate all wireless devices and report if one or more devices are missing. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. B.1. and Approved Scanning Vendor subject matter experts. passwords.g. on some APs. many enterprise APs are equipped with special mounting brackets that prevent ready access to the Ethernet cable.
4.2 Changing the default settings of the APs
Changing default administrative passwords. Special interest groups are made up of Participating Organization. Qualified Security Assessor. Mount APs on ceilings and walls that do not allow easy physical access. physically resetting an AP should result in centrally managed configurations being re-applied. APs housed in tamper-proof chassis are recommended. Testing Procedure Verify the following regarding vendor default settings for wireless environments and ensure that all wireless networks implement strong encryption mechanisms (for example. AES): Encryption keys were changed from default at installation. Common sense precautions like not having Pre Shared Keys (PSKs) and passwords printed on the device or stored insecurely on the device are recommended. some of which inherently contain security vulnerabilities. Ensure wireless device security settings are enabled for strong encryption technology for authentication and transmission.1 For wireless environments connected to the cardholder data environment or transmitting cardholder data. reset function. encryption settings.
PCI DSS Requirement 2. The administrator password is a prime example. Securing handheld wireless devices and laptops is more difficult since physical access to these devices is needed. factory default shared keys and Simple Network Management Protocol (SNMP) access will help eliminate many of the vulnerabilities that can impact the security of the CDE through unauthorized wireless access.
4.1. Instead of reverting to factory defaults. “password” or
The intent of this document is to provide supplemental information. the password field is blank).. Use APs with chassis and mounting options that prevent physical access to ports and reset features. Similarly.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
Options for securing wireless devices may include physically restricting access (e. the factory default configuration does not require a password (i. change wireless vendor defaults. Other APs might have simple and well-documented passwords (e. including but not limited to default wireless encryption keys. and SNMP community strings.g. if applicable
Table 4: PCI DSS § 2. C.1
Each WLAN AP device comes with its own default settings.
are fundamentally insecure. Unauthorized users can easily gain access to the device’s management console if default settings are left unchanged. Special interest groups are made up of Participating Organization. It is common knowledge that the default SNMP community string that SNMP agents commonly use is the word “public” with assigned “read” or “read and write” privileges. B. All Wi-Fi APs have a Service Set ID (SSID). that user could write data to the AP. Similarly. Disable all unnecessary hardware. Disabling the broadcast SSID feature in the APs causes the AP to ignore the message from the client and forces it to perform active scanning (probing with a specific SSID). The default values of SSID used by many 802. The default values should be changed (always a good security practice) to prevent easy access. as often as needed. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. and Approved Scanning Vendor subject matter experts. This is done through synchronizing the AP’s clock with the clocks of the other firewalls. Organizations that require SNMP should change the default community string. Some wireless APs use SNMP agents. Without the clocks being synchronized. Leaving this well-known default string unchanged leads to devices becoming vulnerable to attack. broadcasting an SSID that advertises the organization’s name or is easily identifiable with the organization is not recommended. ensure that the device’s monitoring and logging capabilities are synchronized for proper traceability.
. which allow network management software tools to monitor the status of wireless APs and clients. services. Check for the following protocols to ensure that they aren’t configured unless absolutely necessary: A. is highly recommended. the organization should simply disable SNMP altogether. which includes mechanisms to provide strong security.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
“admin”). The SSID is used to assign an identifier to the wireless network (service set). as a result. Suppressing the SSID is not necessarily a security mechanism as a hacker can sniff the SSID using fairly trivial techniques. Dynamic Host Configuration Protocol (for assigning IP addresses on the fly). Clients that wish to join a network scan an area for available networks and join by providing the correct SSID. If SNMP is not required on the network. many wireless APs have a factory default setting that allows unencrypted wireless access. to a strong community string. Privileges should be set to “read only” if that is the only access a user/system requires. and
The intent of this document is to provide supplemental information. SNMPv3. and servers. HTTP SSL (for protected web pages). and applications that the AP might have shipped with. resulting in a data integrity breach. In addition. Some APs might be pre-configured for WEP access with simple keys like “111111”. Qualified Security Assessor.11 wireless LAN vendors have been published and are well-known to would-be adversaries. If an unauthorized user were to gain access and had read/write privileges. when configuring the WLAN AP. routers. The first two versions of SNMP. support only trivial authentication based on plain-text community strings and. it is not possible to discern which logging events on the AP match logged events in other devices. The SSID is an identifier that is sometimes referred to as the “network name” and is often a simple ASCII character string. However. SNMPv1 and SMPv2.
B. Do not advertise organization names in the SSID broadcast. and malicious activity. A wireless IDS/IPS
The intent of this document is to provide supplemental information. Disable all unnecessary applications. and wireless intrusion attempts. (ii) detection of unsafe activity or configurations. and Approved Scanning Vendor subject matter experts. C.
PCI DSS Requirement 11.2. and updated per vendor instructions to ensure optimal protection. and/or intrusionprevention systems to monitor all traffic in the cardholder data environment and alert personnel to suspected compromises. Special interest groups are made up of Participating Organization. Examine IDS/IPS configurations and confirm IDS/IPS devices are configured. or standard security practices.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
C. A wireless IPS should be able to find these rogue devices even when they are configured to not broadcast information about themselves or present in isolated network segments.3 Wireless intrusion prevention and access logging
Intrusion detection is the process of monitoring the events occurring in a computer system or network and analyzing them for signs of possible incidents.
Table 5: PCI DSS § 11. Enable WPA or WPA2 and make sure that default PSKs are changed. misuse.
4. Enterprise mode is recommended. Unauthorized wireless devices connected to the CDE must be detected and disabled. Qualified Security Assessor. maintained. Wireless zero configuration service (for those APs and devices connecting to them) that run on Windows OS. (iii) detection of denial of service attacks. Testing Procedure Verify the use of intrusion-detection systems and/or intrusionprevention systems and ensure that all traffic in the cardholder data environment is monitored. These capabilities can be grouped into three categories: (i) rogue wireless device containment. Synchronize the APs’ clocks to be the same as other networking equipment used by the organization. If not. which are violations or imminent threats of violation of computer security policies. ports. D.1 Summary of recommendations:
A. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. An Intrusion Detection System (IDS) is software that automates the intrusion detection process.
4. Disable SNMP access to remote APs if possible. change default SNMP passwords and use SNMPv3 with authentication and privacy enabled.4
Wireless IDS/IPS provides several types of security capabilities intended to detect misconfiguration. and protocols. Keep all intrusion-detection and prevention engines up-to-date. In addition to rogue containment.
. E. An Intrusion Prevention System (IPS) is a system that has all the capabilities of an IDS and can also attempt to stop possible incidents.4 Use intrusion-detection systems. acceptable use policies. Confirm IDS and/or IPS are configured to alert personnel of suspected compromises. organizations should evaluate the automatic device classification capabilities of the wireless IDS/IPS for situations when connectivity cannot be determined.
An IDS/IPS system can generate a lot of wireless threat information. Most wireless IDS/IPSs can identify the physical location of a detected threat by using signal strength triangulation. For example. then organizations should ensure the signatures are updated when new threats are discovered. This allows an organization to send physical security staff to the location to address the threat. This is accomplished by identifying deviations from organization-specific policies for configuration settings such as encryption. data rates. Many wireless IPS systems provide the ability to prevent clients from associating with an unauthorized AP or disable an ad hoc network. Some wireless IDS/IPS use anomaly and/or behavior based detection methods to detect unusual WLAN usage patterns. or the maximum log size is reached). the information has to be properly logged. or unauthorized parties might be using the WLAN. then calculating the physical location at which the threat would be located to satisfy the distance criteria from each sensor. and Approved Scanning Vendor subject matter experts. on all operational channels. A wireless IDS/IPS can detect misconfigurations and unsafe activity by monitoring and analyzing wireless communications. This includes detecting misconfigurations and the use of weak WLAN protocols. SSID names. Qualified Security Assessor. efficacy of these techniques vary widely and can provide adequate temporary mitigation of the risk. a device on the network. the organization must ensure that at least the following logging items are coordinated correctly: A. The level of logging (the types of events to log). unauthorized/rogue or neighboring. requires the system to look for attempts to disrupt the wireless network. In this case. Triangulation is the process of estimating the threat’s approximate distance from multiple sensors by the strength of the threat’s signal received by each sensor. one of the devices might have been compromised. A wireless IDS/IPS can analyze wireless traffic to look for malicious activity such as Denial of Service (DoS) and individual attacks on devices. authentication. and classify each device as authorized. unauthorized devices should be physically and/or logically removed from the CDE as soon as possible. In order for the organization to be able to use this information. However. C. If these detections are signature-based. The log file prefix (used to identify the device conducting the logging). they could detect that a wireless device is using WEP instead of WPA2. Some systems can also alert if any WLAN activity is detected during off-hours periods. Special interest groups are made up of Participating Organization. or to gain unauthorized access to the network.
The intent of this document is to provide supplemental information. This implies that the logs from the IDS/IPS have to be coordinated with other logging systems on the network (if there are any). and channels.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
should be able to observe all APs and clients. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. For example. Most can identify APs and clients that are not using the proper security controls. B. The log auto-roll setting (whether a new log file is created when the device is restarted. This task. as in wired IDS/IPS. 17
. if there is a higher than usual amount of network traffic between a wireless client and an AP.
in the Institute of Electrical and Electronics Engineers (IEEE) 802. 18
. even with WEP enabled. Use a centrally controlled wireless IDS/IPS to monitor for unauthorized access and detect rogues and misconfigured wireless devices.1 Summary of recommendations:
A. and Approved Scanning Vendor subject matter experts.4 Strong wireless authentication and encryption
4. These studies showed that. This is a device doing the legwork of watching out for potential problems. D. C. Enable historical logging of wireless access that can provide granular wireless device information and store event logs and statistics for at least 90 days. Special interest groups are made up of Participating Organization. you can refer to Understanding WEP Weaknesses [20]. E. the Wi-Fi Alliance introduced Wi-Fi Protected Access (WPA) as a strong.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
D. the Wi-Fi Alliance introduced Wi-Fi Protected Access 2 (WPA2). To learn more about this. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. the original native security mechanism for wireless local area networks (WLANs). Add processes and policies that will regularly read and act on the data provided by the IDS/IPS. WPA provides assurance that their data will remain protected and that only authorized users may access their networks. The organization’s policies and procedures must take into account the reading and taking action on the logs provided by this and other key monitoring devices. However. standardsbased interoperable Wi-Fi security specification. G. they must be resolved. an intruder equipped with the proper tools and a moderate amount of technical knowledge could gain unauthorized access to the wireless network via the WLAN. It is not enough to merely purchase and properly configure the IDS/IPS. Qualified Security Assessor. WPA uses Temporal Key Integrity Protocol (TKIP) for data encryption that changes keys used for encryption on a per packet basis. Coordinate logging events with other networking devices within the organization. the organization must read and respond to the IDS/IPS reports. Enable IPS features that automatically disable rogue wireless devices connecting to the CDE as well as accidental or malicious associations of wireless clients. WPA2 provides Wi-Fi users with a high level of assurance that their
The intent of this document is to provide supplemental information.11 specification. Ensure the IPS signature set is regularly updated as new threats are discovered. a series of independent studies from various academic and commercial institutions had identified weaknesses in Wired Equivalent Privacy (WEP). the second generation of WPA security. If there are anomalies. Like WPA. The log maximum (log age in days). what it can’t do is stop a potential cardholder data breach without personnel interaction. After gathering the information within the IDS/IPS. Maintain a current topology of all physical locations of access points.
4. F. In 2004. B.3. In 2003.
1 For wireless networks transmitting cardholder data or connected to the cardholder data environment. The Wi-Fi Alliance certifies products as WPA or WPA2 compatible for interoperability based on the 802. verify that industry best practices (for example. In this mode. Qualified Security Assessor.1X/EAP Encryption: TKIP/MIC Authentication: PSK Encryption: TKIP/MIC WPA2 Authentication: IEEE 802. Enterprise mode operates in a managed mode to meet the rigorous requirements of enterprise security. It operates in an unmanaged mode that uses a Pre-Shared key (PSK) for authentication instead of IEEE 802.1. each user is assigned a unique key mechanism for access to the WLAN. 19
. To protect against a brute force attack. making the encryption code
The intent of this document is to provide supplemental information.1. For WPA. Consequently. IEEE 802. Weak passphrases are vulnerable to password cracking attacks. and Approved Scanning Vendor subject matter experts. • For new wireless implementations. TKIP employs an encryption cipher that issues encryption keys for each data packet communicated in each session of each user. it does not scale well in the enterprise. Special interest groups are made up of Participating Organization. 2010.
PCI DSS Requirement 4. use industry best practices (for example. which uses an Extensible Authentication Protocol (EAP) type. it is prohibited to use WEP after June 30.11i) are used to implement strong encryption for authentication and transmission.2 requires discontinuing WEP as of June 30.1.
Table 6: PCI DSS § 4.
Mode Enterprise Personal WPA Authentication: IEEE 802. a truly random passphrase of 13 or more characters (selected from the set of 95 permitted characters) is probably sufficient.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
data will remain protected and that only authorized users can access their wireless networks.11i standard. It leverages the IEEE 802.11 standard ratified in June 2004. • For current wireless implementations. This mode uses applied authentication in which a pass-phrase (the PSK) is manually entered on the access point to generate the encryption key. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. WPA2 uses the Advanced Encryption Standard (AES) for data encryption and is eligible for FIPS (Federal Information Processing Standards) 140-2 compliance. it is prohibited to implement WEP after March 31. Both provide an authentication and encryption solution. PCI DSS v1. TKIP encryption is used. with an authentication server to provide strong mutual authentication between the client and authentication server.1
There are two modes in WPA and WPA2 . IEEE 802.1X.1X authentication framework.11i amendment to the 802.1 Ensure wireless networks transmitting cardholder data or connected to the cardholder data environment.1X/EAP Encryption: AES-CCMP Authentication: PSK Encryption: AES-CCMP
Table 7: The two modes in WPA
Personal mode is designed for home and Small Office Home Office (SOHO) users who do not have authentication servers available. The PSK is typically shared among users. WPA2 is based on the final IEEE 802. Testing Procedure 4.Enterprise and Personal. This affords a high level of individual privacy.11i standard. 2010 and moving to robust encryption and authentication such as the IEEE 802. 2009.11i) to implement strong encryption for authentication and transmission.
NDS. Pocket PC2000. B.
4. Qualified Security Assessor. This was to ensure that WPAEnterprise certified products can interoperate with one another. For WPA2. 2000. Pre-Shared Keys should be changed on a regular basis. AES is stronger than TKIP. WinCE.1X authentication and AES encryption is recommended for WLAN networks. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. only EAP-TLS (Transport Layer Security) was certified by the Wi-Fi alliance. and Approved Scanning Vendor subject matter experts. NT Domains. While the attack does not lead to a compromise of the PSK. the attack revealed that it is possible to reuse the compromised encryption keystream to inject 7-15 arbitrary packets into the network using QoS mechanisms without triggering the replay protection countermeasures available in TKIP. AES encryption is used. WPA or WPA2 Enterprise mode with 802. LDAP. ME.112 [19] defines similar data confidentiality. Security encapsulation is the independent protection of specific data elements within another security protocol. The following table illustrates the popular EAP types certified by Wi-Fi along with a comparison of features. Special interest groups are made up of Participating Organization. NT Domains.1 Summary of recommendations:
A. The Wi-Fi Alliance has announced the inclusion of additional EAP types to its certification programs for WPA and WPA2 Enterprise certification programs. it is recommended that organizations use AES encryption.
WPA Enterprise Mode User Authentication Database and Server Native Operating System Support User Authentication Method Authentication Transaction Overhead Management Deployment Complexity Single Sign On
The intent of this document is to provide supplemental information. Recent attacks against the TKIP encryption algorithm have revealed some flaws in the protocol that can allow an attacker to decrypt small frames encrypted using TKIP such as Address Resolution Protocol (ARP) frames in about 15 minutes. NDS. LDAP. C. which is immune to the attack. such as separate PIN encryption at the point of entry within the WPA protocol. Further. Active Director Windows XP. 98. thus providing additional network protection. 2000
LDAP. Active Directory Windows XP. entity authentication and data integrity requirements with an additional requirement for security encapsulation. 2000
OTP. Mobile 2003 Password or OTP4 Moderate Moderate Digital Certificate For Server Yes
Password or OTP Moderate Moderate Digital Certificate For Server Yes
Digital Certificate Substantial Substantial Digital Certificate Per Client and For Server Yes
Table 8: WPA Enterprise mode security
ANS X9.4. It is recommended that WPA2 Personal mode be used with a minimum 13-character random passphrase and AES encryption. Active Directory Windows XP. NT Domains. Previously.
.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
extremely difficult to break.
when using wireless as a transport medium in a CDE. Examples of open. • Global System for Mobile communications (GSM). Section 4.1. 2010. • Verify that only trusted SSL/TLS keys/certificates are accepted. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. and Approved Scanning Vendor subject matter experts.4 described Layer 2 specific wireless encryption protocols such as AES that is used within WPA2 to provide confidentiality and integrity at the wireless link layer. it is a security best practice to treat the wireless network as part of a DMZ or a public network.1.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
D. public networks that are in scope of the PCI DSS are: • The Internet. public networks. • Wireless technologies. Verify that HTTPS appears as a part of the browser Universal Record Locator (URL). This means all CDE data must be encrypted as suggested in PCI DSS Requirement 4. and • General Packet Testing Procedure 4.
PCI DSS Requirement 4.1 Use strong cryptography and security protocols such as SSL/TLS or IPSEC to safeguard sensitive cardholder data during transmission over open.1
The intent of this document is to provide supplemental information. The use of WEP in the CDE is prohibited for all deployments after June 30.
.5 Use of strong cryptography on transmission of cardholder data over wireless
In addition to encrypting and authenticating wireless LANs using WPA2. Qualified Security Assessor.
Table 9: PCI DSS § 4. E. Verify that no cardholder data is required when HTTPS does not appear in the URL. • Select a sample of transactions as they are received and observe transactions as they occur to verify that cardholder data is encrypted during transit. public networks • Verify that strong encryption is used during data transmission • For SSL implementations: Verify that the server supports the latest patched versions.a Verify the use of encryption (for example. • Verify that the proper encryption strength is implemented for the encryption methodology in use. SSL/TLS or IPSEC) wherever cardholder data is transmitted or received over open.
4. Higher layer encryption methods such as SSL/TLS and IPSEC and could be used to provide endto-end cryptographic protection of card-holder data. Centralized management systems that can control and configure distributed wireless networks are recommended. Special interest groups are made up of Participating Organization.
The “Guest Traffic” could be open or SSL as in the “Hot Spot” example. will provide an open wireless service which.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
Figure 7 illustrates an example where wireless technology and “on line” credit card purchases intersect at a “wireless hot spot”. In this example. with only those exceptions that must be in place for the transaction to occur.
Figure 7: Wireless “Hotspot” example with SSLv3 HTTPS portal
A. and Approved Scanning Vendor subject matter experts. The Internet port of the firewall must also be configured for NAT as well as “Deny All”. when connected to. Qualified Security Assessor. The dashed line signifies that the information flowing out through the Internet must be encrypted. etc. An example of a multi-service wireless network with both public and PoS services is shown in Figure 8.
The intent of this document is to provide supplemental information. This process is analogous to purchasing merchandise on the Internet. Locations such as airports. with only those exceptions that must be in place for the transaction to occur. The hot spot guest connects through the access point over a private WLAN connected to the firewall’s external LAN port using SSLv3/TLS. B. Special interest groups are made up of Participating Organization. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. D. The gateway or web server that processes the transaction must do so using a secure connection using strong cryptography such as SSL or IPSEC. present users with a HTTPS/SSL web page that allows them to purchase access to the internet. cafés. A recommended encryption for the Secure Application traffic would be IPSEC or WPA2-AES.
. C. The firewall’s LAN port must be configured for NAT as well as “Deny All”.. the wireless network is treated as an “untrusted” network and is segmented using a firewall.
. which is based on NIST SP 800-57 [21]. Secure application traffic tunnels are created through the IDF switches to an internal firewall. The dashed line signifies that the information flowing out through this segment must be encrypted.g. Guest traffic is separated from the secure application traffic tunnels through VLANs.g. DES) with cryptographic strengths (e. 512-bit RSA and 512-bit DH) that are inappropriate for today’s networks.
.. the encryption cipher. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. 56-bit DES) that
The intent of this document is to provide supplemental information. IPSEC supports several Security Associations which define the cryptographic algorithms for the IP Authentication Header (AH) and the IP Encapsulating Security Payload (ESP).g. Secure wireless devices connect to the private WLAN through the APs.g. Refer to Table 9 for relative cryptographic strengths.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
Figure 8: Secure Application Traffic using WPA2-AES/802. the hash function and their parameters. Special interest groups are made up of Participating Organization. SSLv2 supported older encryption ciphers (e.. and Approved Scanning Vendor subject matter experts. SSLv3 is recommended as it supports a range of Cipher Suites which define the key establishment algorithm. B. Historically.1X between client device and AP or Access Device
A. Guest traffic attaches through private WLAN APs. RC2 and DES) and cryptographic key lengths (e. D. The firewall’s connection rules also guarantee that traffic flowing between the secure application and the secure wireless device traverse no other path than this one. C. The firewall is the termination point for encrypted traffic.. Qualified Security Assessor. E. The dashed line signifies that the information flowing out through this segment must be encrypted. Historically IPSEC supports older algorithms (e.
how it is to be secured and deployed and how the organization will address incidents as they occur. e-mail usage and Internet usage) to define proper use of these technologies for all employees and contractors. which is based on NIST SP 800-57 [21]. Special interest groups are made up of Participating Organization. SSLv3 is mandatory for traffic that carries cardholder data. If an employee receives a wireless inventory device. laptops.3
The intent of this document is to provide supplemental information. When possible.5. he or she needs to understand how to properly protect. removable electronic media. Another important aspect the policy should address is how employees can and should use their authorized wireless devices. wireless technologies. personal data/digital assistants (PDAs). 256-bit encryption is preferred.3 Develop usage policies for critical employeefacing technologies (for example. Qualified Security Assessor.
Cryptographic Strength 56-bits 80-bits 112-bits 128-bits 192-bits 256-bits Symmetric Algorithm DES 3DES-2K 3DES-3K AES-128 AES-192 AES-256 Hash Algorithm SHA-1 (160) SHA-2 (224) SHA-2 (256) SHA-2 (384) SHA-2 (512) ECC Algorithms 160-bits 224-bits 256-bits 384-bits 512-bits RSA/DSA/DH Algorithms 1024-bits 2048-bits 3072-bits 7680-bits 15360-bits
Table 10: Relative Cryptographic Strengths
4. if employees receive laptops. remote-access technologies. For example.
4. Refer to Table 10 for relative cryptographic strengths. and store that device.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
are inappropriate for today’s networks. The importance here is that organizations understand how wireless is to be used within their environment.
Table 11: PCI DSS § 12. access. Testing Procedure 12. they need to understand the acceptable usage and responsibilities of wireless networking.
. which include those for wireless devices.
PCI DSS Requirement 12. and Approved Scanning Vendor subject matter experts.3 Obtain and examine the policy for critical employee-facing technologies.6 Development and enforcement of wireless usage policies
The PCI DSS mandates the need for acceptable usage policies and procedures.1 Summary of recommendations:
A. B. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard.
In Enterprise mode. Verify that the usage policies prohibit copying. substituting it with a non-sanctioned AP is not acceptable. card holder data should not be stored locally on the device. if a wireless POS is being used. if a wireless AP needs to be replaced. then the same networks should not be used for guest access. Verify that the usage policies require explicit management approval to use wireless networks in the CDE. Any unsanctioned wireless must be removed from CDE. Verify that the usage policies require automatic disconnect of sessions for wireless access after a specific period of inactivity. Verify that the usage policies require labeling of wireless devices with owner. WPA Enterprise supports this requirement. B. F. Verify that the usage policies require a list of company-approved products. contact information and purpose. Verify that the usage policies require that wireless access is authenticated with user ID and password or other authentication item (for example. H. and Approved Scanning Vendor subject matter experts. Verify that the usage policies require activation of wireless-access technologies used by vendors only when needed by vendors. Special interest groups are made up of Participating Organization. with immediate deactivation after use. C. moving. a wireless POS terminal should automatically log out and disconnect from the CDE if left unattended. I. then they must be rotated whenever employees that have access to wireless devices leave the organization.6. D. if wireless devices are being used to transmit card holder data. For example. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. For example. For example. G.
4. Qualified Security Assessor.1 Summary of recommendations:
A. E. Verify that the usage policies require acceptable uses for the wireless technology.
The intent of this document is to provide supplemental information. or storing of cardholder data onto local hard drives and removable electronic media when accessing such data via wirelessaccess technologies. For example. it should only be encrypted and transmitted. If PSKs are used. token). individual user access can be enabled/disabled centrally. Verify that the usage policies require a list of all wireless devices and personnel authorized to use the devices.
Wireless Network Security: 802.pdf http://www.2 PCI Security Scanning Procedures Location https://www.ars http://www.112 Wireless Management and Security for the Financial Services Industry
http://www.mastercard.biz/docs/risk/MC_best_practices _online.wifi.pdf http://iase.pdf http://csrc.attackprevention.net/projects/WPA-tables/ http://csrc.com/articles/paedia/wpacracked. and Approved Scanning Vendor subject matter experts. Special interest groups are made up of Participating Organization. Bluetooth and Handheld Devices Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications.gov/publications/nistpubs/80048/NIST_SP_800-48.x9.com/ap/library/wirelessse cRJ.2 MasterCard International Electronic Commerce Security Architecture Best Practices The Center for Internet Security Wireless Networking Benchmark NIST SP 800-48.11b wireless environment” “Ultimate wireless security guide: An introduction to LEAP authentication” “Battered. 802.nist.talisma.0.
.org/OpenSection/pdf/WiFi_Protected_ Access_Overview.pdf http://csrc.11.renderlab.org/files/wp_9_WPAWPA2%20Implementation_2-27-05.nist. Nov.pdf http://standards.pdf http://www.11S WPA Overview.gov/publications/nistpubs/80041/sp800-41.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
5 Authority Documents and External References
The following table shows the documents upon which this document draws its source of authority.org
The intent of this document is to provide supplemental information.pdf
MasterCard International Wireless LANs – Security Risks and Guidelines Wireless Security Checklist Version 5. Release 2.aspx?c= 58&cpc=MSdA03B2IfY15uvLEKtr40R5a5pV2lnCUb4i 1Qj2q2g&cid=81&cat=&catURL=&r=0.org/tools2/wireless/CIS_Wireless _Benchmark_v1.html http://arstechnica.cisecurity.org/ http://selfservice. but not broken: understanding the WPA crack.wi-fi. Document PCI DSS v1.com/5100-10878_116148551.pdf http://www.mil/stigs/checklist/wirelesschecklist_v5r2-2_final_20080326.pcisecuritystandards.com/display/2/index.gov/publications/nistpubs/80094/SP800-94.techrepublic. ANSI/IEEE Std.ieee.686736822128 296 http://www.nist. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard.htm http://articles.com/us/sdp/assets/pdf/wl_entir e_manual.11 -2007.” Glenn Fleishman.disa.com.pdf http://www.powerpay. 2008 Deploying Wi-Fi Protected Access (WPA™) and WPA2™ in the Enterprise Church of Wifi WPA-PSK Rainbow Tables Guidelines on Firewalls and Firewall Policy Guide to Intrusion Detection and Prevention Systems (IDPS) ANS X9.pdf http://www. WiFi Alliance ”Security risks and ways to decrease vulnerabilities in a 802. Qualified Security Assessor.org/getieee802/download/802.
nist.html
The intent of this document is to provide supplemental information. Special interest groups are made up of Participating Organization. and Approved Scanning Vendor subject matter experts. Devin K. ISBN: 978-07645-9730-5 NIST Special Publication 800-57 Recommendation for Key Management – Part 1: General
Location http://www.id-3262. Akin.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
Document Understanding WEP Weaknesses: Hacking Wireless Networks for Dummies. Qualified Security Assessor.dummies.subcatNETWORKING. Davis.
. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard.com/WileyCDA/DummiesArticle/ Understanding-WEP-Weaknesses.gov/publications/PubsSPs.html
http://csrc. by Kevin Beaver. Peter T.
Qualified Security Assessor.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
6 Glossary of Acronyms
Acronym AES ANSI AP ARP ASCII CCMP CDE DSS EAP GPRS GSM HTTP HTTPS IDF IDS IEEE IPS IPSEC LAN LDAP MAC Definition Advanced Encryption Standard American National Standards Institute Access Point Address Resolution Protocol American Standard Code for Information Interchange Counter Mode CBC MAC Protocol Cardholder Data Environment Data Security Standard Extensible Authentication Protocol General packet radio service Global System for Mobile Hypertext Transport Protocol Hypertext Transport Protocol Secure Intermediary Distribution Frame Intrusion Detection System Institute of Electrical and Electronics Engineers Intrusion Prevention System Internet Protocol Security Local Area Network Lightweight Directory Access Protocol Medium Access Control Acronym MIC NDS OTP PCI PDA PoS PSK QoS SIG SNMP SOHO SSID SSL TKIP TLS URL VLAN WEP Wi-Fi WLAN WPA Definition Message Integrity Code Netware Directory Services One Time Password Payment Card Industry Personal Data (Digital) Assistant Point of Sale Pre-Shared Key Quality of Service Special Interest Group Simple Network Management Protocol Small Office Home Office Service Set Identifier Secure Socket Layer Temporal Key Integrity Protocol Transport Layer Security Universal Record Locator Virtual Local Area Network Wired Equivalent Privacy Wireless Fidelity Wireless Local Area Network Wi-Fi Protected ACCESS
The intent of this document is to provide supplemental information. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard.
. and Approved Scanning Vendor subject matter experts. Special interest groups are made up of Participating Organization.
and attempt to log on (with system administrator help) to the devices using default vendor-supplied accounts and passwords.
Doc Section
§3. including any wireless networks
1.2.1.2 Current network diagram with all connections to cardholder data. The third column in the table references the section within this guide that addresses the corresponding requirement.1. and that these firewalls deny or control (if such traffic is necessary for business purposes) any traffic from the wireless environment into the cardholder data environment. (Use vendor manuals and sources on the Internet to find vendor supplied accounts/passwords. Qualified Security Assessor.1 Verify the following regarding vendor default settings for wireless environments and ensure that all wireless networks implement strong encryption mechanisms (for example.3 Verify that there are perimeter firewalls installed between any wireless networks and systems that store cardholder data.
. including any wireless networks. and configure these firewalls to deny or control (if such traffic is necessary for business purposes) any traffic from the wireless environment into the cardholder data environment.a Verify that a current network diagram (for example. and wireless access points.1 Always change vendorsupplied defaults before installing a system on the network—for example.3 Install perimeter firewalls between any wireless networks and the cardholder data environment. and Approved Scanning Vendor subject matter experts.3
The intent of this document is to provide supplemental information.2 Cross Reference
The following table provides a cross reference between PCI DSS v1. and SNMP community strings. WPA/WPA2) Other security-related wireless vendor defaults. change wireless vendor defaults.2 and the contents of this guideline. if applicable
§4.1. one that shows cardholder data flows over the network) exists and that it documents all connections to cardholder data. The PCI DSS requirements below overtly refer to wireless (underlined in blue).2.1
1. Ensure wireless device security settings are enabled for strong encryption technology for authentication and transmission. and elimination of unnecessary accounts.)
2. 2. passwords.
1. Special interest groups are made up of Participating Organization. including but not limited to default wireless encryption keys.
1. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. 2. and are changed anytime anyone with knowledge of the keys leaves the company or changes positions Default SNMP community strings on wireless devices were changed Default passwords/passphrases on access points were changed Firmware on wireless devices is updated to support strong encryption for authentication and transmission over wireless networks (for example. 1.b Verify that the diagram is kept current. include passwords. simple network management protocol (SNMP) community strings. critical servers.1 Choose a sample of system components.2.1.1 For wireless environments connected to the cardholder data environment or transmitting cardholder data.
2. to verify that default accounts and passwords have been changed. AES): Encryption keys were changed from default at installation.1.2.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
7 PCI DSS v1.
Qualified Security Assessor.11i) are used to implement strong encryption for authentication and transmission. and Approved Scanning Vendor subject matter experts. Select a sample of transactions as they are received and observe transactions as they occur to verify that cardholder data is encrypted during transit.1.
4. and General packet radio service (GPRS). 2010..4 Write logs for externalfacing technologies onto a log server on the internal LAN.
The intent of this document is to provide supplemental information. Examples of open.) 4. .1.a Verify the use of encryption (for example.Verify that the server supports the latest patched versions. wireless. public networks.3 Verify that physical access to wireless access points. 2009. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard.1 For wireless networks transmitting cardholder data or connected to the cardholder data environment. (Check vendor recommendations/best practices.4
10.5. For new wireless implementations.2
4. Verify that only trusted SSL/TLS keys/certificates are accepted.1. Special interest groups are made up of Participating Organization.Verify that HTTPS appears as a part of the browser Universal Record Locator (URL). Wireless technologies.g.
§4.Verify that no cardholder data is required when HTTPS does not appear in the URL. SSL/TLS or IPSEC) wherever cardholder data is transmitted or received over open.1
9. gateways and handheld devices is appropriately restricted.
. 9.5. public networks that are in scope of the PCI DSS are: The Internet.
§4.1 Use strong cryptography and security protocols such as SSL/TLS or IPSEC to safeguard sensitive cardholder data during transmission over open. IEEE 802. it is prohibited to use WEP after June 30.1 Ensure wireless networks transmitting cardholder data or connected to the cardholder data environment. mail) are offloaded or copied onto a secure centralized internal log server or media. For current wireless implementations. public networks Verify that strong encryption is used during data transmission For SSL implementations: . DNS. it is prohibited to implement WEP after March 31. Global system for mobile communications (GSM). . 10.3 Restrict physical access to wireless access points. use industry best practices (for example. firewalls. gateways and handheld devices. Verify that the proper encryption strength is implemented for the encryption methodology in use.1.1.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
§4. verify that industry best practices (e.4 Verify that logs for external-facing technologies (for example. IEEE 802.11i) to implement strong encryption for authentication and transmission.
10 Protect cardholder data 12. 11.2 §3.3 Verify.1 Explicit management approval 12. remote-access technologies.
The intent of this document is to provide supplemental information.9) includes a response in the event unauthorized wireless devices are detected.2
12.9.9. Qualified Security Assessor. and file-integrity monitoring systems.
§4. through observation and review of processes.2 Authentication method 12.9 Remote access for vendors 12.1.8 Session management (inactivity limits) 12. 12. or that a wireless IDS/IPS is implemented and configured to identify all wireless devices. through observation and review of policies.
.9.a Verify that a wireless analyzer is used at least quarterly. wireless technologies. Special interest groups are made up of Participating Organization.5 Include alerts from intrusion detection. and/or reports of unauthorized critical system or content file changes.5 Verify. personal data/digital assistants (PDAs). Ensure these usage policies require the following: 12.7 Approved products 12.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
11. detection of unauthorized wireless access points.1. verify the configuration will generate alerts to personnel.
§3.9.1.3 Obtain and examine the policy for critical employeefacing technologies and perform the following: 12. critical IDS alerts.4 Device labeling 12. e-mail usage and Internet usage) to define proper use of these technologies for all employees and contractors. removable electronic media. that there is 24/7 incident response and monitoring coverage for any evidence of unauthorized activity.c Verify the organization’s Incident Response Plan (Requirement 12.
11. that monitoring and responding to alerts from security systems including detection of unauthorized wireless access points are covered in the Incident Response Plan. intrusionprevention.2
§3.b If a wireless IDS/IPS is implemented. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. and Approved Scanning Vendor subject matter experts. 11.3 Designate specific personnel to be available on a 24/7 basis to respond to alerts. laptops.6 Acceptable network locations 12.3 Develop usage policies for critical employee-facing technologies (for example.6
12.1 Test for the presence of wireless access points by using a wireless analyzer at least quarterly or deploying a wireless IDS/IPS to identify all wireless devices in use.3 Inventory of devices and authorized users 12.5 Acceptable use policy (AUP) 12.
Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard. and Board of Advisors representative: Doug Manchester. Information Assurance Consortium Jeremy Bennett. Tesco Pabo Lopez-Tello. Cisco Tim Cormier. Group lead. Hewlett-Packard Maurice Lee. ARC Dorian Cougias. Special interest groups are made up of Participating Organization. Aruba Networks Kris Strittmater. VeriFone Special Interest Group Members: Amit Sinha. Latham & Watkins LLP Marek Kosinski. Ingenico Vikram Phatak. Chico’s Gary Zempich. Shell Matt FitzGerald. Qualified Security Assessor. Spacenet Steve Bernard. Citigroup Marcelo Halpern. and Approved Scanning Vendor subject matter experts. Scott Hutchinson.
. TimeInc. CollegeBoard Rich Shetina. CollegeBoard Terri Quinn. Apriva Larry Hitchew. Capita Deborah Offink. Deutsch Card Services Dave Whitelegg. Hypercom Jeff Stapleton. Motorola Daniela Christoffel. Unified Compliance Framework Ed Martin.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
The PCI Security Standards Council recognizes the following individuals for their contributions to the Wireless Special Interest Group and thanks them for producing this valuable resource. NSS Labs Ryan Townsend. Sprint Deven Bhatt. McDonald’s Rick Moy. NSS Labs
The intent of this document is to provide supplemental information. Air Defense Chris Hinsz. PayPal Paul Lazarr.
31.3. BS 15000-2 § 5. Generally Accepted Principles and Practices for Securing Information Technology Systems. NIST SP 800-53 CM-8. Code of Practice for Information Security Management § 5.
.1. Qualified Security Assessor. and Approved Scanning Vendor subject matter experts. CB4.1. NW1. CM-2.3.2.3. BS 15000-2 § 5.3.1. IT Service Management Standard . Gramm-LeachBliley Act (GLB) 16 CFR § 314. Exam Tier II Obj A. ISO 17799:2000. FFIEC IT Examination Handbook – EBanking Pg 28. Recommended Security Controls for Federal Information Systems. Pg G-7.1.5. CB4.1a Gramm-Leach-Bliley Act (GLB) 16 CFR § 314.33.1a
Check local laws as applicable. NIST SP 800-53 CM-8. NIST 800-53A § CM-2.7. Guide for Assessing the Security Controls in Federal Information Systems. ISO 17799:2000.
The intent of this document is to provide supplemental information.Code of Practice. CI1. NW5.2.10.4. Guide for Assessing the Security Controls in Federal Information Systems. NW2.1. Information provided here does not replace or supersede wireless requirements in the PCI Data Security Standard.3. CI2.10.5. NIST SP 800-14 § 3. NIST 800-53A § CM-2.8.8. Exam Obj 11. The Standard of Good Practice for Information Security SM4. SM6.3.1. SM4.6. Generally Accepted Principles and Practices for Securing Information Technology Systems.4(b)(2). FFIEC IT Examination Handbook – Operations Pg 9.2. NW1. Recommended Security Controls for Federal Information Systems.3.6.6.5. FFIEC IT Examination Handbook – Business Continuity Planning Pg E-3. 3.4.3. Code of Practice for Information Security Management § 5.3. CI2. CI1.1.2.Code of Practice.3.3. CM-2.1. CI1.5.Wireless SIG Implementation Team • DSS Wireless Guidance July 2009
Australian Government ICT Security Manual (ACSI 33) § 3. Exam Tier II Obj A. NIST SP 800-14 § 3.2. Pg 8.1.1.1. Special interest groups are made up of Participating Organization. The Standard of Good Practice for Information Security CB4.2. IT Service Management Standard .1.3.4. FFIEC IT Examination Handbook – Operations Pg 7.4(b)(2).2(b). FFIEC IT Examination Handbook – Business Continuity Planning Pg G-7.1. FFIEC IT Examination Handbook – Development and Acquisition Pg 32.
Class a SubnettingSDM Lab 2 - NATSDM Lab 1OSPF on 3 RoutersThe Meaning of GlutenNetwork+09 Tearcard31323908 BMC ADDM ExplainedStyle and Layout Guides for UMLHandbook for Computer Security Incident Response Teams (CSIRTs)
PCI DSS Wireless Guidelines by epocableoils10 viewsEmbedDownloadRead on Scribd mobile: iPhone, iPad and Android.Copyright: Attribution Non-Commercial (BY-NC)List price: $0.00Download as PDF, TXT or read online from ScribdFlag for inappropriate contentMore informationShow less
RelatedPCI: How to Audit Application Activity When Logs Don’t Helpby Amy MarionPCI DSS Wireless Guidelinesby sokhaneDOS Introductionby 20ajayFLOWS_D17by Faisal SaleemSite Plannerby chayhofmesCase Study British Telecomby Advantec SrlUG_TEW-443PI(A1.1R)by anitalukCertified Wireless Network Administrator Course Outlineby johnbdbdunit 1 mcby Kuna NareshThings You Should Know About Enterprise WLANby 779482688netsh wlan start hostednetworkby M Nanda KumarWireless Communicationby rinlacerAbstractby anon_163071217Readmeby aaaHuawei WLAN Authentication and Encby Phuc HoangLKS000005_0by JEdu DonosoUniFi Controller V4 UGby Gabriel VillarrealWireless Discussionby Bob Bacher04. Mobile Wireless Computingby anon_99391795Wp Large-Scale Campus-wide Wifiby Femi AdeyemoNot a CD 06by Cikgu YumiEmerging Trends of Ubiquitous Computingby Editor IJACSAGi-fi 3by sushantNWby mansha99@gmail.comCWNPG_V1_7_August_15_2006.docby revvdgi-fi.docxby Gary Koch[Conciseness]Avoiding Sentence Openers "It is" and "There is" (3)by 柯泰德 (Ted Knoy)13L0828by kkhalilzad5536Similar to PCI DSS Wireless GuidelinesPCIPCI DSS Wireless GuidelinesDOS IntroductionFLOWS_D17Site PlannerCase Study British TelecomUG_TEW-443PI(A1.1R)Certified Wireless Network Administrator Course Outlineunit 1 mcThings You Should Know About Enterprise WLANnetsh wlan start hostednetworkWireless CommunicationAbstractReadmeHuawei WLAN Authentication and EncLKS000005_0UniFi Controller V4 UGWireless Discussion04. Mobile Wireless ComputingWp Large-Scale Campus-wide WifiNot a CD 06Emerging Trends of Ubiquitous ComputingGi-fi 3NWCWNPG_V1_7_August_15_2006.docgi-fi.docx[Conciseness]Avoiding Sentence Openers "It is" and "There is" (3)13L0828ReadmeR6_Primer