Review configuration standards 2.2.3 Are additional security features documented and implemented for any required services, protocols or Examine configuration settings daemons that are considered to be insecure? For example, use secured technologies such as SSH, If SSL/early TLS is used: FTP, TLS, or IPSec VPN to protect insecure services such Review documentation that verifies as NetBIOS, file-sharing, Telnet, etc. POS POI devices are not Note: SSL and early TLS are not considered strong susceptible to any known exploits cryptography and cannot be used as a security control after for SSL/early TLS 30th June, 2016. Prior to this date, existing implementations and/or that use SSL and/or early TLS must have a formal Risk Review Risk Mitigation and Mitigation and Migration Plan in place. Migration Plan Effective immediately, new implementations must not use SSL or early TLS. POS POI terminals (and the SSL/TLS termination points to they connect) that can be verified as not being susceptible to any known exploits for SSL and early TLS may continue using these as a security control after 30th June, 2016. Are system administrators and/or personnel that 2.2.4 Interview personnel configure system components knowledgeable about common security parameter settings for those system components? Are common system security parameters settings Review system configuration included in the system configuration standards? standards Are security parameter settings set appropriately on Examine system components system components? Examine security parameter settings Compare settings to system configuration standards Has all unnecessary functionality—such as scripts, 2.2.5 Examine security parameters on drivers, features, subsystems, file systems, and system components unnecessary web servers—been removed?
2.2.3 Are additional security features documented and implemented for any required services, protocols or daemons that are considered to be insecure? For example, use secured technologies such as SSH, TLS, or IPSec VPN to protect insecure services such as NetBIOS, file-sharing, Telnet, FTP, etc. Note: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after 30th June, 2016. Prior to this date, existing implementations that use SSL and/or early TLS must have a formal Risk Mitigation and Migration Plan in place. Effective immediately, new implementations must not use SSL or early TLS. POS POI terminals (and the SSL/TLS termination points to they connect) that can be verified as not being susceptible to any known exploits for SSL and early TLS may continue using these as a security control after 30th June, 2016. Review configuration standards Examine configuration settings If SSL/early TLS is used: Review documentation that verifies POS POI devices are not susceptible to any known exploits for SSL/early TLS and/or Review Risk Mitigation and Migration Plan 2.2.4 Are system administrators and/or personnel that configure system components knowledgeable about common security parameter settings for those system components? Interview personnel Are common system security parameters settings included in the system configuration standards? Review system configuration standards Are security parameter settings set appropriately on system components? Examine system components Examine security parameter settings Compare settings to system configuration standards 2.2.5 Has all unnecessary functionality—such as scripts, drivers, features, subsystems, file systems, and unnecessary web servers—been removed? Examine security parameters on system components
SAQ_C-VT_v3-1.docx