Not sure if this is best here on information security or serverfault or Network Engineering.
We have a company that takes telephone orders over the telephone using a virtual terminal. PCI-DSS 3.2 says that for this to be allowed:
Merchant accesses the PCI DSS-compliant virtual terminal solution via a computer that is isolated in a single location and is not connected to other locations or systems within the merchant environment;
and then in the questionnaire:
1.2. Do firewall and router configurations restrict connections between untrusted networks and any system in the cardholder data environment as follows: Note: An “untrusted network” is any network that is external to the networks belonging to the entity under review, and/or which is out of the entity’s ability to control or manage.
(a) Is inbound and outbound traffic restricted to that which is necessary for the cardholder data environment? Review firewall and router configuration standards Examine firewall and router configurations
(b) Is all other inbound and outbound traffic specifically denied (for example by using an explicit “deny all” or an implicit deny after allow statement)?
Does this mean that the machine we take the credit card information is inputed on needs to be completely isolated from absolutely everything else on the network in its entirety using firewall or a vlan? This would cause a real issue as they also need to access a central machine for share files for other customer service work as well as an internal SQL server.
Am I reading too much into this, and that access to central resources would in fact be okay - but other non customer service machines would have to be blocked? Thanks in advance