Shared Database and PCI Compliance

Question

Say we have a cloud based web application which is SaaS. This application is to be made PCI compliant as a service provider, as client card data passes through the application. This application uses a database for its configuration information.

Please note that the database only contains configuration information. No card holder or personal details are stored here. However, we also have a management portal that is accessed by clients. The clients can log in to the management portal, and change their configuration that is saved to the shared database.

So we have:

Application --> Shared DB <-- Management Portal <-- Client access

Is it possible for the Shared DB and the Management Portal to be out of scope if on a separate network, making the CDE the Application only?

From the PCI v3 standard:

At a high level, adequate network segmentation isolates systems that store, process, or transmit cardholder data from those that do not.

Does the above appear to adhere to this recommendation?

Answer 1

The communication link between the application and the DB is the issue. If the application is what you consider your CDE then the database will be in scope because it is connected to the application. Depending on your access controls and other security controls for segmentation you might be able to remove the management portal from scope (assuming it sits on a different network segment from that application. This also depends on your QSA and what they will accept.

There are 3 things to consider when evaluating segmentation for PCI:

1. Whether or not a system stores, processes, or transmits Cardholder data
2. Whether or not a system has access to a system that stores, processes or transmits cardholder data
3. Whether or not a system can impact the security of the CDE

A systems can only be excluded from the scope of a PCI assessment by confirming that the 3 criteria above are false.

Answer 2

IANAQSA

No, I don't believe you can achieve the separation you're looking for. The PCI v3 quote you've provided describes using adequate network segmentation to isolate systems. What you're really asking, though, is can you isolate Shared DB (card details) from Shared DB (configuration)? And the answer is no, you can't, because they're... ah... Shared. There's no meaningful isolation layer between a database and itself. Even if you're talking about separate instances on the same DBMS, I expect most QSAs would consider them inseparable.

You can probably keep Client Access out of scope, but even with the network segmentation between Management Portal and Shared DB, it'll be hard to keep Management Portal out of scope because Shared DB (configuration) is tainted by Shared DB (card details).