Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In a PCI environment with an MPLS VPN network setup should you allow store to store communication?

Do you think that an MPLS network would be consider secure enough for this? why or why not?

share|improve this question
welcome to the site! Don't forget, IANAQSA applies to any answer you get here, even if the poster is a QSA: specifically, your QSA will need to approve it. Bottom line: Consult with your QSA. – AviD Jun 7 '11 at 15:53
What Avid said. – Ori Jun 9 '11 at 23:43
up vote 2 down vote accepted

PCI-DSS speaks to the Credit Data Environment. If the entire "store" is all part of the CDE then in compliance terms it doesn't make one bit of difference, all systems in all of those environments are in scope for a QSA auditor to poke at.

That being said, it's probably not a good idea. The more pathways attackers have to bounce around within, the harder it is to define secure channels.

Let me just throw a realistic adversarial scenario out there: A badguy gets on a POS register in Store A, it's an underperforming location that handles a very small number of transactions. Someone in the store connected a third party device to the network outside your control and the attacker managed to transition to the private network. It's low volume and low impact if the attacker pokes around and discovers a weakness in a trust model (Like, the key encryption key "hiding" in a dll in plain sight... yes I'm talking to you PA-DSS compliant folks...) And is able to start gathering a minimal number of credit cards.

They discover that Store B is accessible through the WAN and apply the techniques they were able to pioneer in the low volume store much more effectively the second time around in the store that's processing 100x the number of transactions as the first.

Store B has a much better set of controls, but by leveraging the less maintained systems in Store A the attacker is able to scoot off with all the credit information from both locations. Whereas Store A alone might have led to a compromise of a couple dozen customer records, Store B turned it into a national reporting incident with tourists from 30+ states being compromised.

In other words, if you made it this far and didn't just run away happy with the compliance answer I wouldn't do it unless there was an incredible business need for it. Even though it's "on the MPLS" you're no doubt connecting it to your head end, which in turn is connected to the internet.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.