Freigeben über

SQL Server Support for PCI DSS 3.1

  • Artikel

Here is another post from Grant Carter.

 

The Payment Card Industry Data Security Standard (PCI DSS) was created to describe and enforce data standards and processes for the secure processing of payment cards.  PCI DSS provides technical requirements for protecting data used in card payments.  PCI DSS 3.1 is the most recent revision of this industry standard.  The standard for this revision can be located at https://www.pcisecuritystandards.org/documents/PCI\_DSS\_v3-1.pdf

 

TLS or Transport Layer Security (https://en.wikipedia.org/wiki/Transport_Layer_Security) are cryptographic protocols that allow computer communications over a network to remain secure.  As of February 2016, TLS 1.2 is the most recent production use of this protocol and is considered currently the most secure.

 

The PCI DSS 3.1 standard requires that the use of strong cryptography protocols must be used.  SSL and TLS versions 1.0 and 1.1 are not considered strong cryptography and can no longer be used after June 30, 2016 in systems that must meet PCI DSS 3.1 standards.  TLS 1.2 becomes the de facto standard to achieve PCI DSS 3.1 compliance.

 

Microsoft SQL Server supported the TLS 1.0 protocol until the SQL Server 2012 Service Pack 2 Cumulative Update 6 or SQL Server 2014 Service Pack 1 Cumulative Update 1 updates.  Please note there is a known issue in CU1 release of SQL 2014 that is scheduled to be fixed in February 2016.  In January 2016, support for TLS 1.2 was added to SQL Server 2008R2 and SQL Server 2008 via a hotfix documented at https://support.microsoft.com/en-us/kb/3135244.    Support for TLS 1.2 will not be backported to SQL Server 2005, 2008, or 2008R2.

 

The key to making TLS 1.2 work, is that both the server and the client have to be patched to a level that will allow both to communicate using the TLS 1.2 protocol.   If either side of the conversation isn't properly patched, then the communication will fail and connecting and communicating with SQL Server from a client machine will not work.  This article describes how to get TLS 1.2 working with SQL Server, SQL Native Client, and SQL Server Management Studio.

 

TLS 1.2 is supported in the following Operating Systems (https://blogs.msdn.com/b/kaushal/archive/2011/10/02/support-for-ssl-tls-protocols-on-windows.aspx)

  • Windows 7
  • Windows 8
  • Windows 8.1
  • Windows 10
  • Windows Server 2008R2
  • Windows Server 2012
  • Windows Server 2012R2

 

SQL Server Supports TLS 1.2 in the following versions (https://support.microsoft.com/en-us/kb/3052404)

 

SQL Server Native Access Client (SNAC) and SQL Server Management Studio .Net updates are located at:

 

Steps To Get SQL Server Encryption Working:

Follow the steps outlined at https://msdn.microsoft.com/en-us/library/ms191192(v=sql.110).aspx to enable encryption on the SQL Server.

 

Steps to Get TLS 1.2 working with SQL Server

On The Server Side:

Apply one of the following cumulative updates.

  1. SQL Server 2012 Service Pack 2 Cumulative Update 6 or greater -  https://support.microsoft.com/en-us/kb/3052468
  2. SQL Server 2014 Service Pack 1 Cumulative Update 1 or greater - https://support.microsoft.com/en-us/kb/3067839
  3. SQL Server 2014 RTM Cumulative Update 8 or greater - https://support.microsoft.com/en-us/kb/3067836

 

Steps to Disable TLS 1.0, TLS 1.1, SSL 2.0, and SSL 3.0  (Optional Step. Complete to comply with PCI DSS 3.1 most strictly)

The PCI DSS 3.1 standard states that use of all SSL and early TLS protocols must be discontinued by June 30, 2016.   This step will disable those protocols on the Server and ensure that communication to the server must be done using TLS 1.2. 

 

NOTE WELL: Doing this will break communication with all clients that haven’t been patched to support TLS 1.2. Implementing this could cause issues with connectivity with those clients. Please be aware of this before disabling these protocols.

 

Test very thoroughly in a non-production environment before production deployment.  

Please check with any third party driver provider to ensure that their drivers will support the TLS 1.2 standard before implementing.

 

  1. Because making registry changes involves risk, it is important that before making any changes to your registry as outlined in the KBs in the following step, please make sure you back up your registry by following the procedure outlined at https://support.microsoft.com/en-us/kb/322756. 
  2. Follow the following KB articles for instructions on how to disable certain cryptographic algorithms.  https://support.microsoft.com/en-us/kb/245030 or https://support.microsoft.com/en-us/kb/187498
  3. Reboot the server once the registry changes have been made.  All SQL clients that do not have the TLS 1.2 updates will not be able to connect to the server.
  4. If encrypted communications have been enforced on the server, then SQL Server management studio will not work until a .net 4.6 upgrade is deployed to the server.  You will have to stop SQL Server and SQL Agent while you install the framework.  To Make SSMS use TLS 1.2, you need to install .net framework 4.6 on the client
    machine which can be obtained from the following link.  https://www.microsoft.com/en-us/download/details.aspx?id=48130

 

On The Client Side

  1. Patch SQL Native client to one of the following versions:
  2. SQL Server 2012 Service Pack 2 Cumulative Update 6 or greater -  https://support.microsoft.com/en-us/kb/3052468
  3. SQL Server 2014 Service Pack 1 Cumulative Update 1 or greater - https://support.microsoft.com/en-us/kb/3067839
  4. SQL Server 2008R2 SP3 Hotfix (10.50.6537) - https://support.microsoft.com/en-us/hotfix/kbhotfix?kbnum=3098860&kbln=en-us
  5. SQL Server 2008 SP4 (10.00.6543) - https://support.microsoft.com/en-us/hotfix/kbhotfix?kbnum=3098860&kbln=en-us

 

 NOTE: The tools that use the native client or ODBC should use TLS 1.2 once the previous step is completed, however, SQL Server Management Studio (SSMS) will not use TLS 1.2 even if the SQL Native Client is patched.  Network traces will show it still using TLS 1.0.  To Make SSMS use TLS 1.2, you need to install .net framework 4.6 on the client machine which can be obtained from the following link: https://www.microsoft.com/en-us/download/details.aspx?id=48130

 

 

Completely Off Topic:

Obscure Item of History

On December 8, 1941, President Franklin Roosevelt delivered his famous “Infamy” speech in the Capitol Building in Washington.  The Secret Service was concerned about an assassination attempt on his life.  They chose to drive him to the capitol in a 1928 Cadillac 341A Town Sedan originally owned by Al Capone because it had been heavily armored by the gangster.   Source: https://en.wikipedia.org/wiki/Presidential_state_car_%28United_States%29

   
  
  
  
  
Grant Carter is a Senior Premier Field Engineer for Microsoft based in Boise, Idaho.  Grant has been working with SQL Server since SQL Server 2000. 

EMail: Grant.Carter@microsoft.com

Comments