SSH (Secure Shell)
PCIComplianceHubLast updated
The encrypted protocol used to administer systems over a network: a remote command line, file transfer, and tunnels for other traffic. It is the usual way 2.2.7's requirement that non-console administrative access be encrypted is met on servers and network devices.
Applies to. Every in-scope system administered over a network. Version 1 of the protocol has known weaknesses and is named in the standard's guidance alongside early TLS as something to retire.
Example. An administrator connects to a payment server over SSH with a key and a second factor. The session is encrypted (2.2.7), authenticated with MFA (8.4.1), and logged (10.2.1.2). The same administrator using Telnet would be sending the password in the clear.
Limits. SSH encrypts the session; it does not decide who may open one. Keys are authentication credentials and fall under Requirement 8 like passwords: unique per person, protected, and revoked on departure. The standard's guidance notes that FTP, which sends credentials in cleartext, can be made secure by running it over SSH, which is the pattern for any insecure service under 2.2.5.