Where should perimeter firewalls be installed in relation to wireless networks?

Where should perimeter firewalls be installed in relation to wireless networks?

• A. Between wireless networks and the external Internet only.
• B. On every server in the DMZ.
• C. Between all wireless networks and the cardholder data environment.
• D. Perimeter firewalls are not required for wireless networks.

Answer: (C)

In PCI DSS, any network that contains or can access cardholder data must be isolated from other networks with a security boundary. Wireless networks are treated as untrusted paths into that environment, so the firewall should sit at the boundary between all wireless networks and the cardholder data environment. This forces every connection from wireless devices toward CDE resources to pass through the firewall, where access can be controlled, inspected, and logged, helping prevent direct, uncontrolled access to cardholder data. Other options aren’t sufficient because they don’t guarantee that wireless traffic reaching the CDE is filtered and monitored. Placing a firewall only between wireless networks and the external Internet leaves internal paths from wireless clients to the CDE unprotected. Putting firewalls around DMZ servers doesn’t address the direct boundary between wireless networks and the CDE. Saying no firewall is required ignores the fundamental PCI DSS requirement to separate CDE from less-trusted networks.

In PCI DSS, any network that contains or can access cardholder data must be isolated from other networks with a security boundary. Wireless networks are treated as untrusted paths into that environment, so the firewall should sit at the boundary between all wireless networks and the cardholder data environment. This forces every connection from wireless devices toward CDE resources to pass through the firewall, where access can be controlled, inspected, and logged, helping prevent direct, uncontrolled access to cardholder data.

Other options aren’t sufficient because they don’t guarantee that wireless traffic reaching the CDE is filtered and monitored. Placing a firewall only between wireless networks and the external Internet leaves internal paths from wireless clients to the CDE unprotected. Putting firewalls around DMZ servers doesn’t address the direct boundary between wireless networks and the CDE. Saying no firewall is required ignores the fundamental PCI DSS requirement to separate CDE from less-trusted networks.