1

A client in the retail industry has a network with point-of-sale (POS) terminals that connect to a POS Server. Additionally, most of the Windows workstations in non-sales areas also connect to the same server. This is because the POS software is only one module of a larger legacy application that runs everything for the company (inventory, purchasing, accounting, etc.).

According to our PCI auditor (QSA), any system that connects directly to the card holder data environment is considered in scope (not just the systems that store, process or transmits CC data).

The problem is how to limit the scope so that the hundreds of Windows stations that do not have anything to do with CC data are not in-scope for PCI DSS.

This diagram shows how the POS and Windows stations currently connect to the server: enter image description here

This diagram shows how they connect with a Bastion host implemented: enter image description here

The Windows WS uses Putty or similar to SSH to the Bastion host using password based authentication. The login script or custom shell on the Bastion host auto-SSHes to the POS Server using key-based authentication and the user gets into the business application transparently (the user never gets a shell or ability to break out to shell).

But what does that really accomplish in terms of improved security?

Without a Bastion Host: If the Windows WS is compromised and they get the login password to the POS server, they can SSH to it, but they still only get into the business application with no shell access.

With a Bastion Host: If the Windows WS is compromised and they get the login password to the Bastion server, they can SSH to it, but they still only get into the business application with no shell access.

I don't see that the Bastion host provides a whole lot of extra security in this scenario.

Feedback and/or suggestions on this would be appreciated.

Improve this question
4
  • 6
    I suggest finding a reputable site to upload your images to.
    – Michael Hampton
    Aug 2, 2013 at 19:00
  • Would be more helpful if you provided an example of one!
    – Zek
    Aug 2, 2013 at 19:09
  • Haven't you ever heard of imgur? You've evidently not spent enough time on reddit.
    – Tom O'Connor
    Aug 2, 2013 at 22:12
  • No, never heard of it. But thanks, I will use that next time! Or, hopefully, I will have enough reputations then to be allowed to just include the image directly in the question...
    – Zek
    Aug 2, 2013 at 22:55

1 Answer 1

Reset to default
2

I've spent the last several years working on PCI-DSS initiatives. Instead of me trying to paraphrase and explain this to you I would highly recommend that you read the open scoping toolkit from IT Revolution.

What you are trying to achieve in your scope reduction is network segmentation. This coalition explains exactly how any why you should do it. There are exact examples that will help you understand much better. Reading the intro and then examining the example on page 26 would be a good place for you to start.

Improve this answer
5
  • Thanks - very good document! From what I gather, using a bastion host / jump box for the Windows workstations (diagram 2) moves those workstations out of scope, since they no longer communicate directly with CDH devices. But I still do not see this adding a whole lot of security benefits in my scenario. Some more data on this would be great.
    – Zek
    Aug 2, 2013 at 20:37
  • @Zek - the difference is the number of services and the service area of the attack. The more choke points in your network - such as the bastion host - the less surface area there is for attack and the more readily it can be defended. There isn't a single case where reducing the attackable surface area is a bad thing.
    – Tim Brigham
    Aug 2, 2013 at 20:51
  • Only port 22 is open on both the Bastion Host and the POS server, so it seems to me that the attack surface is the same in terms of listening ports in both diagrams. Of course, the Bastion Host adds one more firewall between the Windows station and the POS Server, but that does not alter the attack surface. Could you give me a concrete case where the Bastion Host provides additional security in my scenario?
    – Zek
    Aug 2, 2013 at 22:52
  • Tim, your take on my last comment would be much appreciated. I do not mind implementing a bastion host, but I would like to also understand the actual security benefits of doing so in this scenario (as opposed to just doing so to look better from a PCI compliance perspective).
    – Zek
    Aug 3, 2013 at 16:10
  • @Zek ideally you can harden the bastion host a lot further than your primary server. Sometimes though its only to get the QSA sign off.
    – Tim Brigham
    Aug 3, 2013 at 22:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .