2.3 Is non-console administrative access encrypted as follows: Use technologies such as SSH, VPN, or TLS for web-based management and other non-console administrative access. Note: SSL and TLS are not considered strong cryptography and cannot be used as a security control after 30th June, 2016. Prior to this date, existing implementations that use SSL and/or early TLS must have a formal Risk Mitigation and Migration Plan in place. Effective immediately, new implementations must not use SSL or early TLS. POS POI terminals (and the SSL/TLS termination points to which they connect) that can be verified as not being susceptible to any known exploits for SSL and early TLS may continue using these as a security control after 30th June, 2016. Is all non-console administrative access Examine system components encrypted with strong cryptography, and is a Examine system configurations strong encryption method invoked before the Observe an administrator log on administrator’s password is requested? [Fill out per your OST-approved 3rd vendor.] Are system services and parameter files Examine system components configured to prevent the use of Telnet and Examine services and files other insecure remote login commands? [Fill out per your OST-approved 3rd party vendor.] Is administrator access to web-based Examine system components management interfaces encrypted with strong Observe an administrator log on cryptography? [Fill out per your OST-approved 3rd party vendor.]
2.3 Is non-console administrative access encrypted as follows: Use technologies such as SSH, VPN, or TLS for web-based management and other non-console administrative access. Note: SSL and TLS are not considered strong cryptography and cannot be used as a security control after 30th June, 2016. Prior to this date, existing implementations that use SSL and/or early TLS must have a formal Risk Mitigation and Migration Plan in place. Effective immediately, new implementations must not use SSL or early TLS. POS POI terminals (and the SSL/TLS termination points to which they connect) that can be verified as not being susceptible to any known exploits for SSL and early TLS may continue using these as a security control after 30th June, 2016. Is all non-console administrative access encrypted with strong cryptography, and is a strong encryption method invoked before the administrator’s password is requested? Examine system components Examine system configurations Observe an administrator log on [Fill out per your OST-approved 3rd vendor.] Are system services and parameter files configured to prevent the use of Telnet and other insecure remote login commands? Examine system components Examine services and files [Fill out per your OST-approved 3rd party vendor.] Is administrator access to web-based management interfaces encrypted with strong cryptography? Examine system components Observe an administrator log on [Fill out per your OST-approved 3rd party vendor.]
saq_c_v3_1_instr.docx