PCI Compliance - SBS 2008

Evening All

A client of mine has recently failed his PCI compliance test on two areas:

1: SSLv3 Padding Oracle On Downgraded Legacy Encryption Vulnerability (POODLE)
Resolution: Disable SSLv3.

2: Microsoft Exchange Client Access Server Information Disclosure
Resolution: There is no known fix at this time.

Originally he failed the test a few months back because of the standard certificate his server was using, we managed to rectify this by installing a verified SSL cert. We also had to disable SSLv2 on the server as the test was also complaining about this.

Now can anybody advise if disabling SSLv3 is ok to do as I'm almost certain we need at least one variant of it running on the server.

As for the exchange error, if there is no known fix how can security metrics expect my client to pass the test?

Any help is greatly appreciated!
Daniel BertoloneAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

David Johnson, CD, MVPOwnerCommented:
Use this script to set your security suites

There is a workaround for the information disclosure and it means editing all of the basic authentication and changing the realm to your fqdn and not leaving it blank
http://blog.kurtiskent.com/2014/09/workaround-for-iis-multiple-internal-ip.html
set-perfectFSecutity.ps1.txt
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Cris HannaCommented:
Yes there is a vulnerability in SSL v3, so it does need to be disabled, v2 should be ok.  Is you customer actually storing credit card information on their server?
0
Daniel BertoloneAuthor Commented:
Hi Cris

I just confirmed with my client and he does not store credit card info on his server, he takes card payments via his website that is hosted externally to his company. In this case should the security metrics test be pointing at the location of where his website is hosted & not at his on premise server.
0
ON-DEMAND: 10 Easy Ways to Lose a Password

Learn about the methods that hackers use to lift real, working credentials from even the most security-savvy employees in this on-demand webinar. We cover the importance of multi-factor authentication and how these solutions can better protect your business!

Cris HannaCommented:
That would be correct, almost.  I suspect that some third party is actually doing the credit card transactions for the website, so then the question becomes is cc information being stored on the web server, or by the 3rd party?
0
Daniel BertoloneAuthor Commented:
Thanks Cris,

The cc information is being held by a 3rd party (ekm powershop), i have just spoken with security metrics who run the PCI compliance test and they have advised that my clients server must still be be compliant. They advised that ssl 3.0 is disabled and to use TLS 1.0 as a minimum.

Now my question is that in the below registry key i only have a ssl 2.0 folder.
HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

To disable ssl3.0 and enable tls 1.0 i have read online that i can create an ssl3.0 folder and enter the necessary dword value?
0
David Johnson, CD, MVPOwnerCommented:
use the powershell script I provided
0
Daniel BertoloneAuthor Commented:
Thanks David, i have just run the script and made the IIS adjustments, i will let you know how the test goes!
0
Daniel BertoloneAuthor Commented:
Test results came back as a pass, thanks for your prompt & accurate assistance, it's aporeciated!

Cris - thanks for your input on the issue!
0
Steph_MCommented:
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
SSL / HTTPS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.