Req 2.3 requires encrypting non-console admin access using strong cryptography. Which practice demonstrates compliant non-console admin access?

Req 2.3 requires encrypting non-console admin access using strong cryptography. Which practice demonstrates compliant non-console admin access?

• A. Allow Telnet for admin access
• B. Use HTTP for admin interfaces
• C. Ensure non-console admin access uses strong encryption and disable insecure login methods such as Telnet
• D. Use weak encryption for performance

Answer: (C)

Non-console admin access means remote administrative sessions to systems, not physical keyboard and screen access. PCI DSS Req 2.3 requires that these remote sessions be protected with strong cryptography and that insecure login methods be disabled. The best practice shown is to ensure admin access over encrypted channels using strong cryptography and to disable insecure login methods like Telnet, which transmits credentials in plaintext. This aligns with the need to protect admin credentials and prevent eavesdropping or tampering during remote management. The other options fail because Telnet transmits credentials unencrypted, HTTP for admin interfaces is not encrypted by default, and using weak encryption does not meet the “strong cryptography” requirement. Focusing on performance does not satisfy the security requirement.

Non-console admin access means remote administrative sessions to systems, not physical keyboard and screen access. PCI DSS Req 2.3 requires that these remote sessions be protected with strong cryptography and that insecure login methods be disabled. The best practice shown is to ensure admin access over encrypted channels using strong cryptography and to disable insecure login methods like Telnet, which transmits credentials in plaintext. This aligns with the need to protect admin credentials and prevent eavesdropping or tampering during remote management.

The other options fail because Telnet transmits credentials unencrypted, HTTP for admin interfaces is not encrypted by default, and using weak encryption does not meet the “strong cryptography” requirement. Focusing on performance does not satisfy the security requirement.