4 ms·
I've had to deal with both HIPAA and PCI-DSS and in both cases if the sensitive data is all stored within the web app, and the authentication to the web app is
by clinta 11y ago
I've had to deal with both HIPAA and PCI-DSS and in both cases if the sensitive data is all stored within the web app, and the authentication to the web app is good and communication to the web app is encrypted, you do not have to secure the endpoint. Both of those are about securing the sensitive data, and keeping sensitive data off the endpoint is a perfectly valid method of doing so.
- dogma1138 11y agoI don't know what you had to deal with regarding PCI or HIPAA but if the endpoint is in scope you have whole chapters about how you should "secure" it, same goes for remote access (VPN, Jump boxes etc.). If the endpoint was in scope I would like to see the QSA that signed an AOC/ROC which stated that the endpoints weren't secured...
- clinta 11y agoThe endpoints don't need to be in scope if they're not storing PII.
- dogma1138 11y agoPCI-DSS the endpoints you use to connect to the CHD environment are in scope, other endpoints that are used to interact with CHD data e.g. POI's or CS terminals are also in scope. HIPAA endpoints that are used to access, view or input patient data are in scope. I am a QSA.
- Spooky23 11y agoYou received bad advice.