We have a small "secured network" in our office. And by small I mean it's a Windows 7 PC connected to a firewall which connects to an internet connection. It's for processing card transactions in compliance with PCI DSS.
One of the requirements of PCI DSS is that any machines in the secure network are regularly patched and kept up to date. Another is that the firewall must be locked down to only allow outbound connections to authorised servers. The firewall only makes outbound exceptions by IP Address.
From this we can derive the facts:
- The server must be up to date with patches
- The server must be allowed to connect to Windows Update
- The firewall can only allow it to do this by IP
- Windows Update appears to have no consistent IP range
- The Win 7 box does not have Small Business Server on it
- Therefore the box will not run WSUS
Is there really no way that we can allow the box to receive updates? Or is there something we are missing?