1

Is it possible to use any remote DVCS (GitHub, Bitbucket, etc.) with PCI DSS or should I host Git on my own server?

The repo obviously doesn't store any sensitive CHD information and I do have my own self-hosted git repo inside the PCI DSS zone to protect and monitor code entering and exiting the PCI zone.


Not a duplicate of Can I use GitHub and be PCI DSS compliant? - the standard allegedly changed with the 4.0 version and I want to confirm.

In general, the 4.0 version of the standard brings in a lot of new things compared to the previous versions which invalidates a lot of the PCI DSS related answers on the site - which is why I added the PCI DSS 4.0 tag.

The 4.0 version of the standard says in "Section 4: Scope of PCI DSS Requirements" on page 10:

Tools, code repositories, and systems that implement software configuration management or for deployment of objects to the CDE or to systems that can impact the CDE.

and also in "Requirement 6: Develop and Maintain Secure Systems and Software"

Code repositories that store application code, system configurations, or other configuration data that can impact the security of account data or the CDE are in scope for PCI DSS assessments.

7
  • 1
    is Github in the cardholder environment? What's your scope?
    – schroeder
    Jun 26 at 10:44
  • 1
    What section in PCI v4 concerns you? I think the answer to the question you linked most likely applies here as well.
    – kenlukas
    Jun 26 at 13:28
  • @kenlukas Page 10 of the v4.0 standard states that "Tools, code repositories, and systems that implement software configuration management or for deployment of objects to the CDE or to systems that can impact the CDE." are in PCI DSS scope - I'll edit the post to add this info
    – bbozo
    Jun 28 at 11:28
  • @schroeder Github is a service, running on Azure as far as I know, it's not in the CHD environment, does not store sensitive data, but according to v4.0 of the standard code repos are kind of in scope of PCI DSS audits - and Github isn't certified? Or is it?
    – bbozo
    Jun 28 at 11:30
  • 1
    So, if you know all this, then your question doesn't make sense. Wherever your code is, it needs to meet the requirements. So, as I asked, are you hosting code in Github that affects the CDE and is it in scope? If it is, then you need to follow Requirement 6. If you can do that with Github, then you're fine.
    – schroeder
    Jun 28 at 11:41

2 Answers 2

5

As a PCI QSA now for close to 20 years, @bbozo's question is spot on. PCI DSS v4 specifically calls out "source code management tools" as an example of system components that can impact the security of the cardholder data environment (CDE). An example use case is "We use Terraform to build out our AWS environment at the end of every sprint." Because Terraform directly configures the security of all of the AWS Things, the source of truth for Terraform (GitHub) can impact the security of the CDE. By the way, the same thing goes for other items listed as examples in the same line on page 10 -- CI/CD tools and services come to mind too such a local implementation of Jenkins or CircleCI, Azure DevOps, AWS Code Pipeline, etc.

To the OP's question, yes, it should be possible to use GitHub in a PCI compliant manner. The real question here is "will GitHub provide a PCI DSS Attestation of Compliance (AoC) completed by an external QSA, or will they participate in each of their customers' PCI DSS assessments?"

My current customer passed along an update based on their meeting with GH today. Yes, it is possible to obtain a PCI DSS AOC from GitHub. It is available to GitHub Enterprise customers.

1
1

I'm not a QSA but as I understand it from reading the PCI DSS 4.0 requirements, there are 2 possibilities if you're using Github:

  1. Github can affect the security of the CDE, so is in scope and subject to various requirements. @flyguy62n's answer seems to cover this well.
  2. Github cannot affect the security of the CDE, so is not in scope.

I'll focus on the 2nd option here...

This depends on your other processes and tools but might be a better option. If Github was compromised but still couldn't affect the security of the CDE then it's isolated and should be out of scope for many requirements. You may need to be able to demonstrate this to a QSA.

To evaluate this, you'd need to consider things like if an attacker added a commit to the Github repo and if an attacker reset your commits (potentially a rollback attack).

Some techniques that might help:

  • Local or self-hosted repos are the source of truth and code is reviewed before pulling from Github
  • Something checks all commits have a suitable signature
  • Something checks commits haven't been reset, for example by comparing to an append-only log
  • Manual or automated checks to ensure that even if compromised code is heading to production, it still can't affect security in any way (I can't see how this would be practical)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .