Ensuring PCI DSS Compliance with the Mist Learning WLAN THE SAFE CHOICE FOR MISSION CRITICAL WIRELESS NETWORKS IN PCI ENVIRONMENTS

Transcription

1 Ensuring PCI DSS Complince with the Mist Lerning WLAN THE SAFE CHOICE FOR MISSION CRITICAL WIRELESS NETWORKS IN PCI ENVIRONMENTS

2 Tble of Contents Ensuring PCI DSS Complince with the Mist Lerning WLAN... 1 Cloud Security... 1 Network Segmenttion... 1 Protect Network From Externl Attcks... 2 Securing Wireless in the Crdholder Dt Environment (CDE)... 3 Summry... 4

3 Ensuring PCI DSS Complince with the Mist Lerning WLAN Ensuring PCI DSS Complince with the Mist Lerning WLAN The Pyment Crd Industry Dt Security Stndrd (PCI DSS) ws creted s common stndrd to protect ginst credit crd nd pyment dt frud in the retil spce (nd other industries, like bnking, where online pyments re mde). By providing consistent nd holistic security policies nd best prctices, PCI DSS enbles security personnel nd network dministrtors to effectively thwrt vrious threts to pyment dt. The ltest version of PCI DSS which is 3.2, went into effect for ssessments in October, As one cn imgine, the network is criticl cornerstone of PCI DSS complince s it is min rtery for pssing pyment dt. PCI DSS requirements re designed to ensure tht network security opertions nd prctices eliminte or minimize known risks. Plus, they ensure tht the orgniztion defines trceble well-structured policies, procedures, nd prctices tht cn be udited. The wireless network in prticulr is especilly importnt to retil environments s business opertions nd digitl enggement technologies rely upon mobile connectivity. Point of Sle devices, scnners, brcode reders, printers, nd mobile computers, for exmple, ll operte on Wireless LANs (WLAN) tht serve s the lifeblood of retil opertions. Given the importnce of WLANs, there re two types of requirements specificlly outlined for the PCI DSS complince of wireless networks. These include: Generlly pplicble wireless requirements. These re requirements tht pply even when the wireless network is not in scope of the Crdholder Dt Environment (CDE). They include strong network segmenttion to protect the CDE network nd security ginst ttcks from rogue or unknown wireless Access Points nd clients. Securing wireless in CDE environment. These re requirements mndted for systems tht trnsmit pyment crd informtion over wireless technology. In ddition to generlly pplicble wireless requirements, they impose dditionl security requirements for chnging defult psswords nd configurtions, using strong encryption nd uthentiction, regulr updting of the system with complint softwre, nd monitoring ccess. This pper ddresses how the Mist Lerning WLAN delivers robust PCI-complint solution. Cloud Security The Mist cloud is outside the CDE environment s it does not crry ny wireless pcket dt. Regrdless, Mist tkes dditionl mesures to ensure the highest level of security in the Mist cloud. For exmple: Mist uses type2 soc2 cloud dt center. User ccess is highly restricted. Industry stndrd encryption is utilized t vrious levels. Any informtion stored in the cloud is obfuscted with n orgniztion-specific key. Security is integrted with development cycles, nd pen tests re performed to detect vulnerbilities t the network nd ppliction levels. Network Segmenttion All of the following schems cn be implemented in Mist environment to ensure network segmenttion: Physicl Segmenttion: One wy to chieve network segmenttion is to connect the wireless Access Points on wired network tht is physiclly seprte from the CDE network. This would imply hving n overly wired nd wireless infrstructure tht does not hve ny intersection with the wired network for the CDE environment. In this scheme, there is no firewll or internet connection tht is shred between the CDE nd non-cde networks. VLAN bsed logicl segmenttion: It is common to use Virtul LANs (VLANs) to segment the networks into logicl subnets. While it is possible to chieve logicl segmenttion by hving the wireless network nd the CDE in different VLANs, this methodology is not considered sfe nd secure wy to protect the network, without dequte ccess control policies between VLANs. 1

4 Ensuring PCI DSS Complince with the Mist Lerning WLAN Firewll seprtion: If the wireless LAN is connected to the CDE, instituting Firewll between the Wireless network nd the CDE network is n cceptble form of segmenttion tht conforms to PCI DSS 3.2 requirements. Softwre defined policy engine. Mist s integrted WxLAN policy engine cn be used to isolte ny wireless trffic into the CDE environment. Mist delivers powerful pltform when it comes to creting policies for role, user, ppliction nd resource bsed ccess on the network vi its inline policy engine - WxLAN. The Mist wireless infrstructure llows policies to be enforced on ny wired network with ccess to the LAN blocked for ll WLANs configured in the system. Protect Network From Externl Attcks To ensure the wireless network is complint with the generlly pplicble requirements for PCI DSS, retilers need to py specil ttention to the following: Rogue Devices: These re ccidentl or mlicious Access Points on the wired network tht cn be used to violte internl networks with ccess to ll network resources. Honeypot devices: these re ccidentl or mlicious Access Points tht msquerde s snctioned Access Points beconing retiler s Access Points. Non-complint nd unsnctioned Access Points: These rnge for Access Points tht my be snctioned Access Points but out of complince running old firmwre without criticl security fixes. Similrly, these my lso include Access Points tht re neighbors s well s those cusing indvertent interference to the wireless opertions inside the four wlls of retil store or wrehouse. Two ctivities re required for hndling these externl devices, often referred to s Wireless Intrusion Detection nd Prevention (WIDS/ WIPS): Monitor the RF environment to find nd nlyze the existence of bove. Isolte ny Wi-Fi Access Points not used to trnsmit or receive crdholder dt. Trditionlly there hve been severl wys in which WLAN vendors hve ddressed the bove requirements for WIDS/WIPS complince: Prt time scnning. In this mode, Access Points when not serving clients scn the spectrum for rogue devices. This is lmost kin to hving security solution tht only works some of the time not 24x7. Dedicted Access Points provide 24x7 security monitoring of the wireless spectrum. While this does protect the network ll the time, it explodes the deployment cost for dditionl AP s with ssocited instlltion cost of PoE cble runs to the IDF/MDF to power up the sensors. Some vendors use dul-bnded rdios in Access Points, nd stel rdio within n Access Point for sensor implementtion leding to nightmres in chnnel plnning nd insufficient coverge for clients in the network. Some vendors, while offering tri-rdio Access Point solution with dedicted third rdio, deploy complete overly monitoring solutions orthogonl to the rest of the Wireless infrstructure nd Controller solution with isolted islnds of dt sources, dtbses, visuliztion nd even seprte controls for rdio configurtion, control nd provisioning. The Mist Access Points provide continuous 24x7 scnning of the spectrum longside 2.4Ghz nd 5Ghz client ccess. This llows Mist to continully scn the spectrum for rogues, honeypots, interferers nd for other nomlies such s unsuccessful connection ttempts t site (which my be source for DDOS ttck). In ddition, unlike trditionl vendors, the Mist pltform mintins stte mchine nd bseline on key metrics for every physicl device (Access Point, clients) nd logicl entity (loction, site, site-groups) tht complements flow informtion nd rich elstic cloud dt store. Mist s AI powered infrstructure identifies unusul ctivity t every level of the network nd this wy the Mist pltform cn detect existing nd zero-dy threts. In ddition, Mist s loction technology cn be used to ccurtely locte ccidentl or mlicious rogue devices nd 2

5 Ensuring PCI DSS Complince with the Mist Lerning WLAN provide loction-bsed ccess to resources. Mist s Mchine Lerning frmework cn be extended to behviorl nlytics whereby client device cpbilities cn be checked ginst the norml bseline nd lerts generted when key postures chnge (e.g. 4x4 client device ppers s 2x2 device or client device snctioned for Cliforni loction ppers to ccess the network from New York). Securing Wireless in the Crdholder Dt Environment (CDE) As mentioned bove, the second set of requirements pplies to wireless devices on the sme network where credit crd dt is hndled. Mist llows you to conduct PCI scn for the VLAN s nd Wireless LAN s in scope, nd helps you remedite both the vulnerbilities on the wireless network nd enforce policies on the wireless mngement system. The following is how Mist ddresses the min requirements for these in scope wireless networks to be PCI DSS complint: PCI DSS REQUIREMENTS V3.2 FOR WIRELESS MIST CONFORMS MIST VALUE PROPOSITION Current network digrm tht identifies ll connections between the crdholder dt environment nd other networks, including ny Mist s PCI scn report identifies the list of wireless SSIDs nd Access Points tht connect with the CDE. wireless networks For wireless environments connected to the crdholder dt environment or trnsmitting crdholder dt, chnge ALL wireless vendor defults t instlltion, including but not limited to defult wireless encryption keys, psswords, nd SNMP community strings. Mist does not hve defult psswords, encryption keys or SNMP community strings. 2.4 Mintin n inventory of system components tht re in scope for PCI DSS. Mintin n inventory of system components tht re in Mist provides list of wireless networks nd Access Points tht re in scope of PCI DSS. scope for PCI DSS Ensure wireless networks trnsmitting crdholder dt or connected to the crdholder dt environment, use industry best prctices to implement strong encryption for uthentiction nd trnsmission. 6.2 Ensure tht ll system components nd softwre re protected from known vulnerbilities by instlling pplicble vendor-supplied security ptches. Instll criticl security ptches within one month of relese. Note: Criticl security ptches should be identified ccording to the risk rnking process defined in Requirement Limit ccess to system components nd crdholder dt to only those individuls whose job requires such ccess. Mist supports strong encryption stndrds, including WPA2-PSK, nd WPA2-Enterprise with AES encryption. As prt of its PCI scn report, Mist clls out ny wek encryption used on SSID in scope of the CDE. Mist mkes vilble the ltest relesed firmwre tht includes ny criticl fix required for the integrity of the wireless network. Mist identifies ny Access Point tht hs not yet been upgrded to the ltest firmwre. Wireless network ccess is restricted to uthorized dministrtors. All uthorized dministrtors re listed on the Mist PCI scn report. 7.2 Estblish n ccess control system(s) for systems components tht restricts ccess bsed on user s need to know, nd is set to deny ll Mist Network Administrtors re ssigned roles with limited scope of ccess. Defult dministrtor role is Observer (View-only). unless specificlly llowed Assign ll users unique ID before llowing them to ccess system components or crdholder dt. 8.2 In ddition to ssigning unique ID, ensure proper useruthentiction mngement for non-consumer users nd dministrtors on ll system components by employing t lest one of the following methods to uthenticte ll users: Something you know, such s pssword or pssphrse Something you hve, such s token device or smrt crd Something you re, such s biometric Mist s PCI scn report identifies the list of wireless SSIDs nd Access Points tht connect with the CDE. All Mist dministrtors re uthenticted using complex psswords. 3

6 Ensuring PCI DSS Complince with the Mist Lerning WLAN Restrict physicl ccess to wireless ccess points, gtewys, hndheld devices, networking/communictions hrdwre, nd Mist Access Points cn be mde physiclly secure with the help of screws nd brckets vilble s prt of the ccess point kit. Additionl telecommuniction lines. physicl security is supported with the Kensington lock slot on the Access Point Implement udit trils to link ll ccess to system components to ech individul user Write logs for externl-fcing technologies onto secure, centrlized, internl log server or medi device Implement processes to test for the presence of wireless ccess points (802.11), nd detect nd identify ll uthorized nd unuthorized wireless ccess points on qurterly bsis. Note: Methods tht my be used in the process include but re not limited to wireless network scns, physicl/logicl inspections of system components nd infrstructure, network ccess control (NAC), or wireless IDS/IPS. Whichever methods re used, they must be sufficient to detect nd identify both uthorized nd unuthorized devices. All system ccess, updtes nd configurtion chnges re trcked in n udit log. All event logs re stored in centrlized servers in the Mist cloud pltform hosted in Type 2 SOC 2 Dt Center. Mist WIDS/WIPS llows detection of uthorized nd unuthorized ccess points on the network, eliminting the need for mnully intensive wireless scns. Specificlly, rogue Access Point detection nd continment protects the CDE network from being compromised. Summry As orgniztions rely more on wireless networks s key enbler for business services, PCI DSS requires creful ttention to WLAN security. Fortuntely, Mist hs you covered. By protecting wireless networks form externl ttck nd ensuring dt trnsferred on CDE networks is lwys secure, the Mist Lerning WLAN is sfe choice for mission criticl wireless networks in PCI environments. The key difference in the Mist rchitecture is how the workflows hve been stremlined to enble cohesive experience for network IT, Security Opertions Tems, Mrketing nd other lines of business. With Mist, ccess lyer connectivity nd ssocited pplictions is now ll bout delivering comprehensive, mzing nd secure experience. 4