Network setup for PCI-DSS C-VT

Question

Not sure if this is best here on information security or serverfault or Network Engineering.

We have a company that takes telephone orders over the telephone using a virtual terminal. PCI-DSS 3.2 says that for this to be allowed:

Merchant accesses the PCI DSS-compliant virtual terminal solution via a computer that is isolated in a single location and is not connected to other locations or systems within the merchant environment;

and then in the questionnaire:

1.2. Do firewall and router configurations restrict connections between untrusted networks and any system in the cardholder data environment as follows: Note: An “untrusted network” is any network that is external to the networks belonging to the entity under review, and/or which is out of the entity’s ability to control or manage.

(a) Is inbound and outbound traffic restricted to that which is necessary for the cardholder data environment?  Review firewall and router configuration standards  Examine firewall and router configurations

(b) Is all other inbound and outbound traffic specifically denied (for example by using an explicit “deny all” or an implicit deny after allow statement)?

Does this mean that the machine we take the credit card information is inputed on needs to be completely isolated from absolutely everything else on the network in its entirety using firewall or a vlan? This would cause a real issue as they also need to access a central machine for share files for other customer service work as well as an internal SQL server.

Am I reading too much into this, and that access to central resources would in fact be okay - but other non customer service machines would have to be blocked? Thanks in advance

Answer 1

The computer needs to be separated from the rest of the environment using either a host-based firewall or a network firewall with defined rules as outlined in Requirement 1. Here are some things to consider:

• Outbound rules: generally the workstation can initiate outbound connections to your file share or your SQL Server.
• Inbound rules: this is where you are segmenting the workstation, which is your cardholder data environment, from non-CDE systems. You would want very tight inbound rules with a final Deny All rule.
• Connected systems: any machine or device that connects to the workstation will be considered connected systems. Systems such as domain controllers, patching servers, antivirus servers, etc. that provide services to the workstation are generally considered connected systems. Connected systems must be secured to PCI standards because they can provide a path into the CDE. Connected systems should be considered in-scope for an assessment. For more information about connected systems see PCI Scoping Tool.

For more information about workstations as a CDE, see How Does PCI DSS Apply to Individual PCs or Workstations and What is SAQ C-VT. As stated in the "What is SAQ C-VT" FAQ, "merchants using virtual terminal solutions should consult with their acquirer (merchant bank)."