The PCI Security Council recently confirmed that the upcoming update to the PCI DSS guidelines, version 3.1 will include a change pressing companies to switch to TLS web encryption as opposed to the outdated SSL. This is mainly a response to Heartbleed, ShellShock and POODLE, bugs discovered in 2014 which revealed a number of weaknesses in SSL encryption protocol.
E-commerce businesses will need to make sure their web servers are configured to work with TLS and turn off their SSL support. This could start a rush by merchants to implement the surprise update over the next couple of weeks, in time for PCI DSS 3.1 compliance, although payment processors will likely face the greatest compliance challenge.
This unscheduled update to the PCI compliance regulations is highly unusual; usually new versions are issued once every 3 years. This latest change does pose the question, why was this change not incorporated in the in v3.0 of the compliance regulations issued late in 2014? It also raises the possibility that we could see more frequent changes in the current climate as further bugs are expected to be discovered.
Our QA Engineer Ian Muscat has provided some detailed guidance about how to make the change to the TLS encryption protocol.
‘While implementing TLS is a step in the right direction, getting the implementation wrong can provide a false sense of security, and worst still, it can render websites and networks vulnerable to several kinds of attacks.
Most of the common configuration mistakes when implementing TLS lie in the choice of cipher suites. By using old or outdated cipher suites, especially those that suffer from different kinds of attacks, may allow an attackers to gain access or successfully tamper secret data while in transit.’
Disabling SSL 2.0 and SSL 3.0
SSL 2.0 was the first publicly released version of SSL in 1995. This version of SSL contained a number of security issues which lead to the introduction of SSL 3.0. SSL 3.0 was released in 1996 with a complete redesign of the protocol.
Because of the issues presented in SSL2.0, the protocol is unsafe to use and should be completely disabled.
Due to the POODLE (Padding Oracle On Downgraded Legacy. Encryption) vulnerability, SSL 3.0 is also unsafe to use and should be disabled in order to avoid the plaintext of secure connections to be calculated a network attacker. Furthermore, Elliptic Curve Cryptography (discussed later on in this article) cannot be used with SSL3.0.
Internet Explorer 6 is the only remaining browser that still makes use of SSL3.0. Therefore, unless there is still the specific need to support the legacy Internet Explorer 6 browser, SSL 3.0 should be disabled as explained later on. If on the other-hand the support for legacy browsers is required, it is highly recommended to support TLS_FALLBACK_SCSV. This mechanism prevents protocol downgrade attacks on the TLS protocol and thus prevents attackers from inducing browsers to use SSL 3.0.
For full guidance on how to configure TLS for various types of server visit the full article about TLS cipher hardening.
Get the latest content on web security
in your inbox each week.
THE AUTHOR
