Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

My organization is undertaking a project to attempt to reduce the amount of our infrastructure covered under PCI scope. Specifically, we're looking to exclude our web merchandising software from PCI scope.

Of course, to make that happen, we'll have to ensure that the application servers never get cardholder information and that the application servers never "connect to" anything in the CDE.

We've talked to our QSA about it and he's mentioned that a lot of organizations do just that. But dispite much Googling, I can find little further evidence of this, let alone anything about best practices when undertaking such a project.

Is this (even remotely) a suitable way to go about approaching the problem? What should I know when going into a project like this? And, who else has written on the topic and what would I Google for to find more information?

Thanks in advance.

share|improve this question
Welcome to StackExchange. The first part of your question (list of organisations) is not definitively answerable, and is not a good fit for this site, as per the FAQ. If it were the only part, your question would be closed as Not Constructive. However, your second part is interesting and a good fit. Might be best to edit out the first bit. – Polynomial Dec 14 '12 at 21:37
What kind of volume are you dealing with. Would it be easier to use a third party service to handle the PCI for you. Many services exist that will use tokens for transaction management. Basically you ask the card processing system to process a transaction with given details and associate a token code to it. The system then processes the transaction and responds back with the status of the transaction when it succeeds or fails. This can be done either with an external vendor or an internal system. The main security concern then is ensuring that you authenticate the communication. – AJ Henderson Dec 14 '12 at 21:50
Hello, Polynomial. Thanks for your input. I'll edit my post. – user1483512 Dec 14 '12 at 21:55
AJ Henderson. Thanks for your input. Unfortunately our payment gateway won't provide all of the functionality necessary to do something like that, and we probably won't be switching any time soon. Whatever we do, we'll pretty much have to do in-house. – user1483512 Dec 14 '12 at 22:03

1 Answer

up vote 1 down vote accepted

I don't have any specific resources to point to because, for better or worse, the PCI council typically defers to QSAs rather than attempting to cover each scenario that an organization my encounter.

Your QSA is responsible for determining exactly what you need to do in order to properly segment you other applications that you wish to keep out of scope. The segmentation usually requires placing system on different subnets with a firewall in between. The extent to which the data flows between the subnets needs to be restricted between the two networks is a good discussion to have with your QSA.

As a QSA, I don't agree with your statement that your application servers "can't connect to anything in the CDE". My interpretation is that traffic should be severely limited and have a strong business need. The DSS uses a flat network as an example of no segmentation--where there there is no access control between two networks whatsoever. On the other hand, it uses the example of "routers with strong access control lists" as an example of network segmentation.

While inbound traffic will most likely require some input from you QSA, outbound traffic is a little more flexible. If you can structure your network such that connections are initiated from inside of the CDE and out through the firewall, you will have much better security in place and a much easier time justifying the traffic.

Just my thoughts.

share|improve this answer
Thanks for the answer. It's very enlightening. By "can't connect to anything in the CDE", I just meant that it can't fall under the definition of things "connected to the CDE" as mentioned very near the beginning of the section "Scope of Assessment for Compliance with PCI DSS Requirements". Also, we do have in mind to initiate connections from within the CDE and we definitely intend to run our design by our QSA. I do wish we could could find out how other people have done this before diving into it, though. Anyway, many thanks. :) – user1483512 Dec 17 '12 at 15:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.