Bounty Ended with 50 reputation awarded by SilverlightFox
2 added 318 characters in body
source | link

I'm agreeing with AndyMac that you are in fact not a shared hosting provider, you are just offering a platform, so I think your QSA is wrong. So what do you do if you are not sure about his opinion? Then you get a second opinion where you explain your concerns! Ensure that you challenge your QSA first to explain why he believes you are a shared hosting provider even though you aren't running code of your clients but your own.

But remember that PCI-DSS is about implementing a security baseline. Now you can make it yourself really complex and start building complex network segragation and implementing seperate processes etc...

  In my opionion, what you should do is use a system where you template an OS with your application + seperate database and just deploy one per client in an isolated trust zone. Then you can forward from a dedicated IP on a per port basis or if you run it through a VPN only provide 1-to-1 connectivity for a certain IP address based on the login credentials.

I'm agreeing with AndyMac that you are in fact not a shared hosting provider, you are just offering a platform. But remember that PCI-DSS is about implementing a security baseline. Now you can make it yourself really complex and start building complex network segragation and implementing seperate processes etc...

  In my opionion, what you should do is use a system where you template an OS with your application + seperate database and just deploy one per client in an isolated trust zone. Then you can forward from a dedicated IP on a per port basis or if you run it through a VPN only provide 1-to-1 connectivity for a certain IP address based on the login credentials.

I'm agreeing with AndyMac that you are in fact not a shared hosting provider, you are just offering a platform, so I think your QSA is wrong. So what do you do if you are not sure about his opinion? Then you get a second opinion where you explain your concerns! Ensure that you challenge your QSA first to explain why he believes you are a shared hosting provider even though you aren't running code of your clients but your own.

But remember that PCI-DSS is about implementing a security baseline. Now you can make it yourself really complex and start building complex network segragation and implementing seperate processes etc... In my opionion, what you should do is use a system where you template an OS with your application + seperate database and just deploy one per client in an isolated trust zone. Then you can forward from a dedicated IP on a per port basis or if you run it through a VPN only provide 1-to-1 connectivity for a certain IP address based on the login credentials.

1
source | link

I'm agreeing with AndyMac that you are in fact not a shared hosting provider, you are just offering a platform. But remember that PCI-DSS is about implementing a security baseline. Now you can make it yourself really complex and start building complex network segragation and implementing seperate processes etc...

In my opionion, what you should do is use a system where you template an OS with your application + seperate database and just deploy one per client in an isolated trust zone. Then you can forward from a dedicated IP on a per port basis or if you run it through a VPN only provide 1-to-1 connectivity for a certain IP address based on the login credentials.