[Autogenerated] whereas a username on a single factors such as a password,
is okay for most Loggins.
Within the 500 there are two types of logging that require multi
factor authentication on those are any administrator access on any
remote access to the 500 requirement?
8.3 just states this and defines what multi factor means,
but it does this in reference.
Back to requirement 8.2.
So that's going to be two off something a user knows,
such as a password, something a user has,
such as a certificate or an authentication token or
something that they are such as a biometric.
The requirement also makes it clear that the authentication
could be at the system or the application level.
There are no testing procedures for 8.3.
They're given separately for each of the sub requirements,
8.3 point one on 8.3 point two now.
The first of these,
then 8.3 point one requires multi factor authentication for
all non console administrative access.
Now we looked at what PC IDE CSS means by non console on requirement 2.3.
Eso is a reminder that anything where the keyboard isn't
plugged into the system being administered.
So basically, all administration nowadays is non console access.
The guidance could be helpful here because it talks about the
two ways that this is typically implemented.
Firstly,
if an administrator is located within the 500 then they'd use MFA
when initially logging into the network or domain.
Or they'd use it every time they logged into a host.
Secondly, it, for instance,
if the administrator access is the 100 far as jump box or a jump post
they could use M F A to log into the jump post,
then they wouldn't have to use it for every other device in the C D.
The second multi factor authentication sub requirement
covers remote network access by all users,
not just administrative uses.
Now I know you can get some pretty complicated and complex
discussions about what is and what isn't remote access,
and I can't cover them all off here.
Otherwise, we'll be having a one hour.
What does PC IDE CSS considers remote access course.
So I want to highlight two parts of the requirement on
also encourage you to talk to you KUSA.
The first parts of highlight is this requirement is
concerned with network access, which you can also read his domain access.
So it's not access to a single application.
So typically, that's access,
which is something like a VPN connect into your cardholder data environment.
On the second is to highlight what PC IDE CSS thinks is remote,
which is the network that's not under the control of the entity being assessed.
And it's important to note here this MF a requirement is required for all users,
not just administrators.
And Jacob and I talk about this in more detail at the end to test the
multi factor authentication requirements in 8.3 point one and 8.3 point
to the QoS will look at system configurations.
Then they'll watch administrators and users logging in.