Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My organisation is now using tokenisation and we are no longer storing any credit card information.

I now think I may no longer need some of the following controls:- (there may be others although these are the main ones)
11.1 - Test for the presence of wireless access points and detect unauthorized wireless access points on a quarterly basis.
** No longer needed as Wifi is not allowed in my environment and the tokenisation server is in a DC** 11.2 - Run internal and external network vulnerability scans at least quarterly......
** Looking at reducing my external PCI-DSS scanning costs and to just continue using external vulnerability assessment tools** 11.3 Perform external and internal penetration testing at least once a year.....
I would descope the PCI-DSS systems from the pen-test if required. (Something that I would not do anyway)

What are your thoughts? Can you greatly descope once you are using tokenisation?
- Wireless will not be connected the the card holder data environment. - I will still need controls on the tokenisation system including the ones I mentioned above. - If the tokenisation system is in my DMZ with other servers all that have a routable IP address, will this mean all those systems will fall under the CDE and will still need to be scanned as part of 11.2 and 11.3?

The QSA that works with out company is telling us that everything is still in scope for PCI-DSS. He has recently added our email server into the CDE scope as employees send their personal or corporate credit card numbers via email when they order flowers or flights. Thoughts? The email server issue is something I'll fix via policy.

My friend who is a QSA said yes descope and you may no longer need some controls. What exactly, I'm not sure at this point in time.

PCI says "Tokenization solutions do not eliminate the need to maintain and validate PCI DSS compliance, but they may simplify a merchant’s validation efforts by reducing the number of system components for which PCI DSS requirements apply"

"Tokenization systems and processes must be protected with strong security controls and monitoring to ensure the continued effectiveness of those controls"

https://www.pcisecuritystandards.org/documents/Tokenization_Guidelines_Info_Supplement.pdf

Thanks.

share|improve this question
    
I would say while some requirements may no longer be required (this seems subjective at best), it's good to maintain them anyway for security of other stuff. There is really not much of a reason not to run basic vulnerability scans for example. –  ewanm89 Oct 9 '12 at 12:36
add comment

1 Answer

Wireless will not be connected the the card holder data environment

Well, that's what the scans are supposed to be determining, isn't it?

If the tokenisation system is in my DMZ with other servers all that have a routable IP address

That doesn't sound like a good idea. Your DMZ is supposed to be a buffer zone between the outside world and your tokenisation system, which should be in a protected internal CDE network on its own.

will this mean all those systems will fall under the CDE and will still need to be scanned as part of 11.2 and 11.3?

If there is no network boundary/control point between two machines, one of which is storing/processing/transmitted cardholder data, then both machines are in the CDE, yes.

we need to consider our email server as employees send credit card numbers out when they order flowers or flights.

Please describe exactly what is happening here because this sounds highly problematic. If credit card numbers are going in the clear over e-mail that's contrary to every intent of PCI (and common sense), and if employees are accessing card numbers to send them from their desktops, you've just brought all your corporate desktops into scope too.

Or are you talking about employees using their own credit cards to buy things, independently of your operations as a merchant? If so that this is not your problem to worry about. (But still - card numbers over e-mail... what?!)

share|improve this answer
    
Thanks for your reply bobince. Wireless Scanning: Policy states no wifi, network architecture does not include wifi. The system with tokenisation is off-site in a data centre. So I would say for PCI-DSS wifi scan is not needed. A physical inspection would be enough. Internal Email Server: Internal employees are using their personal or corporate credit card to make purchases over email. It has nothing to do with me being a merchant. –  Teddy Oct 9 '12 at 21:24
    
Then I guess you'd need to do wireless scanning at the datacentre. Does anyone from within your organisation have access to manage the tokenisation servers? If so then the box they use to do so is likely in scope, and if that box is in your office then the network controls around it (including wifi) are again important. Employees acting as consumers with their own credit cards are out of scope of PCI, though if they're sending card numbers to a merchant via e-mail then that merchant is failing their PCI! –  bobince Oct 10 '12 at 9:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.