Can I use GitHub and be PCI DSS 4.0 compliant?

Question

Is it possible to use any remote DVCS (GitHub, Bitbucket, etc.) with PCI DSS or should I host Git on my own server?

The repo obviously doesn't store any sensitive CHD information and I do have my own self-hosted git repo inside the PCI DSS zone to protect and monitor code entering and exiting the PCI zone.

---

Not a duplicate of Can I use GitHub and be PCI DSS compliant? - the standard allegedly changed with the 4.0 version and I want to confirm.

In general, the 4.0 version of the standard brings in a lot of new things compared to the previous versions which invalidates a lot of the PCI DSS related answers on the site - which is why I added the PCI DSS 4.0 tag.

The 4.0 version of the standard says in "Section 4: Scope of PCI DSS Requirements" on page 10:

Tools, code repositories, and systems that implement software configuration management or for deployment of objects to the CDE or to systems that can impact the CDE.

and also in "Requirement 6: Develop and Maintain Secure Systems and Software"

Code repositories that store application code, system configurations, or other configuration data that can impact the security of account data or the CDE are in scope for PCI DSS assessments.

Answer 1

As a PCI QSA now for close to 20 years, @bbozo's question is spot on. PCI DSS v4 specifically calls out "source code management tools" as an example of system components that can impact the security of the cardholder data environment (CDE). An example use case is "We use Terraform to build out our AWS environment at the end of every sprint." Because Terraform directly configures the security of all of the AWS Things, the source of truth for Terraform (GitHub) can impact the security of the CDE. By the way, the same thing goes for other items listed as examples in the same line on page 10 -- CI/CD tools and services come to mind too such a local implementation of Jenkins or CircleCI, Azure DevOps, AWS Code Pipeline, etc.

To the OP's question, yes, it should be possible to use GitHub in a PCI compliant manner. The real question here is "will GitHub provide a PCI DSS Attestation of Compliance (AoC) completed by an external QSA, or will they participate in each of their customers' PCI DSS assessments?"

My current customer passed along an update based on their meeting with GH today. Yes, it is possible to obtain a PCI DSS AOC from GitHub. It is available to GitHub Enterprise customers.

Answer 2

I'm not a QSA but as I understand it from reading the PCI DSS 4.0 requirements, there are 2 possibilities if you're using Github:

1. Github can affect the security of the CDE, so is in scope and subject to various requirements. @flyguy62n's answer seems to cover this well.
2. Github cannot affect the security of the CDE, so is not in scope.

I'll focus on the 2nd option here...

This depends on your other processes and tools but might be a better option. If Github was compromised but still couldn't affect the security of the CDE then it's isolated and should be out of scope for many requirements. You may need to be able to demonstrate this to a QSA.

To evaluate this, you'd need to consider things like if an attacker added a commit to the Github repo and if an attacker reset your commits (potentially a rollback attack).

Some techniques that might help:

• Local or self-hosted repos are the source of truth and code is reviewed before pulling from Github
• Something checks all commits have a suitable signature
• Something checks commits haven't been reset, for example by comparing to an append-only log
• Manual or automated checks to ensure that even if compromised code is heading to production, it still can't affect security in any way (I can't see how this would be practical)