Skip to main content

💼 1.3 Prohibit direct public access between the Internet and any system component in the cardholder data environment.

  • ID: /frameworks/pci-dss-v3.2.1/01/03

Description​

Empty...

Similar​

  • Sections
    • /frameworks/pci-dss-v4.0/01/04/01
  • Internal
    • ID: dec-c-bc1717aa

Similar Sections (Take Policies From)​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 PCI DSS v4.0 → 💼 1.4.1 NSCs are implemented between trusted and untrusted networks.719no data

Similar Sections (Give Policies To)​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 PCI DSS v4.0 → 💼 1.4.1 NSCs are implemented between trusted and untrusted networks.719no data

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 1.3.1 Implement a DMZ to limit inbound traffic to only system components that provide authorized publicly accessible services, protocols, and ports.620no data
💼 1.3.2 Limit inbound Internet traffic to IP addresses within the DMZ.20no data
💼 1.3.3 Implement anti-spoofing measures to detect and block forged source IP addresses from entering the network.no data
💼 1.3.4 Do not allow unauthorized outbound traffic from the cardholder data environment to the Internet.7no data
💼 1.3.5 Permit only “established” connections into the network.20no data
💼 1.3.6 Place system components that store cardholder data in an internal network zone, segregated from the DMZ and other untrusted networks.6no data
💼 1.3.7 Do not disclose private IP addresses and routing information to unauthorized parties.1no data

Policies (19)​

PolicyLogic CountFlagsCompliance
🛡️ AWS DMS Replication Instance is publicly accessible🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted CIFS traffic🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted traffic to MongoDB🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted traffic to Oracle DBMS🟢1🟢 x6no data
🛡️ AWS RDS Instance is publicly accessible and in an unrestricted public subnet🟢1🟢 x6no data
🛡️ AWS RDS Snapshot is publicly accessible🟢1🟢 x6no data
🛡️ AWS S3 Bucket is not configured to block public access🟢1🟢 x6no data
🛡️ Azure Cosmos DB Account Private Endpoints are not used🟢1🟢 x6no data
🛡️ Azure Cosmos DB Account Virtual Network Filter is not enabled🟢1🟢 x6no data
🛡️ Azure Cosmos DB Entra ID Client Authentication is not used🟢⚪🟢 x2, ⚪ x1no data
🛡️ Azure Network Security Group allows public access to HTTP(S) ports🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to RDP port🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to SSH port🟢1🟢 x6no data
🛡️ Azure SQL Database allows ingress from 0.0.0.0/0 (ANY IP)🟢1🟢 x6no data
🛡️ Azure Storage Account Allow Blob Anonymous Access is enabled🟢1🟢 x6no data
🛡️ Google GCE Instance IP Forwarding is not disabled.🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted SSH traffic🟢1🟢 x6no data
🛡️ Google GKE Cluster Network policy is disabled.🟢1🟢 x6no data
🛡️ Google GKE Cluster Private Google Access is not enabled.🟢1🟢 x6no data

Internal Rules​

RulePoliciesFlags
✉️ dec-x-4c15a09f1
✉️ dec-x-46a83a301
✉️ dec-x-599c86b41
✉️ dec-x-083928f51
✉️ dec-x-b4d3d9dc2
✉️ dec-x-b33429051
✉️ dec-x-ec547a7c1
✉️ dec-x-f937c35f1