[Autogenerated] whereas requirement 1.1 looked at the general management
and implementation of firewalls in the organization.
Requirement 1.2 is concerned with the specific configuration of these firewalls.
And so it's overarching requirement is that the firewall restricts
connections between the cardholder data environment and any networks
connected to it to test all the requirements in requirement.
One point to the JK USA is actually gonna look at the
firewall on route configurations on.
I guess they're going to look at the standards as well.
So starting off with a separate requirements of 1.2 requirement,
1.2 point one wants only necessary traffic to be allowed in and out
of the cardholder data environment on for that traffic to be
explicitly permitted and on the firewall.
If it's not explicit, permitted, there's a denial rule.
So it's denial and explicitly permit just what you want
tohave going through the firewall.
The requirement demands that the necessity of both in band and outbound traffic
to be identified as they say with everything else denied.
My experience is that most organizations are really good at
defining the necessity of inbound traffic,
but they're much less so when it comes to outbound traffic and is a Q S.
A.
I was used to focus on this because it's really rare that
service within the cardholder data environment need
unrestricted access to the Internet.
To test this requirement,
the JK USA is going to look at the firewalls themselves,
your configuration standards and also your change control records,
which will include that business justification for each fire
will rule inbound and outbound that we talked about in
requirement one too many people.
Requirement 1.2 point two will seem prehistoric.
The requirement is the routers toe have synchronized
configuration files because a long time ago there was a
problem with some sorts of router,
which meant that when the router rebooted has she didn't
reboot with a running configuration normally,
because somebody forgot to have saved the changes they made
to the running configuration so that the route would reload
the actual configuration, not the previous configuration.
There was also actually problem where criminals would,
um would hack the router configuration files.
But look, this is something that really isn't a problem anymore.
But if it is a problem for you,
make sure your route to configuration files the synchronized.
And then when your routers boot,
they boot up from synchronize secure configurations to test this requirement.
The cure.
So it's just going to look,
you're rich configurations on where they load the
configuration files from a really mean JK USA might even try
rebooting the router to see what happens.
I wouldn't let mean que essays onto my site if they wanted to do this.
Required at 1.2 point three wants to make sure there's a firewall between
the cardholder data environment and any wireless networks,
and that these firewalls between the cardholder data
environment and the widest network are only configured to
permit just authorized traffic.
So that means there needs to be some rules on the firewall saying what people
connected to the wireless network can access within the CD.
So so what house they can access on what protocols
and service is they can access.
I should remind you hear that one of the largest steps of carnal
the data occurred over a wireless network with a criminal sitting
in the car park outside of head office.
So look,
if you must have a wireless network is part of your cardholder data environment.
Make sure that the device is connected to it can only talk to specific
service is on specific hosts in terms of the testing procedure,
the cure say,
is going to look at the firewall configuration that probably also going
to match this with your network diagram and also the evidence of why
these wireless connections need to be in place.
So that's again the business reason.
The justification for that.