Teleflora Point of Sales PA-DSS Implementation Guide
Remote Administration of a Dove POS System
Addresses:
PA-DSS 11.3.b
PA-DSS 13.1
PCI DSS 8.1
PCI DSS 8.2
PCI DSS 8.3
PCI DSS 8.4
PCI DSS 8.5
Teleflora “GoToAssist” Remote Assistance:
In the event that you need remote assistance, Teleflora Customer Service will use the “GoToAssist” system to access your computer. You will find instructions for using “GoToAssist” in the appendix of this document. Be aware of the following requirements and points of note for GoToAssist:
• Teleflora’s GoToAssist system will always be accessed using the URL: http://www.myteleflora.com/gotoassist.aspx
. Never use a different or unknown URL in order to access the GoToAssist home page.
• Teleflora will never solicit remote access requests via email.
• Your GoToAssist sessions will be encrypted using a 128 bit SSL connection. Never attempt to disable, or otherwise override this encryption.
• Do not use the GoToAssist system if your browser indicates the GoToAssist SSL certificate is not trustworthy.
• Never leave an GoToAssist session “open” for Customer service to login at an arbitrary time.
Limit the duration on which your machine may be accessed.
• Be aware that Teleflora will be recording what happens during GoToAssist sessions.
• Teleflora Customer Service cannot access your computer until you explicitly allow such access through the GoToAssist system.
• The Teleflora customer service representative only has the security privileges of the user you are currently logged in as. Thus, if you are logged-in as a non-administrative user, customer service will not have administrative privileges.
For more information on GoToAssist, and how it works, please visit: https://www.gotoassist.com/en_US/corpHIW.tmpl
Dove_POS_PA-DSS_Implementation_Guide_v1.3.doc – 2011-11-11 Page 15
Teleflora Point of Sales PA-DSS Implementation Guide
Other Remote Administration:
In the event that you choose to allow a third party to remotely administrate your Dove POS server and/or network, be aware that, to remain PCI compliant, these third parties must use PCI compliant practices.
Encryption technology, such as SSL, SSH, TLS or VPNs must be employed for any remote administration tasks.
Console access: Non Console access using technologies such as RDP cannot be used on the local network unless the connections are encrypted. Telnet is never allowed.
See PA-DSS 11.3 and PA-DSS 13.1 for more information regarding remote administrant requirements.
Dove_POS_PA-DSS_Implementation_Guide_v1.3.doc – 2011-11-11 Page 16
