Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm currently going through the PCI DSS requirements and wondered whether running different functions on virtual machines on the same server still make me compliant with the requirement below for PCI DSS.
2.2.1 Implement only one primary function per server to prevent functions that require different security levels from co-existing on the same server. (For example, web servers, database servers, and DNS should be implemented on separate servers.)
I have a small feeling the answer might be no.
Short answer yes, but vms add an additional layer of complexity.
Long answer:
A hypervisor creates an additional attack surface. Not only do you have to worry about the traditional risks that exist in a physical environment, but now you have to worry about the hypervisor itself. If it is compromised, all components of the system are therefore compromised. Misconfiguration of the hypervisor could result in a single point of failure / compromise that now affects every VM on it. So, you have to make sure that you (at a minimum) restrict it according to least privilege, "need to know" and make sure your monitor it (but that's another problem because VM monitoring is not as mature as traditional...)
The additional layers of complexity that result from dealing with a VM (especially if you put a virtual firewall in) give you more of an opportunity to make a mistake.
You also have to make sure you setup user accounts correctly. Misconfiguring the VM users and accidentally allowing too many privileges to a given user, (potentially) gives them access to LOTS more than your simple mistake.
Then you have to worry about old VMs that are "off" and unused. Power cycle the box, and forget that it's set to autostart and you've added a machine to the network that isn't being maintained.
Snapshots add another problem. Sure, it's nice to do a snapshot for an update to prevent the update from taking down the whole system, but you have to be careful that you properly manage that so you don't accidentally leave payment card information vulnerable in the snapshot.
Information may also leak between components, so you have to gaurd against that as well.
And, of course, the hypervisor itself is yet another thing that must be updated, maintained, and secured on a regular basis.
So, there is a trade off between the convenience of using a vm box to host your components and the added complexity and tasks required to keep it secure.
So, long conclusion: sure. You can make it PCI compliant. It just takes a little more effort to deal with the complexities.
If you haven't already done so, you need to read the PCI DSS Virtualization Guidelines. That being said, PCI DSS 3.2 section 2.2.1 clearly addresses your concern, right there in the requirements column:
Note: Where virtualization technologies are in use, implement only one primary function per virtual system component.
I would translate that as "VMs are like servers, limit yourself to one function on each."
That being said, there are other concerns with virtualization you need to be aware of, most importantly (from a Compliance point-of-view) Scope. To quote the Virtualization Guidelines document:
A Virtual Machine (VM) is a self-contained operating environment that behaves like a separate computer. It is also known as the "Guest", and runs on top of a hypervisor.
Scope Guidance: An entire VM will be in scope if it stores, processes or transmits cardholder data, or if it connects to or provides an entry point into the CDE. If a VM is in scope, both the underlying host system and the hypervisor would also be considered in scope, as they are directly connected to and have a fundamental impact on the functionality and security of the VM.
