Disabling SSLv3 & early TLS for PCI DSS compliance

PCI Compliance – SSL the time to migrate is now.

For over 20 years Secure Sockets Layer (SSL) has been in the market as one of the most widely-used encryption protocols ever released, and remains in widespread use today despite various security vulnerabilities exposed in the protocol. SSL/early TLS was removed as an example of strong cryptography in PCI DSS v3.1 (April 2015).

SSL v3.0 was superseded in 1999 by TLS v1.0, which has since been superseded by TLS v1.1 and v1.2. Now SSL & early TLS no longer meet minimum security standards due to security vulnerabilities in the protocol for which there are no fixes. It is critically important that entities upgrade to a secure alternative as soon as possible, and disable any fallback to both SSL and early TLS.

PCI Compliance – How should businesses respond.

The best response is to disable SSL entirely and migrate to a more modern encryption protocol, which at the time of publication is a minimum of TLS v1.1, although entities are strongly encouraged to consider TLS v1.2 as not all implementations of TLS v1.1 are considered secure.

PCI Compliance – How do I ensure SSLv3.0 is disabled on my LANCOM router.

SSL v3.0 is already disabled by default in LANCOM routers beginning from LCOS 8.84RU4 and LCOS 9.00RU3 or later, however this is only true for devices that are factory defaulted with this LCOS version. For devices that have been running with prior versions of LCOS SSL v3.0 is likely still enabled and resellers have two options to remedy.

If the router has a minimal configuration, upgrade the router to at least LCOS 8.84RU4 or 9.00RU3 (we recommend latest LCOS 10.12RU2 if router is capable), then factory default the router and configure from scratch.
If the router has an extensive configuration we again recommend to update to the latest firmware possible and then apply the appropriate script found on LANCOM knowledge-base here.

PCI Compliance – Will disabling SSLv3.0 mean LANCOM routers pass PCI DSS compliance scans?

Yes but PCI DSS compliance scans from Approved Scanning Vendors check more than just SSLv3. After June 30, 2018, all entities MUST have stopped use of SSL & early TLS as a security control, and use only secure versions of the protocol. Failure to comply with this instruction will impact ASV scan results and will ultimately negatively impact on PCI compliance. A document on the PCI DSS requirements regarding SSL & early TLS can be read here.

For the convenience of LANCOM resellers looking to future proof their customer’s SSL/TLS settings, as well as pass PCI DSS testing now and into the future, we have formulated a script that will disable every instance of SSL v3.0, TLS v1.0 and TLS v1.1 leaving only the latest TLS v1.2 enabled. This script also locks down other security algorithm settings to ensure LANCOM routers will pass PCI DSS compliance scans.

Note this script requires LCOS 10.x or greater and carries out the following actions.

Disables SSLv3.0,
Disables TLSv1.0
Disables TLSv1.1
Disables RC4-40, 56, & 128 Crypto-Algorithms
Disables DES, DES40 & 3DES Crypto-Algorithms
Disables 3des-cbc & 3des-ctr Cipher Algorithms
Disables Arcfour, Arcfour 128 & Arcfour 256 Cipher Algorithms
Disables Blowfish-cbc & Blowfish ctr Cipher Algorithms
Disables hmac-md5 & hmac sha1 MAC Algorithms
Disables DH Group 1 & 14 Key Exchange Algorithms
Disables Diffie Hellman Groups 1 & 5
Disables *ALL WAN remote access except for SSH

*Note HTTPS WAN remote access can be enabled if a valid SSL certificate from a trusted Certificate Authority is loaded into the router. Even with HTTPS disabled you can still fully manage a LANCOM router over SSH Port 22 using the latest version of LANconfig and the CLI.

LANCOM PCI-DSS Script

With special thanks to Gabriel McEvoy of Sysnet Global Solutions for his help & patience testing this script.

Disabling SSLv3 & early TLS for PCI DSS compliance