3CX & PCI DSS

[abouzaenin]

Hi guys

One of our customers who is workin in a FinTech is asking weather 3CX is compliant with Payment Card Industry Data Security Standards in order to swap theri existing Cisco collaboration system to 3CX in order to use it as PPBX System along with call center and integrate it with their website/Facebook ?

also note that the customer will not use a SIP trunk with any SIP Provider , just PBX will be connected to a voice gatway with FXO as well as implement a new compatiable snom/fanvil IP Phones in the site.


Any one can give me trusted feedback ?

 

[epodworksnet]

Given that they already have Cisco then 3CX is just as good. PCI / HIPAA compliance does not directly apply to software vendors but how organizations store, process, transmit electronically CC and Personally Identifiable Information through it. The key here is policy and procedures to keep these data elements out of chats or voicemail. Cisco vs. 3CX nothing changes about PCI. It is all VoIP. I would go with SNOM if you are worried about hardware supply chain or make sure network is sealed from outside to handsets. Of course, all normal security issues apply with handling firmware.

Once you start integrating 3CX with outside systems; you have Facebook which is not under your control connecting to 3CX -- not a good recipe? Callers leaving messages will generally over share on VoiceMail but that is not a 3CX issue. You need to keep 3CX isolated with VLANs. 3CX has strong permissions and watch out for barge-in and whisper mode.

Also, 3CX V18 should easily support encryption between phone and PBX. If you are doing remote phones, then SBC would be a must as that will encrypt all traffic between remote and PBX but now you have opened the phone system security envelope. If the FinTech is really worried, then separate LAN for PBX and PC could be on the table.

 

[biggreyphone]

My network has PCI scans run every 3 months and there are no issues with 3CX and security issues coming up in the scan.

 

[abouzaenin]

My network has PCI scans run every 3 months and there are no issues with 3CX and security issues coming up in the scan.

hi biggreyphone and thank you for your replay ..

Can you explain to us more about your network , is the 3CX PBX installed with the same servers you are using with your other workloads ? and weather you have a users with soft phone apps who make calls from intenet or the system is just working locally ?
Thank you .

 

[abouzaenin]

Given that they already have Cisco then 3CX is just as good. PCI / HIPAA compliance does not directly apply to software vendors but how organizations store, process, transmit electronically CC and Personally Identifiable Information through it. The key here is policy and procedures to keep these data elements out of chats or voicemail. Cisco vs. 3CX nothing changes about PCI. It is all VoIP. I would go with SNOM if you are worried about hardware supply chain or make sure network is sealed from outside to handsets. Of course, all normal security issues apply with handling firmware.

Once you start integrating 3CX with outside systems; you have Facebook which is not under your control connecting to 3CX -- not a good recipe? Callers leaving messages will generally over share on VoiceMail but that is not a 3CX issue. You need to keep 3CX isolated with VLANs. 3CX has strong permissions and watch out for barge-in and whisper mode.

Also, 3CX V18 should easily support encryption between phone and PBX. If you are doing remote phones, then SBC would be a must as that will encrypt all traffic between remote and PBX but now you have opened the phone system security envelope. If the FinTech is really worried, then separate LAN for PBX and PC could be on the table.

Thank you dear
So the ultimate solution is to make the 3CX PBX and IP Phones in just a different vlan , and for batter security we should offer them to implement 3CX PBX in a separate server or an external Farsouth PBX

 

[epodworksnet]

I am not familiar with Farsouth, I resell Intel NUCs as I am worried about the supply chain, and they work perfect -- small about 4"x4"x2". Decent Core i5 with 8GB of RAM is great and Intel supports Linux for most any small office! If you want to hedge the performance, go with a Core i7 but that will cost you some money. At that price you can get two if they want Poorman's failover.

 

[biggreyphone]

hi biggreyphone and thank you for your replay ..

Can you explain to us more about your network , is the 3CX PBX installed with the same servers you are using with your other workloads ? and weather you have a users with soft phone apps who make calls from intenet or the system is just working locally ?
Thank you .

I am using a 3CX hosted solution with a SBC at my office and do not have to adjust my firewall at all. We are using Poly, Fanvil and soft phone apps through a trunk provider and it works great!

 

[biggreyphone]

If you start needing to open ports, the PCI scan will detect this even if it is secure and you will likely need to reply to their scan with explanation/justification why and how.