Ssl – Disabling weak ciphers on Windows 2003

encryptionpci-dsssslwindows-server-2003

For PCI-DSS compliance you have to disable weak ciphers. PCI-DSS permits a minimum cipher size of 128 bits.

However for the highest score (0 I believe) you should only accept 168 bit ciphers but you can still be compliant if you permit 128 bit ciphers.

The trouble is that when we disable all but 168 bit encryption it seems to disable both inbound and out bound secure channels.

For example we'd like to lock down inbound IIS HTTPS to 168 bit ciphers but permit outbound 128 bit SSL connections to payment gateways/services from service applications running on the server (not all payment gateways support 168 bit only we just found out today).

Is it possible to have cipher asymmetry on Windows 2003? I am told it is all or nothing.

Best Answer

I believe it is all or nothing but if you disable the RC2/128 and RC4/128 ciphers, will that help? The 128 but RCx ciphers are considered medium-grade while ciphers like AES-128 are still considered high encryption. (I must confess, I don't know what the scoring system is based on)

Related Solutions

How to get SMTP Port 25 to be PCI Compliant on OS X 10.6 Server

One document I found recommends the following settings for PCI compliance:

postconf -e smtpd_tls_ciphers=medium
postconf -e smtpd_tls_protocols=\!SSLv2
postconf -e smtpd_tls_mandatory_ciphers=high
postconf -e smtpd_tls_exclude_ciphers="aNULL, MD5, DES"

Then restart the postfix daemon for good measure.
The document is actually for an unrelated VMWare product, but postfix is postfix, right?

;-)

Security – Our security auditor is an idiot. How to give him the information he wants

First, DON'T capitulate. He is not only an idiot but DANGEROUSLY wrong. In fact, releasing this information would violate the PCI standard (which is what I'm assuming the audit is for since it's a payment processor) along with every other standard out there and just plain common sense. It would also expose your company to all sorts of liabilities.

The next thing I would do is send an email to your boss saying he needs to get corporate counsel involved to determine the legal exposure the company would be facing by proceeding with this action.

This last bit is up to you, but I would contact VISA with this information and get his PCI auditor status pulled.

Best Answer

Related Solutions

How to get SMTP Port 25 to be PCI Compliant on OS X 10.6 Server

Security – Our security auditor is an idiot. How to give him the information he wants

Related Topic