1. System Migration to the PCI Environment BRIAN BENINGA, INFORMATION SECURITY ARCHITECT NOVEMBER 12, 2015

2. Topics  PCI environment overview  Steps for migration  Firewall policy best practice

3. PCI environment overview  Isolated and restricted network that can be assigned to any building network jack  Extensive logging is enabled and retained  Both GSA and LSA available  Hostmaster is point of contact for IP assignment and VLAN changes  ISPO is point of contact for firewall rules

4. Steps for migration  Identify systems in the CDE  Contact Hostmaster with the jack number and hostname of device and request GSA or LSA PCI network IP address  Identify firewall rules for device (inbound and outbound)  Contact ISPO with IP of device and firewall rules (it-security@uiowa.edu)it-security@uiowa.edu  When ready to proceed  Set assigned IP on device and contact Hostmaster to move jack to correct PCI VLAN

5. Firewall policy best practices  If vendor documentation is available start there  Both inbound and outbound connections are blocked by default  PCI environment is IPv4 only (no IPv6)  Netstat can be very helpful if no documentation is available  Windows options –ano (all connections/ports, numeric host, owning process ID)  Most *nix options – anp  OSX (and BSD variants) netstat doesn’t have a process identifier (lsof or sockstat are options)  Firewall rule details needed: Source IP --> Destination IP or netblock : Protocol:Destination Port

6. Netstat examples  Listening on all interfaces TCP:135, 3389, 49152 (MSRPC map, RDP, RPC port)  Inbound session established over TCP:3389 (RDP)  Outbound session established to TCP:443 (HTTPS)  Listening on all interfaces TCP:135, 3389, 49152 IPv6  Listening on all interfaces UDP:123 (NTP)Note: UDP is connection-less

7. Firewall request examples  172.30.42.5 -> 128.255.64.5:TCP:1433  PCI LSA device allowed connection to a PCI Server over TCP:1433 (MSSQL)  128.255.76.0/22 -> 172.30.42.5:TCP:443  Building network (UCC) allowed to a PCI LSA device over TCP:443 (HTTPS)

8. If you have questions… or need help ◦Brian Beninga – brian-beninga@uiowa.edubrian-beninga@uiowa.edu ◦Information Security & Policy Office ◦http://itsecurity.uiowa.eduhttp://itsecurity.uiowa.edu ◦it-security@uiowa.eduit-security@uiowa.edu ◦(319)-335-6332