Requirement 2.3 aims to stop attackers getting hold of administrative
or privileged credentials by sniffing them or intercepting them when
they're in transit across a network.
It wants to make sure that all non-console administration
access is protected by strong encryption.
Now, you might be asking yourself what non console-access is.
Oh, gosh, it's going to be easier to define what console access is,
which is a keyboard and a screen physically plugged directly
into the system that you're administrating.
So,
non-console access is anything that doesn't involve a physical keyboard and
screen plugged into the system that's being administered.
I suspect basically all administration access now is non-console access,
and certainly all cloud administration is non-console access.
The requirement is a simple one,
that all traffic between your computer and the one that you're
administering is encrypted using strong cryptography.
Strong cryptography is a special term in PCI DSS.
It's defined in the PCI DSS and PA-DSS Glossary of Terms.
There's a document you can download from the PCI SSC website.
If you download that document, and if you look at the glossary,
you'll find that strong cryptography is defined as anything
that gives at least 112 bits of effective key strength using an
industry standard tested algorithm.
So practically, this means a minimum of 128-bit AES or 2048-bit RSA.
And I know that someone will comment that yes,
you can theoretically use Triple DES, which is 112 bits of key strength,
which you can, but just please don't.
The glossary also points to NIST Special Publication 800-57 for more
information on approved algorithms and key strengths.
To test this requirement,
the QSA is going to ask people to log in remotely to
systems and watch how they do it.
Some particularly conscientious QSAs may even capture
packets from the network to make sure there are no
credentials transmitted in the clear.
The QSA will also check your documentation and speak to the
people responsible for configuring and logging into remote
servers with this non-console access.