Assume a cardholder data environment (CHDE) is segregated appropriately, data in the environment is encrypted at rest and in transmission. We have a backup service that sits outside the CHDE. If we create an ACL to allow the backup service to run backups in the CHDE, this would potentially allow an admin to bypass multi factor authentication into the environment, by using the same ACL from the backup server/service. Am i right in thinking the only way to do this is to create a service inside the CHDE to run the backups, then push those files out of the CHDE to a remote storage???

  • It may depend on what the backup service is. If you're using something-over-ssh, then there's concern an administrator could use it for regular ssh and avoid normal controls. But if you're using a backup agent with a proprietary protocol over a weird port, that's not as much of an issue. – gowenfawr Oct 3 '18 at 15:25
  • With PCI - always check with your QSA assessing you as interpretations may vary. You may want to consider something which encrypts the data in the CHDE and then pushes the encrypted backup out of the environment. You should also be able to disable interactive login of the account and put in other restrictions, perhaps some type of mutual key based auth so the auth only works between the remote service and your backup job. – Eric G Oct 3 '18 at 23:11

When you create an ACL and allow your backup environment to access your CDE, it means your backup servers and the flow on the way to those servers are also in PCI scope. You can either create another big workload to yourself for auditing this new scope and creating MFA for this flow or you go with the option you think. I would go with a service inside the scope and make sure data is stored in a safe and different place from the other backups. (check PCI v3-2-1 requirement 9.5.1) Link: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.