5

So let's say we have a production site that requires VPN access to the datacenter. We also have a dev/qa datacenter in a separate datacenter with it's own VPN connection. When we're sitting in the office we have an IPSEC tunnel to the dev/qa datacenter, but we have to connect via VPN into production. So, if we're in the office life is good, I can connect to a dev machine or a prod machine BUT I cannot jump from prod to dev and vice versa.

Everything was fine but just recently the network guys got rid of the route that allowed us to use one VPN in order to connect to prod and dev (can't hop between datacenters). We were told it would be a PCI violation, I'm just looking for clarification on whether this is true or not. When we're working from home, it's such a hassle to have to connect and disconnect between the two VPN.

More info (clarification):

  • When on a dev machine, I should NOT be able to connect to a prod machine and vice versa.
  • When I'm sitting in the office, I can freely connect to a dev machine from my laptop but in order to connect to a prod machine (from my laptop), I have to connect via VPN. I CANNOT jump between datacenters from host to host.
  • At one point, when we're working from home, we could connect to the prod VPN and connect to both the prod and dev datacenters BUT we cannot jump between datacenters via a local host in the DC.
  • To make sure I have this right: before, you could directly connect from dev to production, but only when you were at home and VPNed to the office; now, you can't directly connect from dev to production when you're at home. Is that correct? – cpast Feb 17 '15 at 19:44
  • What aspect of the PCI DSS were they concerned with violating? They should be able to tell you something like "6.4.1 Separate development/test environments from production environments, and enforce the separation with access controls." – gowenfawr Feb 17 '15 at 19:56
  • Clarified the set up, please see updated post. Thx @gowenfarw, I'm looking for annything I can use for my argument. it's such a f'n hassle. – luckytaxi Feb 17 '15 at 20:02
  • The 2 main requirements to meet here area the following: 1) separation of production and other environments and 2) separation of duties between production and dev/test/qa. 1 is essentially scope reduction. 2 is to ensure devs don't dev or administer production systems. The network separation must satisfy the intent of segmentation per LPK's response below. Network segmentation, access control, role based access control, jump hosts and a WAN could accomplish the same. – AndyMac Feb 18 '15 at 2:07
3

In addition to Baordog's answer note that PCI encompasses all networks where you store credit card data. It would not seem unlikely that they consider such link a violation in terms of segregating your PCI environment with a non-pci environment.

PCI DSS applies to all systems components … connected to the cardholder data environment (CDE). The CDE includes people, processes or technology that store, process or transmit cardholder data. Network segmentation, or isolating (segmenting) the CDE from the rest of the network … is strongly recommended. Without adequate network segmentation the entire network is in scope of the PCI DSS assessment. … adequate network segmentation isolates systems that store, process, or transmit cardholder data from those that do not. Documenting cardholder data flows via a dataflow diagram helps fully understand all cardholder data flows and ensures that any network segmentation is effective at isolating the cardholder data environment.”

It might be that your PCI auditor made a comment about the fact that this segregation is not enough, which risks taking into scope the QA and Dev environments for your PCI network. And that therefore the network administrators decided to disable that rule.

  • If it's a Dev or QA network, it doesn't store credit card data, as per "6.4.3 Production data (live PANs) are not used for testing or development". With that said, I think you're spot on that this is probably an exercise in controlling scope. – gowenfawr Feb 17 '15 at 21:40
1

PCI DSS requirement 6.4.2 separation of duties between development/test environments

Actually a previous post on this website hints at the answer here. I'm not a PCI expert, but I would guess that yes it is a problem. The separation of duties concept implies that developers should not have access to production servers, so joining both via single vpn login would seem to be in violation of that.

Since PCI matters are very serious, you should ask a PCI expert in person before making an decisions.

  • Understood, NO ONE in dev has access to the prod VPN. Only production guys do. – luckytaxi Feb 17 '15 at 20:01
  • But the prod guys shouldn't be able to get to Dev either. – baordog Feb 17 '15 at 20:17
  • we need to support the environment. – luckytaxi Feb 17 '15 at 20:21
  • @baordog that's not entirely true – Lucas Kauffman Feb 17 '15 at 20:50
  • I'm no PCI expert, but from what I'm seeing, they want total separation. – baordog Feb 17 '15 at 20:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.