Meeting PCI Security Standard with IIS SSL

As a web development manager/network administrator, we've been asked by many of our clients to meet the PCI Security Standard. Since we are an MS shop and use IIS primarily, one common vulnerability is the IIS/SSL protocol not meeting the security standard. According to Microsoft, all SSL protocols and ciphers (including the ones with known vulnerabilities) are all "enabled" by default. Hence, to meet the PCI Security Standard, these vulnerabilities must be addressed. Here's my own quick and dirty list of what must be disabled based on varioius sources for my own use:

1. 322756 (http://support.microsoft.com/kb/322756/) How to back up and restore the registry in Windows

2. Start->Run->Regedt32.

3. Navigate to each of the item in the following list. If the "Enabled" DWORD is not there, you could safely create one by right click on the item, then "New->DWORD" value. Please remember that "0x00000000" means "FALSE" AND "0xffffffff" means "TRUE". For example, setting "Enabled" DWORD value to "0x00000000" means "Disable"; while "0xffffffff" means "Enable" (yeah I myself find it pretty confusing also.)

4. Here's the list of entries in the registry that should be disabled:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]

5. Exit out of Registry Editor and reboot the computer.

(Disclaimer: The information is only based on the compilation of various sources on the Internet. I'm not employed by Microsoft and the information above should not be considered as official information. I will not bear any responsibility for any system crashes/damages/liability as a result of utilizing the above information. Please use at your own risk.)