1

Say we have a cloud based web application which is SaaS. This application is to be made PCI compliant as a service provider, as client card data passes through the application. This application uses a database for its configuration information.

Please note that the database only contains configuration information. No card holder or personal details are stored here. However, we also have a management portal that is accessed by clients. The clients can log in to the management portal, and change their configuration that is saved to the shared database.

So we have:

Application --> Shared DB <-- Management Portal <-- Client access

Is it possible for the Shared DB and the Management Portal to be out of scope if on a separate network, making the CDE the Application only?

From the PCI v3 standard:

At a high level, adequate network segmentation isolates systems that store, process, or transmit cardholder data from those that do not.

Does the above appear to adhere to this recommendation?

Improve this question

2 Answers 2

Reset to default
2

The communication link between the application and the DB is the issue. If the application is what you consider your CDE then the database will be in scope because it is connected to the application. Depending on your access controls and other security controls for segmentation you might be able to remove the management portal from scope (assuming it sits on a different network segment from that application. This also depends on your QSA and what they will accept.

There are 3 things to consider when evaluating segmentation for PCI:

  1. Whether or not a system stores, processes, or transmits Cardholder data
  2. Whether or not a system has access to a system that stores, processes or transmits cardholder data
  3. Whether or not a system can impact the security of the CDE

A systems can only be excluded from the scope of a PCI assessment by confirming that the 3 criteria above are false.

Improve this answer
1
  • 2
    Unfortunately, segmentation means isolation for PCI, i.e. no connectivity. Timee is right that the DB will be an issue. But since the shared DB is "in scope" but not "in the CDE" things that are connected to it are not brought into scope.
    – freb
    Oct 25, 2014 at 2:13
0

IANAQSA

No, I don't believe you can achieve the separation you're looking for. The PCI v3 quote you've provided describes using adequate network segmentation to isolate systems. What you're really asking, though, is can you isolate Shared DB (card details) from Shared DB (configuration)? And the answer is no, you can't, because they're... ah... Shared. There's no meaningful isolation layer between a database and itself. Even if you're talking about separate instances on the same DBMS, I expect most QSAs would consider them inseparable.

You can probably keep Client Access out of scope, but even with the network segmentation between Management Portal and Shared DB, it'll be hard to keep Management Portal out of scope because Shared DB (configuration) is tainted by Shared DB (card details).

Improve this answer
2
  • We are not storing card details. Our application only transmits them. Does your answer reflect this?
    – SilverlightFox
    Oct 24, 2014 at 17:46
  • Again - IANAQSA - but if the application transmits card data, and the database is integrated into the application, then I think most QSAs consider the database in scope, even if you don't persist card details to the database. The Application->Database connection is too intimate to support the sort of isolation they're looking for. So I think the answer still applies, but you should certainly wait to see what other feedback people have.
    – gowenfawr
    Oct 24, 2014 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.