2.3 Is non-console administrative access encrypted as follows: Use technologies such as SSH, VPN, or TLS for management and other non-console administrative access. Note: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after 30th June, 2016. Prior to this date, existing implementations that use SSL and/or early TLS must have a formal Risk Mitigation and Migration Plan in place. Effective immediately, new implementations must not use SSL or early TLS. POS POI terminals (and the SSL/TLS termination points to they connect) that can be verified as not being susceptible to any known exploits for SSL and early TLS may continue using these as a security control after 30th June, 2016. Is all non-console administrative access encrypted Examine system components with strong cryptography, and is a strong encryption Examine system configurations method invoked before the administrator’s password Observe an administrator log on is requested? Are system services and parameter files configured Examine system components to prevent the use of Telnet and other insecure Examine services and files remote login commands? Is administrator access to web-based management Examine system components interfaces encrypted with strong cryptography? Observe an administrator log on For the technology in use, is strong cryptography Examine system components implemented according to industry best practice Review vendor documentation and/or vendor recommendations? Interview personnel
2.3 Is non-console administrative access encrypted as follows: Use technologies such as SSH, VPN, or TLS for management and other non-console administrative access. Note: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after 30th June, 2016. Prior to this date, existing implementations that use SSL and/or early TLS must have a formal Risk Mitigation and Migration Plan in place. Effective immediately, new implementations must not use SSL or early TLS. POS POI terminals (and the SSL/TLS termination points to they connect) that can be verified as not being susceptible to any known exploits for SSL and early TLS may continue using these as a security control after 30th June, 2016. Is all non-console administrative access encrypted with strong cryptography, and is a strong encryption method invoked before the administrator’s password is requested? Examine system components Examine system configurations Observe an administrator log on Are system services and parameter files configured to prevent the use of Telnet and other insecure remote login commands? Examine system components Examine services and files Is administrator access to web-based management interfaces encrypted with strong cryptography? Examine system components Observe an administrator log on For the technology in use, is strong cryptography implemented according to industry best practice and/or vendor recommendations? Examine system components Review vendor documentation Interview personnel
SAQ_B-IP_v3-1.docx