6

My organisation is now using tokenisation and we are no longer storing any credit card information.

I now think I may no longer need some of the following controls:- (there may be others although these are the main ones)
11.1 - Test for the presence of wireless access points and detect unauthorized wireless access points on a quarterly basis.
** No longer needed as Wifi is not allowed in my environment and the tokenisation server is in a DC** 11.2 - Run internal and external network vulnerability scans at least quarterly......
** Looking at reducing my external PCI-DSS scanning costs and to just continue using external vulnerability assessment tools** 11.3 Perform external and internal penetration testing at least once a year.....
I would descope the PCI-DSS systems from the pen-test if required. (Something that I would not do anyway)

What are your thoughts? Can you greatly descope once you are using tokenisation?
- Wireless will not be connected the the card holder data environment. - I will still need controls on the tokenisation system including the ones I mentioned above. - If the tokenisation system is in my DMZ with other servers all that have a routable IP address, will this mean all those systems will fall under the CDE and will still need to be scanned as part of 11.2 and 11.3?

The QSA that works with out company is telling us that everything is still in scope for PCI-DSS. He has recently added our email server into the CDE scope as employees send their personal or corporate credit card numbers via email when they order flowers or flights. Thoughts? The email server issue is something I'll fix via policy.

My friend who is a QSA said yes descope and you may no longer need some controls. What exactly, I'm not sure at this point in time.

PCI says "Tokenization solutions do not eliminate the need to maintain and validate PCI DSS compliance, but they may simplify a merchant’s validation efforts by reducing the number of system components for which PCI DSS requirements apply"

"Tokenization systems and processes must be protected with strong security controls and monitoring to ensure the continued effectiveness of those controls"

https://www.pcisecuritystandards.org/documents/Tokenization_Guidelines_Info_Supplement.pdf

Thanks.

Improve this question
1
  • I would say while some requirements may no longer be required (this seems subjective at best), it's good to maintain them anyway for security of other stuff. There is really not much of a reason not to run basic vulnerability scans for example.
    – ewanm89
    Commented Oct 9, 2012 at 12:36

2 Answers 2

Reset to default
3

Wireless will not be connected the the card holder data environment

Well, that's what the scans are supposed to be determining, isn't it?

If the tokenisation system is in my DMZ with other servers all that have a routable IP address

That doesn't sound like a good idea. Your DMZ is supposed to be a buffer zone between the outside world and your tokenisation system, which should be in a protected internal CDE network on its own.

will this mean all those systems will fall under the CDE and will still need to be scanned as part of 11.2 and 11.3?

If there is no network boundary/control point between two machines, one of which is storing/processing/transmitted cardholder data, then both machines are in the CDE, yes.

we need to consider our email server as employees send credit card numbers out when they order flowers or flights.

Please describe exactly what is happening here because this sounds highly problematic. If credit card numbers are going in the clear over e-mail that's contrary to every intent of PCI (and common sense), and if employees are accessing card numbers to send them from their desktops, you've just brought all your corporate desktops into scope too.

Or are you talking about employees using their own credit cards to buy things, independently of your operations as a merchant? If so that this is not your problem to worry about. (But still - card numbers over e-mail... what?!)

Improve this answer
2
  • Thanks for your reply bobince. Wireless Scanning: Policy states no wifi, network architecture does not include wifi. The system with tokenisation is off-site in a data centre. So I would say for PCI-DSS wifi scan is not needed. A physical inspection would be enough. Internal Email Server: Internal employees are using their personal or corporate credit card to make purchases over email. It has nothing to do with me being a merchant.
    – Teddy
    Commented Oct 9, 2012 at 21:24
  • Then I guess you'd need to do wireless scanning at the datacentre. Does anyone from within your organisation have access to manage the tokenisation servers? If so then the box they use to do so is likely in scope, and if that box is in your office then the network controls around it (including wifi) are again important. Employees acting as consumers with their own credit cards are out of scope of PCI, though if they're sending card numbers to a merchant via e-mail then that merchant is failing their PCI!
    – bobince
    Commented Oct 10, 2012 at 9:46
0

The question you need to ask yourself, "does a clear card number touch my server",

if you are using tokenization, the answer is still probably yes, you are probably in scope because to send any kind of a card authorization you still need to ask the tokenization service for the clear version of the PAN, bringing your servers in scope.

Tokenization allows you to keep DB security, key management etc out of your back, but your servers are still in scope, PANs could still be theoretically found in some unexpected places in your logs etc.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .