PCI version 3.1 was primarily released to address the insecurity of SSL and some TLS encryption protocols.
“SSL has been removed as an example of strong cryptography in the PCI DSS, and can no longer be used as a security control after June 30, 2016.”
UPDATE: As of April 2016, PCI DSS 3.2 is the latest standard. Read more about the 3.2 updates.
The PCI DSS has released an unscheduled and important update to PCI DSS requirements: PCI 3.1. While it does include minor clarifications and additions, PCI version 3.1 was primarily released to address the insecurity of Secure Sockets Layer (SSL) and some Transport Layer Security (TLS) encryption protocols.
Still catching up changes from PCI 3.0? Check out our Ultimate Guide to PCI DSS 3.0.
Effective immediately, all SSL and early TLS versions are no longer considered to be strong cryptography.
SSL and TLS encrypt the information sent between web browsers and web servers. Since the release of SSL v3, unfixable vulnerabilities were identified. You may have heard of some of these vulnerabilities in 2014, including FREAK, POODLE, and WinShock.
From April 15, 2015 on, merchants must not implement new technology that relies on SSL or early TLS (version 1.0 and sometimes 1.1, depending on use and implementation). Merchants already using systems and devices that utilize SSL and TLS must discontinue the use of those systems and devices before June 30, 2016.
The PCI DSS v3.1 requirements directly affected are:
Each of these requirements will have additional sub requirements or guidance provided in the new PCI DSS 3.1 version.
SecurityMetrics has been scanning for SSL vulnerabilities for over a decade. Specifically, we have been scanning for SSL version 3 vulnerabilities, such as the POODLE vulnerability, since October 2014.
Read the entire summary of changes from 3.0 to 3.1
Because virtually all ecommerce websites have SSL/TLS enabled for their cryptography, they are at the highest risk from SSL/TLS vulnerabilities. New e-commerce websites must not use or support SSL/early TLS.
The PCI Council also stated that web browsers will begin prohibiting SSL connections in the near future, preventing users from accessing web servers that haven’t migrated to a more modern protocol.
The PCI Council decided that Point of Sale (POS) or Point of Interaction (POI) devices that aren’t susceptible to all known exploits of SSL and early TLS may be used, even after June 30, 2016.
Merchants who continue using old POS or POI devices should understand that because SSL is outdated technology, it may be subject to future security vulnerabilities. The PCI Council recommends that POI environments update to TLS v1.1 or greater if possible.
SSL and TLS are widely used, so I recommend contacting your terminal providers, gateways, service providers, vendors, and acquiring bank to determine if the applications and devices you use have this encryption protocol. If you’re writing your own software, please check with your development department.
Examples of applications that likely use SSL/TLS
The PCI Council offered great guidance on migrating from SSL and TLS, as well as examples and recommendations on how to deal with this requirement in their Migrating from SSL and Early TLS information supplement.
If you have existing implementations of SSL and early TLS that you don’t need for regular business operations, immediately remove or discontinue all instances of SSL/TLS. Do not use any new technologies that use SSL/TLS.
First, remember not to use any new technologies that use SSL/TLS. If you need to continue using SSL/TLS to continue regular business operations, here are some examples of what you can do to replace use of SSL/early TLS:
See also: SecurityMetrics PCI Guide
Please note that organizations with existing implementations of SSL and early TLS must have a Risk Mitigation and Migration Plan in place. According to the PCI Council, this document will “detail [your] plans for migrating to a secure protocol, and also describes controls [you have] in place to reduce the risk associated with SSL/early TLS until the migration is complete.”
You will need to provide your Risk Mitigation and Migration Plan to your PCI assessor as part of the PCI DSS assessment process.
Learn more about the Risk Mitigation and Migration Plan in the PCI Council’s migrating from SSL and Early TLS information supplement.
More about PCI 3.1 (including new SAQs) will be revealed in the near future.
According to an email I received from the PCI Council, “Corresponding changes to PA-DSS are in progress, and PA-DSS 3.1 will be published shortly. Information on how PA-DSS submissions will be addressed will also be made available at that time.”
In the meantime, merchants have until June 30, 2016 to comply with PCI 3.1.
Need help discontinuing the use of SSL/TLS? Contact our PCI support team.
.svg)
