Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I support the IT infrastructure for a small retail business which is now required to undergo a PCI-DSS assessment. The payment service and terminal provider (Streamline) has asked that we use Trustwave to do the PCI-DSS certification.

The problem I face is that if I answer all questions and follow Trustwave's requirements to the letter, we will have to invest significantly in networking equipment to segment LANs and /or do internal vulnerability scanning, while at the same time Streamline assures me that the terminals we have (Verifone VX670-B and MagIC3 X-8) are secure, don't store any credit card information and are PCI-DSS compliant so by implication we don't need to take any action to ensure their network security.

I'm looking for any suggestions as to how we can most easily meet the networking requirements for PCI-DSS.

Some background on our current network setup:

  • single wired LAN, also with WiFi turned on (though if this creates any PCI-DSS complexities we can turn it off).
  • single Netgear ADSL router. This is the only firewall we have in place, and the firewall is out the box configuration (i.e. no DMZ, SNMP etc). Passwords have been changed though :-)
  • a few windows PCs and 2 windows based tills, none of which ever see any credit card information at all.
  • two swipe terminals. Until a few months ago (before we were told we had to be PCI-DSS certified) these terminals did auth/capture over the phone. Streamline suggested we moved to their IP Broadband service, which instead uses an SSL encrypted channel over the internet to do auth/capture, so we now use that service.

We don't do any ecommerce or receive payments over the internet. All transactions are either cardholder present, or MOTO with details given over phone and typed direct into terminal. We're based in the UK.

As I currently understand it we have three options in order to get PCI-DSS certification.

  1. segment our network so the POS terminals are isolated from all PCs, and set up internal vulnerability scanning on that network.
  2. don't segment the network, and have to do more internal scanning and have more onerous management of PCs than I think we need (for example, though the tills are Windows based, they are fully managed so I have no control over software update policies, anti virus etc). All PCs have anti virus (MSE) and windows updates automatically applied, but we don't have any centralised
  3. go back to auth/capture over phone lines.

I can't imagine we are the first merchant to be in this situation. I'm looking for any recommendations a simple, cost effective way to be PCI-DSS compliant - either by doing 1 or 2 above with (hopefully) simple and inexpensive equipment/software, or any other ways if there's a better way to do this. Or... should we just go back to the digital stone age and do auth/capture over the phone, which means we don't need to do anything on our network to be PCI-DSS certified?

share|improve this question

migrated from serverfault.com Sep 28 '12 at 15:30

This question came from our site for system and network administrators.

    
All this sounds to me very strange. You say that the StreamLine is a payment service and terminal provider. So, this means that they had to pass PCI-DSS certification of all solutions they are providing. If we will take their words as truth then any single store that has a PoS installed has to pass PCI-DSS compliance certification regardless of the fact that acquirer or service provider passed the PCI-DSS? This would kill the card business –  Serge Sep 28 '12 at 15:18
1  
Yes, @Serge, merchants have to pass PCI-DSS; using a solution from a certified payments provider is not sufficient. That being said, a merchant with low volume usually doesn't have to do anything but fill out a form and sign it, which is not onerous, so it hasn't killed the card business. –  gowenfawr Sep 28 '12 at 18:13
    
Move your swipe terminals to a separate network (can be logically segmented) compliance at that point since you're on a single purpose system/single purpose network with a PCI L1 provider doing the processing should make you eligible for the shortened self-assessment: pcisecuritystandards.org/documents/pci_saq_a_v2.doc it's the place to look anyway (the site/docs) –  iivel Sep 28 '12 at 18:18
    
@Serge - as gowenfawr says that the equipment/solution is certified is not sufficient. Indeed there are numerous non IT requirements for us to get certification also (e.g. how we handle printed receipts), but that's all in hand. –  rowatt Oct 1 '12 at 8:26
    
@iivel - yes, that is one option and not a bad one... except that as I currently understand it from trustwave, if we segment the network then we automatically become a 'complex network environment' and still have to do scanning to verify that the PoS network doesn't have anything bad on it. –  rowatt Oct 1 '12 at 8:28

3 Answers 3

Have you talked to an auditor yet? You likely don't have to do anything except answer a survey. Once you certify that you don't accept anything other than card swipes and you don't store card numbers anywhere, then your audit is complete.

All that other stuff is required when the business keeps credit cards stored somewhere.

share|improve this answer
1  
card data storage is not required to put a business within PCI scope; transmission of card data is sufficient. –  gowenfawr Sep 28 '12 at 18:08
    
and we do store card data, just not electronically - it's on the printed receipts. –  rowatt Oct 1 '12 at 8:51

I am not an auditor, and no one but an auditor can give you valid answers. That said, the PCI Data Security Standard is reasonably direct on these matters:

The cardholder data environment is comprised of people, processes and technology that store, process or transmit cardholder data or sensitive authentication data.

Therefore, storage of card data is not required to put you in scope; transmission is sufficient. Your terminals will be transmitting cardholder data, and so are "in scope" for PCI requirements.

Network segmentation of, or isolating (segmenting), the cardholder data environment from the remainder of an entity’s network is not a PCI DSS requirement. However, it is strongly recommended as a method that may reduce:

  • The scope of the PCI DSS assessment
  • The cost of the PCI DSS assessment
  • The cost and difficulty of implementing and maintaining PCI DSS controls
  • The risk to an organization (reduced by consolidating cardholder data into fewer, more controlled locations)

In other words, any system connected to the network with processing terminals on it is "in scope", and will have to be scanned and audited as well. You only have to segment it if you don't want to attest that it's up to PCI security snuff every year! (That being said, it's probably cheaper and easier for you to segment it than to subject everything on your network to PCI requirements).

The PCI DSS Self-Assessment Questionnaire outlines the different types of businesses and what their broad requirements are. Based on your description, you're SAQ "C", outlined on page 11. I've quoted part of it below and highlighted the bullet stating that, yes, they want you to segment your network:

SAQ C merchants validate compliance by completing SAQ C and the associated Attestation of Compliance, confirming that:

  • Your company has a payment application system and an Internet connection on the same device and/or same local area network (LAN);
  • The payment application system/Internet device is not connected to any other systems within your environment (this can be achieved via network segmentation to isolate payment application system/Internet device from all other systems);
  • Your company store is not connected to other store locations, and any LAN is for a single store only;
  • Your company retains only paper reports or paper copies of receipts;
  • Your company does not store cardholder data in electronic format; and
  • Your company’s payment application software vendor uses secure techniques to provide remote support to your payment application system.

The good news is:

  1. At the low-volume merchant level, you're pretty much only required to fill out a form and sign it saying that you're compliant, so you don't have the expensive audit to deal with.
  2. There are many PCI rules which seem silly. This is not one of them. Network segmentation, or lack thereof, has been repeatedly shown to be a significant factor in card data breaches.
  3. If the shop is that small, then this is not expensive to fix. Buy a SOHO firewall with a integrated 4-port switch, make sure it has wireless turned off, connect your two terminals to it and then connect the WAN interface to your LAN. You're done for less than $100.
share|improve this answer
    
I do not agree with you. As rowatt said that the card acceptance is supposed to be done with the SP supplied hardware payment terminals only. So his case is the P2PE-HW. Am I correct? Though, +1 for the answer –  Serge Sep 28 '12 at 19:05
    
@Serge, I assumed this was not P2PE-HW case because in that case I would have expected the provider to have sold that fact loudly enough that the question wouldn't come up. As with all assumptions, it's probably foolish, and thanks for pointing it out! If that is the case, original poster just needs to look at and satisfy their "P2PE Instruction Manual"... which has a non-zero chance of requiring or recommending network segmentation :) –  gowenfawr Sep 28 '12 at 19:14
    
Yes, I agree on network segmentation - I would make one even if it is not required as the cost is really nothing compare to the risks. My concern is that the SP asks OP to pass a certification just because SP want to save money and get certified with this occasion. –  Serge Sep 28 '12 at 19:22
    
@gowenfawr - thank you for a very comprehensive answer. I don't disagree with the benefits of segmentation, but from what I have been told by Trustwave, I believe we still have to have equip to scan that network and verify that it is free of other devices. I'll ask again. I also find it rather strange that Streamline suggested we moved to their IP solution without so much of a mention of possible security implications (so I assume it's secure), and only a few months after we've implemented they make us go through this. We could have just stuck with telephone line based terminals :-~ –  rowatt Oct 1 '12 at 8:33
    
@rowatt, I did not provide you any answer. I used to work in this industry for 7 years, but 5 years ago. I just was surprised with what you said in your post and this is really attracted my attention –  Serge Oct 1 '12 at 8:38

I'm concerned about your MOTO transactions. When you say they are done on a terminal, you mean the vendor (Verifone VX670-B and MagIC3 X-8) terminals, right? If so, that is good.

Do your systems allow for any mapping of card transaction info onto any consumer data you may keep, for instance a credit card authorization transaction number onto a customer name and email that you keep in your database? If so, you have an exposure that the PCI folks will want to examine. One customer of mine in the past had properly secure systems, but their mailchimp (offsite mass email) account got hacked and all the customers got an email saying their card info had been compromised when in fact all data was still safe and secure. But PCI addresses this anyway because above and beyond anything else, PCI exists to protect the collective Payment Card Industry (PCI) reputation.

I'd put Splunk on your till PCs to consolidate your Win error, system, SQL transaction, firewall, and AV logs, then review that integrated log resource regularly (you attest in your PCI questionnaire that you do this). Reviewing the logs, especially the TSQL and Win system logs (installation of new sfwr, etc) is especially valuable in revealing vulnerabilities, and certifying that no exploitable vulnerabilities exist. If you are not consolidating and examining these logs, you have no reasonable basis to assert otherwise.

Better to do it now and have it done, than to have forensic auditors 'suggest' it to you.

share|improve this answer
    
We don't store any card holder data electronically. For MOTO transactions we just type directly into the terminal. +1 though for suggesting splunk, a good idea quite aside from PCI compliance. –  rowatt Oct 1 '12 at 8:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.