Firewall Hardening for PCI Compliance

[pj255]

Hi, Does anyone have an overall guideline or check-list for hardening a 1000c. The firewall is currently being used for web filtering and application control, I will be adding some simple DLP sensors and IPS also. pj

[neonbit · Accepted solution]

The FortiGate Admin guide has a section on PCI compliance here which goes through some of the ways you can harden your FortiGate to comply with PCI.

[emnoc]

That' s a subjective matter. In the PCI compliance guide you will not find one single guide that give specifics for firewall and each auditor seems to target various issues. PCI is wholeness complete compliance and the firewall is just one of many. The only vendor that I' m aware of that has a very broad checklist is dell sonicwall http://www.sonicwall.com/us/en/solutions/Solutions-PCI-Compliance.html#tab=bestpractices You can incorporate some of these items into your practices. Ken

[Istvan_Takacs_FTNT]

You can also try to enable FIPS mode on the host. It will require restart and wipe the config, but will turn on/off many features that would make the host at least FIPS-CC compliant. If the requirement is to harden the host than it will harden it for you, not sure though if it helps with the PCI one, but you may want to have a look.

[emnoc]

FIPS is a good suggestion , but beware of what you can' t use , and if it meets your business model. e.g vpn protocols are greatly enhanced or selection reduced. Check out a recent blog I wrote about FIPS & fortigate. http://socpuppet.blogspot.com/2014/09/hardening-your-fortigate-firewall-by.html And once again FIPS has nothing todo with PCI-DSS compliance. And PCI compliance is not FIPS. PCI-DSS covers ever thing from securing data, passwords, backup, logging,access controls, encryption of data in transit and at rest & security audit/checks on a regular basis. FIPS certification just means you systems has ran thru a stringent check for crypto standards and you meet all of the required minimum checks and now your endorsed as FIPS certified & now you can offer your product on the GSA schedule as FIPS certified and approved. FIPS is about cryptology checks and requirements, where as PCI-DSS is about systems protection for cardholder data.

[Frosty]

Belatedly adding from my experiences of the past few months. 

Some of the things I have had to do in relation to SSL VPN functionality for PCI DSS compliance:

* installed a certificate from a trusted third-party CA for our SSL VPN connections (instead of using self-signed cert)

* disabled SSL 3.0, TLS 1.0 and TLS 1.1 connections for the SSL VPN

* set encryption/cipher algorithms to High level instead of Default (disables insecure ciphers like RC4; I think?)

* contact ISP and set up reverse DNS lookup from firewall IP to host name that matches our wildcard cert

[FatalHalt]

Stephen Frost wrote:

Belatedly adding from my experiences of the past few months. 

Some of the things I have had to do in relation to SSL VPN functionality for PCI DSS compliance:

* installed a certificate from a trusted third-party CA for our SSL VPN connections (instead of using self-signed cert)

* disabled SSL 3.0, TLS 1.0 and TLS 1.1 connections for the SSL VPN

* set encryption/cipher algorithms to High level instead of Default (disables insecure ciphers like RC4; I think?)

* contact ISP and set up reverse DNS lookup from firewall IP to host name that matches our wildcard cert

Sounds like the exact process I'm working on!

[neonbit · Accepted solution]

The FortiGate Admin guide has a section on PCI compliance here which goes through some of the ways you can harden your FortiGate to comply with PCI.

[emnoc · Accepted solution]

FWIW  & IMHO that links is useless without reference to the actual PCI DSS specifications. IMHO experiences and thru various audits, you 're best to read/review the actual PCI DSS "Requirements and Security Assessment Procedures" document. It's only like 100 pages and 12 major areas with like 4-5 that really deals wth network, systems and firewalls. It would take you less than 1-2 hour to read it for a average reader.

OP, keep  this thought in mind ; " as log as you read the areas that applicable to you and can demonstrate that you meet that requirement ( paragraph and all sub-paragrahs )". Then you will always PASS a audit.

Some things will be nik-picked on like " disabling of unused accounts or re-use of passphrases " ( both of these are very hard to do without a remote authentication system aka .....authenticator  radius etc.....

So read the actual PCI DSS document, FIPS mode will get you by on any weak cipher and security protocols, but PCI-DSS is more than just that & is a complete practical procedure from end2end and everything in between.

[Frosty]

I could use some input from others with more experience.  Having followed the instructions here:

https://stuff.purdon.ca/?page_id=83

I've successfully imported a valid wildcard certificate issued by a proper third-party CA (GeoTrust).  The wildcard cert is now being used for SSL VPN connections.  So far so good.

My question concerns the entirety of the cert's chain ... the Intermediate and the Root signing authority certs.

These have NOT been installed to our Fortigate.  The SSL VPN is working fine.  But we are getting an error when we do a PCI vulnerability scan.  The scan is not recognising the validity of the CA.  Is this because I have not also installed the Intermediate and Root certs to the Fortigate?  Or is it because there's an issue with the Qualys scan system and *it* is at fault.

What have others done when installing third-party CA certs ... install Intermediate and Root certs ... or not?

If installing, do they all go into the Local Certificates store, or ... ?

EDIT:  in the meantime I have flagged the issue as a False Positive and this has been accepted by Qualys ... but I would still be interested to know what others have done when installing 3rd-party CA certs.

[seadave]

Stephen Frost wrote:

I could use some input from others with more experience.  Having followed the instructions here:

https://stuff.purdon.ca/?page_id=83

I've successfully imported a valid wildcard certificate issued by a proper third-party CA (GeoTrust).  The wildcard cert is now being used for SSL VPN connections.  So far so good.

My question concerns the entirety of the cert's chain ... the Intermediate and the Root signing authority certs.

These have NOT been installed to our Fortigate.  The SSL VPN is working fine.  But we are getting an error when we do a PCI vulnerability scan.  The scan is not recognising the validity of the CA.  Is this because I have not also installed the Intermediate and Root certs to the Fortigate?  Or is it because there's an issue with the Qualys scan system and *it* is at fault.

What have others done when installing third-party CA certs ... install Intermediate and Root certs ... or not?

If installing, do they all go into the Local Certificates store, or ... ?

EDIT:  in the meantime I have flagged the issue as a False Positive and this has been accepted by Qualys ... but I would still be interested to know what others have done when installing 3rd-party CA certs.

You probably figured this out by now, but you need to install all of the certs that come in the bundle from your CA for it to work.  You use Certificates...Import...CA Certificate for the TrustedRoot.crt and VendorNameCA.crt (I bought mine from Digicert).

After the Trusted Root and Intermediate certs are installed, you use Certificates...Import...Local Cert and select the cert issued by your CA based on the CSR you sent them.  Some things to note:

Using and Extended Validation (EV) cert will break firmware 5.2.3.  You can generate the CSR, but when you import the signed cert provided by your CA, it will turn the cert UI white making it unusable.  Upgrading to 5.2.4 fixes this issue, but 5.2.4 has problems with multi-WAN and SSL (based on other forum posts) so be careful if you need that.  I have two brand new 500Ds that I've been testing this with fairly simple configs, and I have confirmed the above regarding EV certs working on .4 but not .3.

If you want to get the best rating from the Qualys test site: https://www.ssllabs.com/ssltest/index.html

you should do the following:

-Consider using a Elliptic Curve instead of RSA keyed cert.  RSA is not aging well and various sources have indicated that properly funded parties are better able to compromise it.  When you generate the cert choose "Elliptic Curve" and "secp256r1" for the key type and curve name. (EC will not work with old browsers.  Make sure you don't have some maniac at home running Windows 2000, if you do tell them to get with the program).

-Consider getting an EV cert so that your users get the nice green URL bar.  I used Digicert for this.  They are great.

- You need to harden your Fortinet to ensure the proper crypto algorithms and services are enabled/disabled:

config system global     set strong-crypto enable end

config vpn ssl settings     set sslv3 disable     set algorithm high end

Again, if you do need to support legacy browser versions for some terrible reason, the above will remove SSLv3 protocol and RC4 cipher and will break compatibility (but you will be more secure).  Both of these are vulnerable to compromise now and anything produced in the last 2 to 3 years will support TLS (which is essentially SSLv4) and ECDHE, so it shouldn't be an issue except for the most extreme cases.  I have not had problems so far with this config.