1

We need to be PCI compliant for a small setup. We need to share a folder which should be accessible by other regions as well.

  1. We have Private MPLS Connection.

  2. PCI users will be having only READ access.

  3. The File server will be in PCI ZONE.


Question is Can we share folder across regions?

Is it compliant with PCI?

1

No. The requirement for getting out-of-scope for the non-CDE enviroment is that its totally isolated in such a way that the non-CDE enviroment - if totally compromised, this should read as "totally taken over and owned by the attackers" - should not be able to compromise the CDE enviroment - not even reduce the security the smallest bit. (CDE enviroment = "PCI Zone" in your question)

The security risk you expose the CDE enviroment for by exposing a read-only fileserver to the CDE Enviroment that is writeable from the non-CDE enviroment is that the server can be infected with a virus that originates from the non-CDE enviroment, that a PCI user might access and cause havoc inside the CDE Enviroment.

A better way to accomplish this transfer of information, is to transfer the information in such a way that it can never be interpreted as executeable files. Think a one-way RS-232-channel from non-CDE to CDE, that is handled very restrictive in the CDE enviroment. Best way to accomplish this is to use a RS-232 to optical fiber at the non-CDE end, and then a optical fiber to RS-232 at the CDE end, and then you only connect the transmit port on non-CDE to the receive port on the CDE side. You must ensure that regardless whatever is put into the non-CDE end of the RS-232 channel, the CDE enviroment may not be affected security-wise.

This means you need to configure the RS-232 receiver in such a way so the charset is limited so even if a user copies a file off the server that handles the RS-232 receiver and for example, Changes the file extension from .txt to .exe, the system must stay safe. This means very restrictive settings on the RS-232 receiver.

  • Thanks, Understand your point. My point is Regions A,B, and C are PCI compliant CDE zones. Files will be created in region A with read only access. That file will be shared in region B and C. Within the PCI CDE zone. Can it be done?. All these three regions are connected by MPLS private link. – PCIrs Jan 26 '15 at 5:42
  • There is no data copied from Non CDE to CDE. Its from CDE to CDE but in different regions – PCIrs Jan 26 '15 at 5:45
  • Please provide your invaluble answer – PCIrs Jan 26 '15 at 5:46
  • 1
    Yes. Then its fine. As long as Everything is kept inside PCI boundaries, you can configure the servers as you want. You can even do so PCI zones they all have read/write. Note that if the file-share traffic is being transported over network Cables that physically pass non-PCI zones, for example over internet, you have to encrypt the Connections, even if the data transported is not confidental. The reason is that else, a adversiary can inject malicious traffic into the PCI zones. – sebastian nielsen Jan 26 '15 at 13:31
  • 1
    A PCI boundary can span multiple physical countries or regions. Its no problem. The important thing is to define this boundary. Everything inside this boundary is subject to PCI DSS. Everything outside this boundary are not affected by PCI DSS. So even if A is Sweden, B is USA, and C is Germany, you could still interconnect these Three zones with encrypted VPN tunnels, and then share files across the zones freely, like the 3 zones was adjacent to each other. However, the VPN tunnels MUST terminate inside the zones, and be subject to the same physical security as the zones itself. – sebastian nielsen Jan 26 '15 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.