PCI - prohibiting direct connections to the Cardholder Data Environment

Question

In PCI 1.3.3 it states:

Are direct connections prohibited for inbound or outbound traffic between the Internet and the cardholder data environment?

A Cardholder Data Environment (CDE) encompasses any device or server that stores or transfers cardholder data. (PCI Glossary available here)

With our system, a user adds a credit card via the web, making each one of our front-facing servers a part of the CDE. In my view this is a paradox because any server the user has a direct connection to will always be considered a part of the CDE.

Any clues about how I should approach this?

Answer 1

The Guidance column of PCI DSS 1.3.3 (v3) states:

Examination of all inbound and outbound connections allows for inspection and restriction of traffic based on the source and/or destination address, as well as inspection and blocking of unwanted content, thus preventing unfiltered access between untrusted and trusted environments. This helps prevent, for example, malicious individuals from sending data they've obtained from within your network out to an external untrusted server in an untrusted network.

This means firewall controls and content controls (IDS/IPS, WAF, DLP proxies) should be used to limit CDE ingress/egress. Permitting traffic in to limited, necessary ports is okay. Permitting broad traffic in to unnecessary ports is not okay. Permitting unregulated outbound traffic which could allow an attacker to exfiltrate data is not okay.

It really boils down to "preventing unfiltered access between untrusted and trusted environments." I'll grant you the wording isn't directly useful.

(There is no guidance column in PCI DSS v2, but the requirement itself is the same, and the whole point of adding a guidance column with v3 was to provide, um, guidance to clarify the intent of the requirements. So it's valid whichever version you're working with.)