In the PCI DSS version 3 it says:

1.3.3 Do not allow any direct connections inbound or outbound for traffic between the Internet and the cardholder data environment.

But in the event of hard drive failure, fire, natural disaster, or terrorist takeover, I wouldn't want to lose the information stored there, so I researched websites that provide "secure online backup" solutions. For example: http://www.carbonite.com/, which has a pro plan for backing up "financial data, healthcare records or other crucial business files". (Note, I'm only using this as an example because they were the first result, not because I have any affiliation with them).

So it would seem that it is possible somehow. My question is, how would you get the data from the cardholder data environment and the Internet without being able to have any incoming or outgoing traffic? If I have to proxy it through another local server, wouldn't that be essentially the same thing with just another step where things could potentially go wrong in between? Along the same lines is keeping the operating system patched and up to date. That's a bit difficult to do without an active Internet connection. Are there any exceptions to the PCI DSS for pre-defined connections for purposes such as backups and operating system updates?

  • 2
    "Do not allow any direct connections" – Digital Chris Sep 8 '14 at 19:49
  • You can use a VPN (or any other type of private network) to store the data in another secure location that does not have direct access to the internet. For example, you can have a VPN server in your DMZ to which you connect, and from there you can create a SSH tunnel to your internal network (which should be protected by another firewall) and take the backup from there. The simpler alternative is to have a private network provided by a telco (you still need to move files in a secure way). – HocusPocus Sep 9 '14 at 7:37

They're saying, "Don't hook up a server with cardholder data stored on it directly to an ADSL modem". In other words, firewalling has to be employed between the Internet connection and the cardholder data environment (and must be employed following the PCI spec).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.