crowmoor.se

A customer asked me today how they should argument with their auditor to make them compliant even if they do not have firewalls. It is a very intriguing question due to the fact that firewalls are regarded as the only thing that actually hinders every system from beeing included as System Components. But where there is a will there is a way.

How should this be solved then? From a compliance point of view there is no way to get around requirement 1 regarding firewalls and we also has to look at how to contain the creditcard information. That said there of course is a loophole. If there is a loophole it is my job to find it 😉 and the loophole is of course compensating controls. It is stated that compensating controls should only be used when business needs or old legacy products that you cannot replace hinders you from beeing compliant with a requirement. It is also stated that the compensating control should be equal or better that the requirement. Also the auditors I often work with says that the most important thing is to reduce or remove the risk.

That said lets take a look on what the compensating control for this has to do. A firewall blocks all traffic but the allowed to a segmented network. It also logs a lot of information and is possibly capable of handling users rights. From my point of view if you separate your networks with packetfiltering routers and add additional security by only letting specified computers communicate into the secure network throough a jumpstation that has user authentication included, as a terminal server of some sort you have created something that more or less handles the requirements of a fierewall. Still, to have it approved as a compensating control you have to go beyond the original control. By adding IP filtering and exhaustive logging this could be a possible way.