In this module,
we're going to look at the final two sub-requirements of PCI DSS requirement 1.
I know it's a bit strange splitting a requirement into two modules,
but requirement 1.4, which looked at personal firewalls,
really isn't related to requirements 1.1,
1.2, and 1.3, which are concerned with network firewalls and routers.
So anyway, here is that rogue requirement,
requirement 1.4 which wants a personal firewall installed on a
particular class of portable devices that may bring malware into
the cardholder data environment.
So this requirement is just considered with portable devices,
portable devices that might connect to the cardholder data environment,
but which also can leave the safety of the CDE and then
randomly connect to places on the internet,
like at home, or a coffees shop, or an airport.
The requirement is for these devices to have personal firewalls
installed on them and that the personal firewall is working.
You might call these also host-based firewalls or
operating system-based firewalls.
The aim is to prevent these mobile devices being infected with
malware when they're away from the protection of the office and
then bring that malware back into the CDE.
I call it a rogue requirement because frankly it would
really sit better in requirement 2,
which is about the configuration of systems rather than this requirement 1,
which is about firewalls, routers, and networking things.
The testing requirements of requirement 1.4 are quite extensive.
And if you're the sort of organization that thinks it's
actually a good idea to have portable devices wandering out the
CDE and then coming back into the CDE,
I recommend you have a really good look at the testing
requirements because it seems to me that actually this should've
been put in a separate sub-requirement to 1.4.
Because the QSA is going to look at three things.
They're going to look at the policy,
they're going to look at a sample of devices to make sure the
firewall is configured in accordance with the policy,
that the firewall is running, and it can't be disabled by use of the device.
If I was the QSA making an assessment of this requirement,
honestly,
I'd also interview the users of these portable devices to make sure that
they didn't try and turn them off and they were aware of what they were
doing and that they knew what was happening.