What Are The PCI DSS Requirements in 2023?

The PCI DSS outlines numerous requirements that all merchants must follow in order to ensure compliance. The first step is to protect cardholder data by installing and maintaining a firewall configuration. We are going to talk you through what this entails and how our service helps. 

This requirement is actually the most technically challenging of all of the PCI DSS standards. Installing and maintaining a firewall configuration may sound simple on the surface, but there is a lot that is entailed in this requirement, as you will discover below. 

What does PCI expect when it comes to installing and maintaining a firewall configuration?

The first thing you need to do is establish and install router and firewall configuration standards, which must consist of all of the following:

1. A formal procedure for the testing and approval of all network connections and alterations to router and firewall configurations.
2. A diagram that identifies all networks, network devices, and systems components. This diagram must include connections between the Cardholder Data Environment (CDE) and all other networks, with wireless networks included.
3. You also need a diagram that shows cardholder data flows across all of your networks and systems. 
4. For each Internet connection, there must be a firewall. This also applies between any demilitarised zone (DMZ) and the internal network zone. 
5. To manage network components, you need a description of all groups, roles, and responsibilities. 
6. Business justification and documentation are required in regards to the utilisation of all permitted services, ports, and protocols as well as any security measures that are used for insecure protocols. 
7. You must review all router and firewall rule sets every six months minimum. 

Understanding this requirement:

What you must recognize is that both routers and firewalls play a crucial role when it comes to network entry and exit points. They will grant authorized network access and block unwanted access, and this highlights why it is imperative to have firewalls and routers implemented. Points a-g are essentially PCI’s guidelines for the steps that need to be taken in order to ensure this first line of defense is as strong as it needs to be. 

So, let’s take a look at how to implement points a-g:

1. 1. Formal testing/approval process – This is vital because it helps prevent security problems that arise due to misconfiguration of the network, firewall, or router. You must ensure that only authorized users (with a password) are permitted to make any changes and that these alterations are recorded and retained. 
   2. Diagram identifying networks, network devices & systems components – These diagrams describe network configuration and can be used to identify all network device locations. Without it, devices may be unknowingly left out of security controls, which can pose a severe risk. You should automatically generate and update network diagrams. 
   3. Cardholder data flow diagram – This identifies the location of all cardholder data within the network. This allows you to manage data more effectively. 
   4. Firewalls for all Internet connections – This reduces the chances of a malicious individual getting into your network via an unprotected network because access is monitored and controlled more effectively. Ensure a PCI compliant firewall is installed for each Internet connection, as well as between any DMZ and the internal network zone.
   5. Description of all groups, roles, and responsibilities – This ensures that all personnel is aware of who is responsible for what. These roles can be managed via a centralized management system. 
   6. Documentation and business justification for all permitted services, ports, and protocols – This allows you to remove or disable all other protocols, ports, or services. 
   7. Review router and firewall ruleset every six months – Constant updating is required to continually meet PCI DSS standards. 

You must also build router and firewall configurations that limit connections among CDE system components and untrusted networks. This involves:

1. Traffic must be restricted, both inbound and outbound so that the Cardholder Data Environment only contains what is necessary. All other, unrelated traffic must be segregated. 
2. Router configuration files must be secured and synchronized. 
3. Control traffic by installing perimeter firewalls between the CDE and all wireless networks. Configure these firewalls to permit authorized traffic only between the CDE and wireless environment. 

Understanding this requirement:

Step two involves achieving the correct firewall configuration so that it functions correctly and controls network traffic in a safe and effective manner. You need to ensure that network protection is installed between the internal, trusted network and any external, untrusted networks. If you don’t do this, you are vulnerable to an attack. 

1. 1. Restrict inbound and outbound traffic – This is necessary to ensure any malicious attackers do not gain access to your network through the use of services, ports, or protocols in an unauthorized manner or via unauthorized IP addresses. Achieve this through creating a Cardholder Data Environment whereby all inbound and outbound traffic is denied except payment transactions. 
   2. Secure and synchronize router configuration files – Start-up configuration files are often overlooked due to their infrequent use. However, if they are not updated with the same secure settings, then a cybercriminal may find a way in. 
   3. Install perimeter firewalls between all wireless networks and the CDE – Malicious individuals often exploit wireless technology to access card details. This is why firewalls are needed to restrict access from wireless networks to the Cardholder Data Environment. 

Direct public access between any CDE system components and the Internet must be prohibited. To do this, you must:

1. Inbound traffic must be limited to system components that supply authorized publically accessible services, protocols, and ports. Implement a DMZ to achieve this.
2. Within the DMZ, inbound Internet traffic must be limited to IP addresses. 
3. Direct connections between the CDE and Internet, whether inbounded or outbound, must be prohibited. 
4. You must detect and block any forged source IP addresses so that they cannot enter the network. Implement anti-spoofing measures to achieve this.
5. Unauthorized outbound traffic from the CDE to the Internet should not be allowed.
6. ‘Established’ connections should only be allowed into the network. 
7. Any system components that store cardholder data must be segregated from the DMZ and other untrusted networks and instead placed in an internal network zone. 
8. Routing information and private IP addresses must not be disclosed to unauthorized parties. 

Understanding this requirement:

The previous two steps have focused on the protection offered by firewalls. The firewall essentially protects the connections from the public systems to the CDE. However, all of this will be completely worthless if you allow direct access between public systems and the CDE.

1. 1. Implement a DMZ – This manages connections between the Internet and services that businesses need to have available to the public. This will stop cybercriminals from using the Internet to access your internal network. Limit all traffic to ensure you’re compliant. 
   2. Limit inbound traffic to IP addresses in the DMZ – This ensures no one unauthorized has access. Prohibit direct connections between the Internet and the CDE – This stops unfiltered access from occurring between trusted and untrusted environments. Therefore, let’s say a cybercriminal obtains sensitive information; they will be unable to send it from your network to an untrusted, external server. You can achieve this by denying all inbound and outbound traffic except payment transactions. 
   3. Implement anti-spoofing measures – Malicious attackers often try to imitate an IP address so you believe it is coming from your own network. Measures must be in place to stop this.
   4. Prohibit unauthorized outbound traffic from the CDE to the Internet – You must control traffic so that only authorized communications are allowed. You can do this by denying all inbound and outbound traffic apart from payment transactions. 
   5. Only allow established connections into the network – You need a firewall that performs a stateful packet inspection. This involves maintaining each connection’s status through the firewall so you know if a response is authorized or a cybercriminal is trying to trick the firewall so they can find a way in. 
   6. Segregate system components that store cardholder data from the DMZ – There are fewer layers for cybercriminals to penetrate if cardholder information is stored within the DMZ. This makes it easier for them to gain access. Cardholder data needs to be within a segregated network.
   7. Routing information and private IP addresses must not be disclosed to unauthorized parties – You must ensure private IP addresses are disclosed, otherwise a hacker may discover what the IP address is and gain access to your network. Require all users to log in, ensuring authorized disclosure from an administrator at each location, and you should prohibit routing protocols and advertisements. 

Personal firewall software must be installed on any employee-owned devices and mobiles that connect to the Internet when used to access the network or outside the network.

Understanding this requirement:

A personal firewall is needed to protect mobiles and employee-owned devices from an Internet-based attack. This is imperative, as these devices are more susceptible to breaches because they are outside the corporate firewall, and so they become prime targets for hackers. Therefore, if your employees use their laptops for work purposes and connect when they are outside the network it is your responsibility to ensure they have personal firewall software installed. 

Operational procedures and security policies for managing firewalls must be documented and known to all parties that are affected.

Understanding this requirement:

To ensure you continue to prevent unauthorized network access you must manage the policies and procedures that are in place in regards to firewalls and routers, ensuring they are well documented and updated.