A client in the retail industry has a network with point-of-sale (POS) terminals that connect to a POS Server. Additionally, most of the Windows workstations in non-sales areas also connect to the same server. This is because the POS software is only one module of a larger legacy application that runs everything for the company (inventory, purchasing, accounting, etc.).

According to our PCI auditor (QSA), any system that connects directly to the card holder data environment is considered in scope (not just the systems that store, process or transmits CC data).

The problem is how to limit the scope so that the hundreds of Windows stations that do not have anything to do with CC data are not in-scope for PCI DSS.

This diagram shows how the POS and Windows stations currently connect to the server: enter image description here

This diagram shows how they connect with a Bastion host implemented: enter image description here

The Windows WS uses Putty or similar to SSH to the Bastion host using password based authentication. The login script or custom shell on the Bastion host auto-SSHes to the POS Server using key-based authentication and the user gets into the business application transparently (the user never gets a shell or ability to break out to shell).

But what does that really accomplish in terms of improved security?

Without a Bastion Host: If the Windows WS is compromised and they get the login password to the POS server, they can SSH to it, but they still only get into the business application with no shell access.

With a Bastion Host: If the Windows WS is compromised and they get the login password to the Bastion server, they can SSH to it, but they still only get into the business application with no shell access.

I don't see that the Bastion host provides a whole lot of extra security in this scenario.

Feedback and/or suggestions on this would be appreciated.

  • 6
    I suggest finding a reputable site to upload your images to. – Michael Hampton Aug 2 '13 at 19:00
  • Would be more helpful if you provided an example of one! – Zek Aug 2 '13 at 19:09
  • Haven't you ever heard of imgur? You've evidently not spent enough time on reddit. – Tom O'Connor Aug 2 '13 at 22:12
  • No, never heard of it. But thanks, I will use that next time! Or, hopefully, I will have enough reputations then to be allowed to just include the image directly in the question... – Zek Aug 2 '13 at 22:55

I've spent the last several years working on PCI-DSS initiatives. Instead of me trying to paraphrase and explain this to you I would highly recommend that you read the open scoping toolkit from IT Revolution.

What you are trying to achieve in your scope reduction is network segmentation. This coalition explains exactly how any why you should do it. There are exact examples that will help you understand much better. Reading the intro and then examining the example on page 26 would be a good place for you to start.

  • Thanks - very good document! From what I gather, using a bastion host / jump box for the Windows workstations (diagram 2) moves those workstations out of scope, since they no longer communicate directly with CDH devices. But I still do not see this adding a whole lot of security benefits in my scenario. Some more data on this would be great. – Zek Aug 2 '13 at 20:37
  • @Zek - the difference is the number of services and the service area of the attack. The more choke points in your network - such as the bastion host - the less surface area there is for attack and the more readily it can be defended. There isn't a single case where reducing the attackable surface area is a bad thing. – Tim Brigham Aug 2 '13 at 20:51
  • Only port 22 is open on both the Bastion Host and the POS server, so it seems to me that the attack surface is the same in terms of listening ports in both diagrams. Of course, the Bastion Host adds one more firewall between the Windows station and the POS Server, but that does not alter the attack surface. Could you give me a concrete case where the Bastion Host provides additional security in my scenario? – Zek Aug 2 '13 at 22:52
  • Tim, your take on my last comment would be much appreciated. I do not mind implementing a bastion host, but I would like to also understand the actual security benefits of doing so in this scenario (as opposed to just doing so to look better from a PCI compliance perspective). – Zek Aug 3 '13 at 16:10
  • @Zek ideally you can harden the bastion host a lot further than your primary server. Sometimes though its only to get the QSA sign off. – Tim Brigham Aug 3 '13 at 22:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.