<div dir="ltr"><div>Hi Group, </div><div>thanks! </div><div>I think TLS 1.2 is pretty tricky and since it is not compulsory now then I will avoid it. TLS 1.1 seems good enough for now. </div><div><br></div><div>The main problem will revolve around enable voice encryption on existing cluster. This will be quite a major effort. If this is deem necessary, I will get customer to create a standalone cluster just for UCCX else potentially it will cost them more $$ to enable end to end encryption on all existing sites. </div><div><br></div><div>The PCI compliance consultant they have hired, recommended them to go digital phones or analogue phones which is kind of weird. </div><div><br></div><div>Regards,</div><div>Ki Wi <br></div></div><br><div class="gmail_quote"><div class="gmail_attr" dir="ltr">On Tue, Jan 22, 2019 at 11:56 PM Ryan Ratliff (rratliff) <<a href="mailto:rratliff@cisco.com">rratliff@cisco.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid">
<div style="-ms-word-wrap: break-word;">
BRKCOL-2009 is a good Cisco Live session entirely dedicated to the impact of PCI requirements on collab (TLS 1.2 particularly).
<div><br>
</div>
<div>
<blockquote type="cite">Transport Layer Security (TLS) 1.0 is being deprecated and may not provide the level of security required by an organization anymore. The Payment Card Industry Data Security Standard (PCI DSS) is for example requiring vendors
to use newer versions of TLS for encrypted communications. This session will discuss the support of TLS 1.2 in the Cisco On-Premises Collaboration products. It will also cover the ability to disable TLS 1.0 and/or TLS 1.1, the interfaces that are affected
by this, and the implications on the Cisco Collaboration solution. Finally, it will discuss limitations when older phones are still used in a environment where TLS 1.0 has been disabled.</blockquote>
<br>
<div>
<div style="color:rgb(0,0,0);text-transform:none;line-height:normal;text-indent:0px;letter-spacing:normal;font-family:"Lucida Grande";font-style:normal;font-weight:normal;word-spacing:0px;white-space:normal">
- Ryan Ratliff</div>
</div>
<div><br>
<blockquote type="cite">
<div>On Jan 22, 2019, at 8:18 AM, Lamont, Joshua <<a href="mailto:joshua_lamont@brown.edu" target="_blank">joshua_lamont@brown.edu</a>> wrote:</div>
<br class="gmail-m_5457366164701177350Apple-interchange-newline">
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">The complete guide is located here: <a href="https://www.pcisecuritystandards.org/documents/Protecting_Telephone_Based_Payment_Card_Data_v3-0_nov_2018.pdf" target="_blank">https://www.pcisecuritystandards.org/documents/Protecting_Telephone_Based_Payment_Card_Data_v3-0_nov_2018.pdf</a></div>
<div dir="ltr"><br>
</div>
<div>This was updated in November for the first time in seven years. If you are a business accepting credit cards this is definitely something you should read through. </div>
<div><br>
</div>
<div dir="ltr">
<div>
<div class="gmail-m_5457366164701177350gmail_signature" dir="ltr">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div dir="ltr"><font color="#444444" face="arial, helvetica, sans-serif">Joshua Lamont</font>
<div><font color="#444444" face="arial, helvetica, sans-serif">Senior Telecommunications Engineer</font></div>
<div><font color="#444444" face="arial, helvetica, sans-serif">Brown University</font></div>
<div><font color="#444444" face="arial, helvetica, sans-serif">office (401) 863-1003</font></div>
<div><font color="#444444" face="arial, helvetica, sans-serif">cell (401) 749-6913</font></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
<input name="virtru-metadata" type="hidden" value="{"email-policy":{"state":"closed","expirationUnit":"days","disableCopyPaste":false,"disablePrint":false,"disableForwarding":false,"enableNoauth":false,"expires":false,"isManaged":false},"attachments":{},"compose-id":"3","compose-window":{"secure":false}}"></div>
</div>
<br>
<div class="gmail_quote">
<div class="gmail-m_5457366164701177350gmail_attr" dir="ltr">On Tue, Jan 22, 2019 at 7:36 AM Ryan Huff <<a href="mailto:ryanhuff@outlook.com" target="_blank">ryanhuff@outlook.com</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid">
At a high level I’d think you’ll need to look into SRTP (aka voice encryption) enabled system-wide, no call recording (which you can’t do with SRTP anyway) and possibly no call monitoring too (at least on the PII calls).<br>
<br>
Then adhere to all the physical access rules for servers that store or transmit PII (personally identifiable information).<br>
<br>
You may need to research database storage requirements as it relates to PCI. I’m assuming the UCCX environment is what will be dealing with the PII; while UCCX doesn’t have the capacity to outright store CC info, it may be possible that some of that info is
captured in logs, depending on how your environment is set up.<br>
<br>
You’d have to do a lot of dry runs in the UCCX environment and run all the calling scenarios that interact with PII to ensure traces of it do not get logged.<br>
<br>
Obviously nothing can be done to the UCCX database outside of what Cisco supports, like encrypt table values that aren’t encrypted.. etc<br>
<br>
Sent from my iPhone<br>
<br>
> On Jan 22, 2019, at 01:23, Ki Wi <<a href="mailto:kiwi.voice@gmail.com" target="_blank">kiwi.voice@gmail.com</a>> wrote:<br>
> <br>
> Hi Group,<br>
> I have a customer who is querying on how can we make their existing Cisco IPT (with UCCX) PCI DSS compliance since the new upcoming site we are planning to deploy will handle sensitive data such as credit cards information.<br>
> <br>
> Any folks out there have experience doing this?<br>
> <br>
> Do we need voice encryption? Turn on TLS v1.1 ? etc? <br>
> <br>
> -- <br>
> Regards,<br>
> Ki Wi<br>
> _______________________________________________<br>
> cisco-voip mailing list<br>
> <a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
> <a href="https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpuck.nether.net%2Fmailman%2Flistinfo%2Fcisco-voip&data=02%7C01%7C%7Cb9218ac35b024bba75db08d680321fbe%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636837350098382558&sdata=%2Fb%2BfDpOqy2BHdBZ%2F%2F%2B%2BYB7FyBrE4lznDiRI1dlwChC4%3D&reserved=0" target="_blank" rel="noreferrer">
https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpuck.nether.net%2Fmailman%2Flistinfo%2Fcisco-voip&data=02%7C01%7C%7Cb9218ac35b024bba75db08d680321fbe%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636837350098382558&sdata=%2Fb%2BfDpOqy2BHdBZ%2F%2F%2B%2BYB7FyBrE4lznDiRI1dlwChC4%3D&reserved=0</a><br>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank" rel="noreferrer">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
</blockquote>
</div>
</div>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</blockquote></div><br clear="all"><br>-- <br><div class="gmail_signature" dir="ltr"><div dir="ltr"><div>Regards,</div><div>Ki Wi</div></div></div>