I think we all need to step back a bit, let OP do what his auditor feels is right, then thank him on behalf of EFF’s StartTLSEverywhere project... [1] ;)
James [1] https://starttls-everywhere.org On Mon, 23 Jul 2018, at 18:21, Mark Foster wrote: > Maybe i've missed something. Email is valid to shift around in plain > text. TLS 1.0 might not be acceptable if you're talking minimum > encryption standards, but I agree with the posters that point out that > the Payment Card environment should have no dependencies on any email > exchange with third parties. This sounds to me like a box-ticking > exercise where the right action on the public internet is to generally > support the lowest common denominator unless it's insecure to do so - > and in the case of email, you have to assume all transactions are > insecure anyway unless you have end-to-end controls in place (which > clearly you don't in this case if TPG is one end!)> In the end you should be > able to exchange email with TPG without any > encryption at all and it shouldn't affect your compliance, surely?! As > you can't be held responsible for a third party system and shouldn't > be dependent on its status for your compliance as a result.> Disclaimer: Have > never tried to seek PCI compliance in any system i've > operated.> Mark. > > On 23/07/2018 7:03 PM, Paul Wilkins wrote: >> PCI spec is pretty clear you're to have separation (virtual/physical) >> between PCI and other environments.>> >> OTOH, TPG SLA's do not require TLS1.0+. >> >> Someone is going to have to sling for an external MTA. >> >> Kind regards >> >> Paul Wilkins >> >> On 23 July 2018 at 16:01, Michael Junek >> <[email protected]> wrote:>> >>> Just being the 'mean security consultant' - the security level of >>> each system could easily be argued - email would be considered low >>> security for compatibility (which technically means that TLS1.0/SSL3 >>> etc is acceptable) ; whereas the web servers are considered high >>> security handling CHD, which means that they should covered under >>> the full encrypted spec. It would also mean if that was considered, >>> that 2.2.1 would apply, and seperation of function would be >>> required.>>> >>> >>> >>> *From:* Bradley Silverman <[email protected]> *Sent:* >>> Monday, 23 July 2018 15:56 *To:* Michael Junek *Cc:* Mark Newton; >>> [email protected]>>> >>> *Subject:* Re: [AusNOG] Issues receiving from TPG Mail servers.>>> >>> >>> @Michael - That's what we are looking at doing, though it will be a >>> pain. Not sure how to go about doing it with Exim & cPanel but will >>> start looking into it.>>> >>> Re 2.2.1, it won't fail if they have the same security level, which >>> is what we are trying to accomplish by bringing TPG into spec. DNS >>> is on separate servers, and the database connection isn't publicly >>> accessible.>>> >>> Really appreciate the help with this gents. Hopefully TPG get back >>> in touch with me else we will have to investigate ways of blocking >>> TLS handshakes from TPG.>>> >>> Regards, >>> >>> Bradley Silverman | VentraIP Australia >>> *Technical Operations* >>> >>> mobile. +61 418 641 103 >>> phone. +61 3 9013 8464 >>> >>> On Mon, Jul 23, 2018 at 3:48 PM, Michael Junek >>> <[email protected]> wrote:>>> >>>> On the PCI Audit side of things, however, I think the shared >>>> hosting such as CPanel servers will fail PCI based on requirement >>>> 2.2.1 regardless-->>>> >>>> " >>>> Implement only one primary function per server to prevent functions >>>> that require different security levels from co-existing on the same >>>> server. (For example, web servers, database servers, and DNS should >>>> be implemented on separate servers.)>>>> " >>>> >>>> >>>> >>>> >>>> >>>> *From:* AusNOG <[email protected]> on behalf of >>>> Bradley Silverman <[email protected]> *Sent:* Monday, >>>> 23 July 2018 15:40 *To:* Mark Newton *Cc:* [email protected] >>>> *Subject:* Re: [AusNOG] Issues receiving from TPG Mail servers.>>>> >>>> >>>> @Michael - I agree that turning it off is the best way of solving >>>> it, the issue is we don't have the servers forcing TLS, that's TPG.>>>> >>>> @Mark - These are shared hosting servers, think cPanel & Plesk. >>>> The one server is both mail, and website. Which means that the >>>> server has websites that accept credit card payments, and >>>> therefore is subject to PCI. Any system that is on that server is >>>> required to comply with PCI.>>>> >>>> If the server was website only, then I'd agree 100% that it would >>>> be out of scope for PCI, but since the same server runs both email >>>> and websites for shared hosting customers, it is in scope.>>>> >>>> We have zero issue with any other MTA, it is only these TPG MTA's >>>> that are forcing both TLSv1.0 and an old cipher. If they either >>>> turned off TLS or upgraded to TLSv1.2 they would be up to spec.>>>> >>>> But we either have to make the decision to block TPG from being >>>> able to send to the 100,000s of email accounts we have, or make it >>>> so that none of our customers servers are PCI compliant. I'd rather >>>> speak to TPG and work with them to fix the underlying problem.>>>> >>>> Regards, >>>> >>>> Bradley Silverman | VentraIP Australia >>>> *Technical Operations* >>>> >>>> mobile. +61 418 641 103 >>>> phone. +61 3 9013 8464 >>>> >>>> On Mon, Jul 23, 2018 at 3:34 PM, Mark Newton >>>> <[email protected]> wrote:>>>> >>>>> But PCI Compliance only applies to the Cardholder Data >>>>> Environment.>>>>> >>>>> Why on earth would you have a mail server in the Cardholder Data >>>>> Environment?>>>>> >>>>> And if it isn’t in the CDE: You can run whatever version of TLS >>>>> you want, and it’s none of PCI’s business.>>>>> >>>>> >>>>> - mark >>>>> >>>>> >>>>> >>>>> >>>>>> On Jul 23, 2018, at 3:06 PM, Bradley Silverman >>>>>> <[email protected]> wrote:>>>>>> >>>>>> Hi Matt, >>>>>> >>>>>> Really appreciate you sending me that email, I will definitely >>>>>> send an email through to there!>>>>>> >>>>>> @Mark Certainly not! PCI Compliance requires that TLSv1.0 be >>>>>> disabled on the server. Postifx/Exim/Dovecot are not exception >>>>>> to the rule, if we disable TLSv1.0 on the server and remove the >>>>>> weak cipher, then TPG's MTAs aren't able to send mail to us.>>>>>> >>>>>> Regards, >>>>>> >>>>>> Bradley Silverman | VentraIP Australia >>>>>> *Technical Operations* >>>>>> >>>>>> mobile. +61 418 641 103 >>>>>> phone. +61 3 9013 8464 >>>>>> >>>>>> On Mon, Jul 23, 2018 at 2:48 PM, Mark Newton >>>>>> <[email protected]> wrote:>>>>>> >>>>>>> You’re trying to exchange payment card information over email?>>>>>>> >>>>>>> >>>>>>> - mark >>>>>>> >>>>>>>> On Jul 23, 2018, at 1:30 PM, Bradley Silverman >>>>>>>> <[email protected]> wrote:>>>>>>>> >>>>>>>> Does anyone have a contact at TPG regarding their mail >>>>>>>> servers?>>>>>>>> >>>>>>>> We are having issues with their mail servers using non-PCI >>>>>>>> compliant ciphers which is stopping our servers accepting mail >>>>>>>> from them.>>>>>>>> >>>>>>>> >>>>>>>> Regards, >>>>>>>> >>>>>>>> Bradley Silverman | VentraIP Australia >>>>>>>> *Technical Operations* >>>>>>>> >>>>>>>> mobile. +61 418 641 103 >>>>>>>> phone. +61 3 9013 8464 >>>>>>>> _______________________________________________ >>>>>>>> AusNOG mailing list [email protected] >>>>>>>> http://lists.ausnog.net/mailman/listinfo/ausnog>>>>>>> >>>>>> >>>>> >>>> >>> >>> >>> _______________________________________________ >>> AusNOG mailing list >>> [email protected] >>> http://lists.ausnog.net/mailman/listinfo/ausnog >>> >> >> >> >> _______________________________________________ AusNOG mailing list >> [email protected] >> http://lists.ausnog.net/mailman/listinfo/ausnog >>> > _________________________________________________ > AusNOG mailing list > [email protected] > http://lists.ausnog.net/mailman/listinfo/ausnog
_______________________________________________ AusNOG mailing list [email protected] http://lists.ausnog.net/mailman/listinfo/ausnog
