1. Okay...so need more clarification on that because it recommendation makes no sense. If you block all connections via exit points you won't be doing much business. It's a lot easier to turn those services off! I would suggest putting exit point programs in place that allow for more granular control of who gets access to what. For instance, to log and control FTP transactions. The point is to deny by default...but grant only who's allowed. Without exit point programs in place, your ability to do that is limited. You can roll your own with CL or buy a package.
2. You just need to ensure that all network protocols that support TLS are using them, then turn off any that don't. Some are easier to do than others. For instance, Telnet can be configured to use port 992 and allows you to turn port 23 off. Then you need to tell all your clients to use encrypted connections via 992. Others, like database access via ODBC or any other host servers applications for that matter, you'll need to enable encryption on its TLS port but prevent the service from running on it's plain text port by using a TCP port restriction.
Give me a call if you need further clarification...I do a lot of this and don't mind a conversation. LOL
Steve
Steve Pitcher
iTech Solutions Group, LLC
p: (203) 744-7854 Ext. 176 | m: (902) 301-0810
www.itechsol.com | www.iInTheCloud.com
-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx] On Behalf Of iseriesstuff
Sent: Thursday, August 20, 2020 12:58 PM
To: Midrange-L <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: pci review questions
We had IBM come in and do an evaluation. Couple of items i have questions with.
1. Validate that Exit Programs on all network interfaces are set to block. Has anyone done this? If so, what exit points?
2. TLS/SSL secured versions of protocols exclusively. I know telnet (23) is an issue. We use client access for all our green screen access. Has anyone had to remove telnet for access to the iseries?
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
https://url.emailprotection.link/?bAncuoXZnqCUcaMP1y9_Vy4mA238WJyRc0I8PCKF6U9fHOB7USL8o9LIjNnrhOJEAi3TdOb-G5vau-B83VyfmjkcCaxU0pJleTMyCCTW9Gu_cvvOIO3HD73g0V2T8lSNs
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://url.emailprotection.link/?bg3JjUAS7FimdYyLHsRj55dyDH2GIgsXgg_1-7Sba-glStbGmeg_qPpBRVN13Yniv2RhSUJ8GiBJ_EYDWbUA6qQ~~.
Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.
Help support midrange.com by shopping at amazon.com with our affiliate link:
https://url.emailprotection.link/?bw8w48TccQ5CGr-yc6E2hKHQEBExR0kQBX7bTe_H0E2zpd8tD53U-Vab_twbySYxaxCFGDnSUOyTTYRM3hwrj-Q~~
midrange.com
