The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function'
we have a webserver with database - web pages and email
is this a breach of the rules? because just about all web servers come with a database, web server and email. We are only a very small merchant with a very small web shop i can't imagine everyone is splitting all these up into 3 servers? this would be very expensive?
2.2.1 Implement only one primary function per server to prevent functions that require different security levels from co-existing on the same server. (For example, web servers, database servers, and DNS should be implemented on separate servers.)
A database, which needs to have strong security measures in place, would be at risk sharing a server with a web application, which needs to be open and directly face the Internet. Failure to apply a patch to a seemingly minor function could result in a compromise that impacts other, more important functions (such as a database) on the same server.
This requirement is meant for all servers within the cardholder data environment (usually Unix, Linux, or Windows based). This requirement may not apply to systems which have the ability to natively implement security levels on a single server (e.g. mainframe).
I had a look at PCI-DSS - one application per server? but im still confused