Re: SSL w/ PCI best practices

--===============0065739006==
Content-Language: en-US
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature";
	micalg=SHA1; boundary="----=_NextPart_000_0852_01CAB56C.A573DE10"

------=_NextPart_000_0852_01CAB56C.A573DE10
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Adding to that, the simplest definition I've ever seen of "terminating
within a secure zone" was to simply make sure that the traffic entered your
domain--through a firewall--BEFORE terminating ssl.  So, let's say that you
are load-balancing your firewalls--it would not be appropriate to terminate
SSL on the load-balancers in front of the firewalls, but it would be on the
pair behind them.

You can extend this to say that it cannot be terminated until traversing a
firewall device protecting any DMZ or application block.

As others have noted, making it difficult to remotely access the devices
within that zone and interconnection equipment is also a best practice.  For
instance, in my enterprise days, we eschewed telnet/SSH access in lieu of a
dedicated and secured management network which then connected via direct
serial terminal cable to the devices (like our firewalls); that network only
allowed SSH or other encrypted traffic as well and used two-factor auth.

Of course, the degree to which you go in isolating this segment is subject
to standard risk-management and due care/due diligence practices.

KJ (Ken) Salchow, Jr. | Manager, Technical Marketing
D 651.423.1133
M 612.868.1258
P 206.272.5555
F 206.272.5555
www.f5.com



-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of
Chris Miller
Sent: Wednesday, February 24, 2010 1:39 PM
To: 'Load Balancing Mailing List'
Subject: Re: [load balancing] SSL w/ PCI best practices

When we weren't doing SSL end-to-end, we offloaded at our load balancer and
then sent data to our web servers via clear-text. 

The following are ways that the clear-text traffic could have been
intercepted:

1. Mirror a web-server port.
2. Mirror the load balancer port.
3. Access the server remotely or physically in order to run a packet
capture.

Since all of those options force you to enter the data center or have an
account with advanced privileges, a case could be made that the zone is
"secure."

Alternatively, if our web servers had been owned by someone else or offsite,
we wouldn't have as much control.


Chris Miller

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of
David Coulthart
Sent: Wednesday, February 24, 2010 1:23 PM
To: Load Balancing Mailing List
Subject: Re: [load balancing] SSL w/ PCI best practices

On Feb 24, 2010, at 11:54 AM, Kenneth Salchow wrote:
> Bill-
>
> Thanks for the verification.  I know this was a HUGE security debate 
> back in 2000 when we started doing the ssl termination, but I think 
> over the years people have come to agree on the fact that as long s 
> the traffic stays within a secure zone, with limited electronic and 
> physical access, that it is ok.

Would folks be willing to share any practical documents describing how to
create "secure zones?"  I'm currently working on a project to replace our
existing load balancer and would really like to push for SSL termination
(mainly so I can get the network management benefits of using SNAT).
However, I'm concerned I'll face resistance from our application, systems &
security groups regarding the risks of SSL termination.

Thanks,
Dave Coulthart
_______________________________________________
lb-l mailing list
[email protected]
http://vegan.net/mailman/listinfo/lb-l
Searchable Archive: http://vegan.net/lb/archive http://lbdigest.com Load
Balancing Digest http://lbwiki.com Load Balancing Wiki


_______________________________________________
lb-l mailing list
[email protected]
http://vegan.net/mailman/listinfo/lb-l
Searchable Archive: http://vegan.net/lb/archive
http://lbdigest.com Load Balancing Digest
http://lbwiki.com Load Balancing Wiki

------=_NextPart_000_0852_01CAB56C.A573DE10
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIIzjCCAlYw
ggG/oAMCAQICEEgb315xx3HUwgzZMb1Lyl0wDQYJKoZIhvcNAQEFBQAwYjELMAkGA1UEBhMCWkEx
JTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQ
ZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA5MDgyNjIzNTc1MloXDTEwMDgyNjIzNTc1
MlowQjEfMB0GA1UEAxMWVGhhd3RlIEZyZWVtYWlsIE1lbWJlcjEfMB0GCSqGSIb3DQEJARYQay5z
YWxjaG93QGY1LmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAry5h0di1dpSX3iunEOj5
yhbkKQwF8+4MnRaGp5LhwITm+/2K977gkxd2FqBho+iC0sMCxbFDarMawqOITQuzoW/0VqcOyNrW
Zh/L6dRQOSFIjJAz4eGAtuohC5N8oRdV+l1Zb8UcOua11YBPcOLAgD94AOcALm0DFlwaTsQi8pcC
AwEAAaMtMCswGwYDVR0RBBQwEoEQay5zYWxjaG93QGY1LmNvbTAMBgNVHRMBAf8EAjAAMA0GCSqG
SIb3DQEBBQUAA4GBAJDs8XatGqIVTw6NkEdNOxwIaxbQI8JU8NZcGIc42DbX/TsUXR8CAdFJ640Q
pXke6ldn8I01pEPEIlUWri2zNrEVgSuHGizrt3qGn8hHU4hmO3vdhHqXWeowalRZMDA8P9oMAhjK
2j9EfnxJ8N5USl8/JEbayDFnjFvBU7DOi08PMIIDLTCCApagAwIBAgIBADANBgkqhkiG9w0BAQQF
ADCB0TELMAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBU
b3duMRowGAYDVQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBT
ZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIENBMSsw
KQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbEB0aGF3dGUuY29tMB4XDTk2MDEwMTAwMDAw
MFoXDTIwMTIzMTIzNTk1OVowgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUx
EjAQBgNVBAcTCUNhcGUgVG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsT
H0NlcnRpZmljYXRpb24gU2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25h
bCBGcmVlbWFpbCBDQTErMCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhhd3RlLmNv
bTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1GnX1LCUZFtx6UfYDFG26nKRsIRefS0Nj3sS
34UldSh0OkIsYyeflXtL734Zhx2G6qPduc6WZBrCFG5ErHzmj+hND3EfQDimAKOHePb5lIZererA
Xnbr2RSjXW56fAylS1V/Bhkpf56aJtVquzgkCGqYx7Hao5iR/Xnb5VrEHLkCAwEAAaMTMBEwDwYD
VR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQQFAAOBgQDH7JJ+Tvj1lqVnYiqk8E0RYNBvjWBYYawm
u1I1XAjPMPuoSpaKH2JCI4wXD/S6ZJwXrEcp352YXtJsYHFcoqzceePnbgBHH7UNKOgCneSa/RP0
ptl8sfjcXyMmCZGAc9AUG95DqYMl8uacLxXK/qarigd1iwzdUYRr5PjRzneigTCCAz8wggKooAMC
AQICAQ0wDQYJKoZIhvcNAQEFBQAwgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENh
cGUxEjAQBgNVBAcTCUNhcGUgVG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNV
BAsTH0NlcnRpZmljYXRpb24gU2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJz
b25hbCBGcmVlbWFpbCBDQTErMCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhhd3Rl
LmNvbTAeFw0wMzA3MTcwMDAwMDBaFw0xMzA3MTYyMzU5NTlaMGIxCzAJBgNVBAYTAlpBMSUwIwYD
VQQKExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29u
YWwgRnJlZW1haWwgSXNzdWluZyBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAxKY8VXNV
+065yplaHmjAdQRwnd/p/6Me7L3N9VvyGna9fww6YfK/Uc4B1OVQCjDXAmNaLIkVcI7dyfArhVqq
P3FWy688Cwfn8R+RNiQqE88r1fOCdz0Dviv+uxg+B79AgAJk16emu59l0cUqVIUPSAR/p7bRPGEE
QB5kGXJgt/sCAwEAAaOBlDCBkTASBgNVHRMBAf8ECDAGAQH/AgEAMEMGA1UdHwQ8MDowOKA2oDSG
Mmh0dHA6Ly9jcmwudGhhd3RlLmNvbS9UaGF3dGVQZXJzb25hbEZyZWVtYWlsQ0EuY3JsMAsGA1Ud
DwQEAwIBBjApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRUHJpdmF0ZUxhYmVsMi0xMzgwDQYJKoZI
hvcNAQEFBQADgYEASIzRUIPqCy7MDaNmrGcPf6+svsIXoUOWlJ1/TCG4+DYfqi2fNi/A9BxQIJNw
PP2t4WFiw9k6GX6EsZkbAMUaC4J0niVQlGLH2ydxVyWN3amcOY6MIE9lX5Xa9/eH1sYITq726jTl
EBpbNU1341YheILcIRk13iSx0x1G/11fZU8xggL4MIIC9AIBATB2MGIxCzAJBgNVBAYTAlpBMSUw
IwYDVQQKExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVy
c29uYWwgRnJlZW1haWwgSXNzdWluZyBDQQIQSBvfXnHHcdTCDNkxvUvKXTAJBgUrDgMCGgUAoIIB
2DAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xMDAyMjQyMjE1NTda
MCMGCSqGSIb3DQEJBDEWBBQg7hIpvq+D7atv+1mEig1QAz7v8TBnBgkqhkiG9w0BCQ8xWjBYMAoG
CCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG
9w0DAgIBKDAHBgUrDgMCGjAKBggqhkiG9w0CBTCBhQYJKwYBBAGCNxAEMXgwdjBiMQswCQYDVQQG
EwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhh
d3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECEEgb315xx3HUwgzZMb1Lyl0wgYcGCyqG
SIb3DQEJEAILMXigdjBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcg
KFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0EC
EEgb315xx3HUwgzZMb1Lyl0wDQYJKoZIhvcNAQEBBQAEgYBXJEb58vtEH0LugkuvzTdF9LGHvNwf
UT53uE9BERK0Tw3Wx7XIjiWDMceVAojP8ZsFeKw1Yonff+xHOOVhNkSNSYppvym+mUxX7jsM65/d
YpRuInztgyI6/ldiXZCmY1VqGSgKyIGlc2UFZPPwzLRENOSno9qdFoy5XFkvOohwPwAAAAAAAA==

------=_NextPart_000_0852_01CAB56C.A573DE10--

--===============0065739006==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
lb-l mailing list
[email protected]
http://vegan.net/mailman/listinfo/lb-l
Searchable Archive: http://vegan.net/lb/archive
http://lbdigest.com Load Balancing Digest
http://lbwiki.com Load Balancing Wiki

--===============0065739006==--