[Autogenerated] requirement one is all about firewalls is split into five.
Sub requirements were going to look at the 1st 3 in this module,
which have firstly,
tohave and also implement by war configurations or
firewall management standards.
Secondly, to make sure that fire was properly re streets,
all traffic between the cardholder data environment and any other network,
and also that fire was properly control inbound traffic
into the cardholder data environment.
There's also a sub requirement concerned with personal firewalls,
which really doesn't fit very well in Requirement one.
But because it contains the word by a wall is probably
why the PCS SC put it here and then.
The final sub requirement to have policies and procedures is
common across all 12 PC ideas s requirements.
We're going to look at personal firewalls and policies in the next module.
If we take a look at our imaginary network to think about what bits are in
scope and therefore what bits requirement one applies to,
it's pretty obvious.
It's every single firewall,
whether that's a firewall that connects two sites with a VPN,
a firewall that segments a GMC from the internal network,
a fire one in front of an Internet connection or a firewall between,
say,
management network or a corporate network and the cardholder data environment.
Basically,
any firewall that can affect the security of the cardholder data
environment is in scope for requirements 1.11 point two and 1.3.
Let's start off with requirement 1.1,
which I like to think of is the requirement which is concerned with how an
organization takes a management responsibility for its firewalls.
It requires organizations both developed configuration standards
and implement those configuration standards.
1.1 itself requires configuration standards to be both established
and implemented on what needs to be in those configuration standards
in specified in the sub requirements.
1.1 point one through 1.1 point seven In testing all of the
parts of requirement 1.1 a qualified security assessor will
look at the standards themselves.
The configuration of firewalls and routers.
Change control records on other documentation about the network.
They're going to talk to people who were responsible for the
management configuration of firewalls.
If you see an exclamation mark in the testing procedures,
it means that although it it that that's not specified,
in the formal PC idea says documentation,
because it's either an oversight or or, in my practical experience,
the cure say, Well, look at these things.
So let's jump into the sub requirements The first of the sub requirements
requirement 1.1 point one wants to make sure that fire will rule.
Changes are properly managed,
it say's That has to be a reason for every network connection
into and out of the network and for all firewall rules to
have been approved by somebody.
The exact requirements want both a formal process for approving connections
and also a formal process but testing network connections so that it means
you'll need a simple workflow where firewall changes,
get requested and approved by somebody else and then
also wants that changes being made.
There's a test to make sure that change was made correctly,
and if we look at the testing procedure,
you'll see that the JK USA is gonna look for the policy and
written procedures to change firewall rules.
They're going to look at the change records and speak to the people responsible,
both approving on making and testing that change requirement 1.1
point two wanted to have a current network diagram with all the
connections to the cardholder data environment on the emphasis
here is on that word current.
Now remember,
Requirement one is all about firewalls is concerned with connections
between the cardholder data environment and anywhere else.
So what's most important in the network diagram is those external connections.
It's also really important to focus on the word current,
especially in the cloud environment,
where it's really easy to add a new external gateway to a V.
P.
C.
Having being a Q s.
A fully aware that most people update the network diagrams
the day before the qs A comes on site.
But beware really clever.
Q.
Essays are also gonna look at your change control looks.
A look for attractive versions of your network diagrams.
I'm often asked, what's that met?
What diagram is required,
A layer to diagram or lay three diagram Because we're looking for connections
between the cardholder data environment in the outside world,
layer threes where it's really needed.
Jacob and I discussed this in the chat,
which you'll find at the end of the module because in modern
virtualized cloud environments network diagrams,
the cells are actually quite an old fashioned concept.
But what's not old fashioned, though,
is knowing where the ingress and egress points are on your network,
where traffic will leave on come into the cardholder data environment.
As I said, the Q S A is going to look at your network diagram,
but it's also going to talk to people to find out
how the insurance kept up to date.
The JK USA will also check your firewall configurations to make
sure that they match the network diagram.
In addition to a current network diagram requirement,
1.1 point three also wants you to maintain a cart all the data flow
diagram showing how cardholder data flows into and out of your environment
on what you do with it when it's inside the CD A.
The diagrams therefore needs to show where cardholder data is stored,
processed and transmitted within the environment.
I always make sure that my diagram show where data is transmitted,
an encrypted form on what is transmitted in clear text form,
because that makes it much easier to work out what your devices
they're doing and where you might need to protect data.
I know it's a really obvious statement.
But unless you know where your cardholder data is,
it's really hard to protect it.
When we come to the testing procedure,
the JK USA is going to look at the data flow diagram on Also,
talk to people to make sure the diagram is both correcting up today.
It's this diagram the JK USA will use extensively to validate.
You've got the scope of your P C.
I.
D.
S s assessment correct on It's almost one of the core things the cure.
So it's gonna look at and refer to all the way through an assessment.
So it's worth putting sufficient effort into this to make sure accurately
describes how Cardell the data flow through your organization.
When I work in organizations I actually do to diagrams.
I do One diagram showing authorization flows where transactions
received unauthorized and a 2nd 1 was showing where clearing and refund
data flows go so you can see them separately.
Requirement 1.1 point four wants to say that your policy
protects the internal network with firewalls,
so the policy must require a firewall between the
cardholder data environment and the Internet.
Of course,
you must have implemented this policy a swell and actually have
firewalls between the CD on the Internet.
Also,
if you have a demilitarized zone or D M Z that
terminates inbound traffic from the Internet,
there's a firewall between the internal network on the D.
M Z, and if you look at our sample network,
you'll see a couple of very common configurations.
But comply with these PC idea sets requirements.
There's a Web server in its own TMC connected to the Internet
through a firewall on with a second firewall between the DMC on
the internal network and again looking at the connection between
the retail store and head office.
There's a firewall in the store protecting the store network
from the Internet on that also establishes that V P into the
head office and simile at head office.
There's a firewall between the internal network in the Internet,
which also terminates that V P M.
The Q.
S.
A.
Is going to look at the network diagram at the firewall policies and
standards on also at the Firewall Configurations requirement,
1.1 point five wants to make sure that the files are managed
properly and so demands role based access.
The requirement is looking for a description of the roles of
people who manage firewalls in the organization,
what logical groups those roles represent and what management
tests those roles are expected to undertake.
Remember that requirement one is a document and implement requirement.
And so the JK USA is going to look for this information in a
formal document somewhere and is going to talk to people to make
sure this is what actually happens.
Interestingly, there's no requirement for the cure.
Say,
to check the role based access on the firewalls themselves
or any directory server that you rely on,
although honestly on expect most que essays to do.
This is well.
Now we get to one of the hardest requirements.
Requirement 1.1 point six,
which wants documentation for every single firewall rule that
says why the route is needed and the evidence that the creation
of that rule has been approved.
There are three crucial parts of this requirement,
so let's take them one by one.
Firstly, but you need written documentation,
including management approval for every firewall rule.
On that,
that documentation needs to include the source address the
destination address on the port or service.
When I say management approval,
I mean the approval of somebody who is not responsible for
the day to day management the firewall.
The second part is this.
Documentation.
Orson Isa detail the business reason while the rule is required,
finally, you're using any insecure protocols such as town there or or FTP.
You need to document any technical controls you put in
place to help secure the protocol.
For instance,
you might require mutually authenticated tear less and
run your FTP server over tere less.
Or you might.
You might allow telnet connections in just from specified I P addresses,
which you actually pre configured to be monitored in a particular way.
The cure sale's gonna look your standards.
Your record of all protocols and service is in the
business reason they're required.
Then they're gonna go and match that to the current state of the firewall.
Now, in all but the most simple organizations,
this is gonna be a really complicated requirement.
They will typically be helped out by the use of firewall management tools
alongside your organizations change control process.
So you might, for instance, log every firewall changing gear.
Er, you might have Ah,
workflow in there that that tracks the approvals and then the sign off for it
that it's been completed and it's been tested afterwards.
So to meet this requirement, you need to be up to point the qs a twosome.
Change control records on the firewall management system itself or,
in the worst case, the firewall.
And the JK USA is going to just dump the rules.
Set requirement 1.1 point seven is similarly as hard to
comply with is the previous requirement,
because it wants us also to make sure rule sir is correct.
It requires the organization to review its firewall
rules at least every six months.
So practically an organization needs to be making sure any
rules that have outlived their life a deleted.
That's really the main aim of this requirement.
There's a cure,
I say when I reviewed roll sites are iost ___ for a traffic breakdown so
I could get the traffic passing through each rule to help me identify
rules that are actually support connections,
the network, but which were actually in use anymore.
So again, on anything but the most simple,
um, networks,
this test is going to require you to use a dedicated firewall management tool.
You're gonna look all the rules that are defined on the firewall,
determined that they're still in use and that they match
the approvals and change control process.
Since you lasted, it's a big job.
Don't really underestimate this.
When the QS A comes in sight to do your annual assessment but
going to look your standards to make sure they require you to
undertake these regular rule set reviews,
they're also going super conscientious.
Look at evidence of the previous reviews so that when
you're conducting a fire will review.
You need to make sure you keep evidence that you can show the cure,
say to prove you did them.
They're gonna look for those records off reviews.