Very valid point Steve. This system is technically not in scope, but we are trying to be proactive. Changing to SSL connections for iSeries Access is next up on our security teams project list.
----------------------------------------
From: "Steve Martinson" <smartinson66@xxxxxxxxx>
Sent: Wednesday, November 24, 2010 12:36 PM
To: midrange-l@xxxxxxxxxxxx
Subject: Re: Login Issues at QPWDLVL 2 for some users
Remember, too, that if this is a system that is "in-scope" for the PCI DSS,
all connections to the machine *must* be secure:
*Requirement 8.4** - Render all passwords unreadable during transmission and
storage on all system components using strong cryptography.*
*
*
So for regular TELNET, while it could hypothetically pass a PCI assessment
for Requirement 2.3 for all non-administrative users, later down the road
(Requirement 8 controls) you would end up failing anyway because of the
passwords not being encrypted over the network during transmission (whether
it's admin-level access or not).
--
Regards,
Steve
Steven W. Martinson, CISSP, CISM, CISA | Senior Consultant
SkyView Partners, Inc. | 25563 SE 41st
Court | Issaquah, WA 98029
Phone: 425-458-4975 ext 712 | Fax: 425-657-0135 |
steve.martinson@xxxxxxxxxxxxxxxxxxx
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit:
http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at
http://archive.midrange.com/midrange-l.
midrange.com
