PCI service provider and separation

Question

This is connection to my previous question: Shared Database and PCI Compliance

However, this question relates to the requirement "Appendix A: Additional PCI DSS Requirements for Shared Hosting Providers".

If we are a service provider, is there any requirement (or recommendation) to:

• Keep the Shared Database separate per client? i.e. a separate instance of the DB service running on a different port.
• Have separate processes on our service where we decrypt data that may contain CHD? e.g. for our first client we use port 443, for our second client we use port 444, etc.

We do not store or process card data, we only decrypt it, analyse it and then re encrypt it for transmission. The Shared Database contains configuration information for certain parameters for our service, but it is not possible for a client to configure it in such a way that it will affect other clients.

Also, the processes for our service do not run client code. It is our own application. I mention this as the A.1.1 states:

A.1.1 Ensure that each entity only runs processes that have access to that entity’s cardholder data environment.

Although the guidance states:

If a merchant or service provider is allowed to run their own applications on the shared server, these should run with the user ID of the merchant or service provider, rather than as a privileged user

As our applications run only our code (not any code by our clients), how does this affect the interpretation of A.1.1? The definition in the Testing Procedure is:

If a shared hosting provider allows entities (for example, merchants or service providers) to run their own applications, verify these application processes run using the unique ID of the entity.

and my interpretation was that the running code was not a merchant's "own application", however our QSA believes that this requirement applies.

My question comprises of the two closely related questions above (in bold) relating to how much separation is required.

Answer 1

I'm agreeing with AndyMac that you are in fact not a shared hosting provider, you are just offering a platform, so I think your QSA is wrong. So what do you do if you are not sure about his opinion? Then you get a second opinion where you explain your concerns! Ensure that you challenge your QSA first to explain why he believes you are a shared hosting provider even though you aren't running code of your clients but your own.

But remember that PCI-DSS is about implementing a security baseline. Now you can make it yourself really complex and start building complex network segragation and implementing seperate processes etc... In my opionion, what you should do is use a system where you template an OS with your application + seperate database and just deploy one per client in an isolated trust zone. Then you can forward from a dedicated IP on a per port basis or if you run it through a VPN only provide 1-to-1 connectivity for a certain IP address based on the login credentials.

Answer 2

Let's break this down to a logical view of what you state you are doing without getting lost in the weeds on the definition of a service provider, hosting provider, Tier 1, Tier 2, etc.. You state:

"We do not store or process card data, we only decrypt it, analyse it and then re encrypt it for transmission."

While you may not be a PROCESSOR you are putting the data through a process (decrypting, then analyzing, then encrypting). How does this process work. For example, how does data get to you, so you could perform what it is you need to do?

What PCI is primarily looking for is proof that when data is PROCESSED (goes from one place to another, whether or not it is stored) it is done so in a secure fashion. When you mention "we only decrypt it, analyze it" a function (process) is happening somewhere on a system. How does this occur, does data get stored somewhere? The reality is, it would have to. Whether it's in memory, in a temporary file, at some point you need the decrypted output (CC data) in order to analyze it. Even if for a split second, you need to document what occurs, how it occurs, and how this is segmented from possibly being disclosed.