Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

6.4.2 Is there separation of duties between personnel assigned to the development/test environments and those assigned to the production environment?

What does the separation of duties here mean? Is it in the sense of http://www.sans.edu/research/security-laboratory/article/it-separation-duties or something else? The formulation "between test and production environment" is really confusing me, it looks like they mean that one should have different sysadmins for test and production? Or do they just mean that developers shouldn't have access to production?

share|improve this question

migrated from serverfault.com Mar 22 '12 at 11:55

This question came from our site for professional system and network administrators.

5  
Don't give developers access to the production servers. Sounds like a simple starting point. –  Tom O'Connor Mar 22 '12 at 11:30
1  
may sound simple, but not that simple in practice. Quite commonly, the only people able/capable to really troubleshoot a production issue is your developers. –  Yoav Aner Mar 22 '12 at 13:10

2 Answers 2

up vote 10 down vote accepted

It is, of course, always wisest to accept the judgements of your QSA when making judgement calls, however during your own in-house compliance work I recommend checking out the Navigating PCI-DSS: Understanding the Intent of the Requirements document whenever confused by a requirement.

Looking at page 32 of that document we see the following write up regarding requirement 6.4.2

Reducing the number of personnel with access to the production environment and cardholder data minimizes risk and helps ensure that access is limited to those individuals with a business need to know.

The intent of this requirement is to ensure that development/test functions are separated from production functions. For example, a developer may use an administrator-level account with elevated privileges for use in the development environment, and have a separate account with user-level access to the production environment.

In environments where one individual performs multiple roles (for example application development and implementing updates to production systems), duties should be assigned such that no one individual has end-to-end control of a process without an independent checkpoint. For example, assign responsibility for development, authorization and monitoring to separate individuals.

So, by the strictest reading, then yes. Developers have access to the development system, and may have user role access to production, but a separate individual will actually perform application installs/administration and system administration of the production environment. The real purpose of all this, as discussed in the last paragraph, is that there is no single individual that has end-to-end administrative control of the service. What they want are multiple people with visibility into the process so that no single person can do make changes in development and roll them into production unquestioned.

So, whenever possible, the official advice would be best summed up with a picture.

segregation_of_roles

In serious practice, however, you need to figure out how best to manage that auditing and/or segregation while documenting your processes and eventually getting it properly handled by your QSA.

share|improve this answer
    
In principal, wouldn't this make it impossible to achieve PCI-DSS compliance as a 1 person company? PCI-DSS compliance is a legislation, catch 22 mess! –  Ben Lessani - Sonassi Mar 23 '12 at 0:46
    
thank you, i feel so dumb for not checking the navigating guideline ;) –  Aleksandar Ivanisevic Mar 23 '12 at 13:21

PCI-DSS is an exceptionally broad (and interpretative) set of rules - so this answer is probably best answered by a QSA (for anything other than opinion/heresy).

However, our interpretation is such that the environments have to be separate, but not necessarily on physically separate hardware. Using VPS/virtualisation is a great way to securely partition up a physical server and still maintain PCI compliance without falling under the "a machine for each role" rule.

share|improve this answer
2  
+1, but QSAs, like any auditor, may have varying opinions. One should be able to reasonably interpret the standard. Basically, those who write the code which has protection mechanisms should be separate from those who manage the live data. Similarly in business in general: managers reconcile cashier's registers. Those who cut checks shouldn't be responsible for approving invoices, etc. The idea is to make any kind of theft require more than one person to be complicit. –  Jeff Ferland Mar 22 '12 at 12:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.