BBPS and Pre TLS 1.2 versions

Jim Freer:

As TLS 1.2 becomes the standard and part of RE 7.96, is there a time table to stop communicating with earlier versions of TLS?


t

 

JP Provencal:

 

Jarod Bonino:

Jim Freer:

As TLS 1.2 becomes the standard and part of RE 7.96, is there a time table to stop communicating with earlier versions of TLS?


t

 

Hey Jim,


The PCI Security Standards Council has set a deadline of June 30, 2018 for all payment processors to stop support for processing payments being submitted using vulnerable encryption protocols (SSL and TLS 1.0).

https://blog.pcisecuritystandards.org/migrating-from-ssl-and-early-tls


Blackbaud payment services will need to pick a date that is equal to or earlier than that date to stop supporting these vulnerable encryption protocols. A date has not yet been set and will largely be driven by our payment processing team. I can assure you this will not be an overnight change and will be preceded with an announcement that will be made well before the change is made. 


In the meantime, however, I would recommend maing plans to upgrade to a recent version of Rasier's Edge that supports advanced TLS encryption protocols to ensure that the announcement (when it does occur) is a non-event for you and your organzation.


This, of course, is assuming you are self-hosted. If you are a hosted Blackbaud customer, this should not be a concern for you as we have already made the environment changes necessary to ensure that payment processing is being done a way that is as secure as currently possible and future proof.


Thanks,

Jarod

 

Hi Jarod,


So is it going to be .Net Framework 4.6 that resovles the TLS issues, or it is additional coding found within RE7.96?  In other words, if a client were to upgrade the affected workstations/servers with .Net 4.6 could they conceivably continue to use RE 7.93 or 7.95?  Are there compatibility issues between older viersions of RE and the new .Net 4.6?


Cheers,

JP

 

Jim,


I did my best to address this in the webinar content, but I know it's a complicated topic. I'll try to state it as plainly as possible below:


Blackbaud added support for TLS 1.2 encryption in Patch 1 of 7.95. If you are running RE 7.95 patch 1 or later AND you ensure that you have .NET framework 4.6+ installed on your RE server and all workstations, 7.96 won't introduce anything new (in terms of payment processing encryption) and you can be confident that your payment processing is "future proof" for any upcoming payment processing changes for PCI compliance.


If you have an earlier version of The Raiser's Edge installed, however, (7.93 for example) having .NET Framework 4.6 or later intsalled will not change the fact that payment processing done through RE will be using the SSL and/or TLS 1.0 encryption protocols (which are the ones that have been deemed "vulnerable" by the PCI Security Standards Council).


So to answer your question, it's the combination of changes made in RE 7.95, RE 7.95, Patch 1, and .NET framework 4.6 or later that collectively serve as the answer to this problem. We wanted to make it is simple as possible to wrap all that up and simplify it for our self-hosted customers, which is where 7.96 comes in. With 7.96 we will be including .NET Framework 4.6 as a pre-req installation and will fail the RE install if the pre-req is not satisfied. So ultimately, as long as you are able to install RE 7.96 on your server and workstations, you can be sure that your payment processing is as secure and future proof as possible.


I hope this helps!


Thanks,

Jarod

JP Provencal:

Jarod Bonino:

JP Provencal:

 

Jarod Bonino:

Jim Freer:

As TLS 1.2 becomes the standard and part of RE 7.96, is there a time table to stop communicating with earlier versions of TLS?


t

 

Hey Jim,


The PCI Security Standards Council has set a deadline of June 30, 2018 for all payment processors to stop support for processing payments being submitted using vulnerable encryption protocols (SSL and TLS 1.0).

https://blog.pcisecuritystandards.org/migrating-from-ssl-and-early-tls


Blackbaud payment services will need to pick a date that is equal to or earlier than that date to stop supporting these vulnerable encryption protocols. A date has not yet been set and will largely be driven by our payment processing team. I can assure you this will not be an overnight change and will be preceded with an announcement that will be made well before the change is made. 


In the meantime, however, I would recommend maing plans to upgrade to a recent version of Rasier's Edge that supports advanced TLS encryption protocols to ensure that the announcement (when it does occur) is a non-event for you and your organzation.


This, of course, is assuming you are self-hosted. If you are a hosted Blackbaud customer, this should not be a concern for you as we have already made the environment changes necessary to ensure that payment processing is being done a way that is as secure as currently possible and future proof.


Thanks,

Jarod

 

Hi Jarod,


So is it going to be .Net Framework 4.6 that resovles the TLS issues, or it is additional coding found within RE7.96?  In other words, if a client were to upgrade the affected workstations/servers with .Net 4.6 could they conceivably continue to use RE 7.93 or 7.95?  Are there compatibility issues between older viersions of RE and the new .Net 4.6?


Cheers,

JP

 

Jim,


I did my best to address this in the webinar content, but I know it's a complicated topic. I'll try to state it as plainly as possible below:


Blackbaud added support for TLS 1.2 encryption in Patch 1 of 7.95. If you are running RE 7.95 patch 1 or later AND you ensure that you have .NET framework 4.6+ installed on your RE server and all workstations, 7.96 won't introduce anything new (in terms of payment processing encryption) and you can be confident that your payment processing is "future proof" for any upcoming payment processing changes for PCI compliance.


If you have an earlier version of The Raiser's Edge installed, however, (7.93 for example) having .NET Framework 4.6 or later intsalled will not change the fact that payment processing done through RE will be using the SSL and/or TLS 1.0 encryption protocols (which are the ones that have been deemed "vulnerable" by the PCI Security Standards Council).


So to answer your question, it's the combination of changes made in RE 7.95, RE 7.95, Patch 1, and .NET framework 4.6 or later that collectively serve as the answer to this problem. We wanted to make it is simple as possible to wrap all that up and simplify it for our self-hosted customers, which is where 7.96 comes in. With 7.96 we will be including .NET Framework 4.6 as a pre-req installation and will fail the RE install if the pre-req is not satisfied. So ultimately, as long as you are able to install RE 7.96 on your server and workstations, you can be sure that your payment processing is as secure and future proof as possible.


I hope this helps!


Thanks,

Jarod

 

Thanks for all the details Jarod, I appreciate it.


As a follow-up question, what would be the minimum version of ancilliary Blackbaud software like NetCommunity, Finaical Edge ect. that would be reqruied to meet the TLS 1.2 protocols?


Cheers,

JP