5

So let's say we have a production site that requires VPN access to the datacenter. We also have a dev/qa datacenter in a separate datacenter with it's own VPN connection. When we're sitting in the office we have an IPSEC tunnel to the dev/qa datacenter, but we have to connect via VPN into production. So, if we're in the office life is good, I can connect to a dev machine or a prod machine BUT I cannot jump from prod to dev and vice versa.

Everything was fine but just recently the network guys got rid of the route that allowed us to use one VPN in order to connect to prod and dev (can't hop between datacenters). We were told it would be a PCI violation, I'm just looking for clarification on whether this is true or not. When we're working from home, it's such a hassle to have to connect and disconnect between the two VPN.

More info (clarification):

  • When on a dev machine, I should NOT be able to connect to a prod machine and vice versa.
  • When I'm sitting in the office, I can freely connect to a dev machine from my laptop but in order to connect to a prod machine (from my laptop), I have to connect via VPN. I CANNOT jump between datacenters from host to host.
  • At one point, when we're working from home, we could connect to the prod VPN and connect to both the prod and dev datacenters BUT we cannot jump between datacenters via a local host in the DC.
Improve this question
4
  • To make sure I have this right: before, you could directly connect from dev to production, but only when you were at home and VPNed to the office; now, you can't directly connect from dev to production when you're at home. Is that correct?
    – cpast
    Feb 17, 2015 at 19:44
  • What aspect of the PCI DSS were they concerned with violating? They should be able to tell you something like "6.4.1 Separate development/test environments from production environments, and enforce the separation with access controls."
    – gowenfawr
    Feb 17, 2015 at 19:56
  • Clarified the set up, please see updated post. Thx @gowenfarw, I'm looking for annything I can use for my argument. it's such a f'n hassle.
    – sdot257
    Feb 17, 2015 at 20:02
  • The 2 main requirements to meet here area the following: 1) separation of production and other environments and 2) separation of duties between production and dev/test/qa. 1 is essentially scope reduction. 2 is to ensure devs don't dev or administer production systems. The network separation must satisfy the intent of segmentation per LPK's response below. Network segmentation, access control, role based access control, jump hosts and a WAN could accomplish the same.
    – AndyMac
    Feb 18, 2015 at 2:07

2 Answers 2

Reset to default
3

In addition to Baordog's answer note that PCI encompasses all networks where you store credit card data. It would not seem unlikely that they consider such link a violation in terms of segregating your PCI environment with a non-pci environment.

PCI DSS applies to all systems components … connected to the cardholder data environment (CDE). The CDE includes people, processes or technology that store, process or transmit cardholder data. Network segmentation, or isolating (segmenting) the CDE from the rest of the network … is strongly recommended. Without adequate network segmentation the entire network is in scope of the PCI DSS assessment. … adequate network segmentation isolates systems that store, process, or transmit cardholder data from those that do not. Documenting cardholder data flows via a dataflow diagram helps fully understand all cardholder data flows and ensures that any network segmentation is effective at isolating the cardholder data environment.”

It might be that your PCI auditor made a comment about the fact that this segregation is not enough, which risks taking into scope the QA and Dev environments for your PCI network. And that therefore the network administrators decided to disable that rule.

Improve this answer
1
  • If it's a Dev or QA network, it doesn't store credit card data, as per "6.4.3 Production data (live PANs) are not used for testing or development". With that said, I think you're spot on that this is probably an exercise in controlling scope.
    – gowenfawr
    Feb 17, 2015 at 21:40
1

PCI DSS requirement 6.4.2 separation of duties between development/test environments

Actually a previous post on this website hints at the answer here. I'm not a PCI expert, but I would guess that yes it is a problem. The separation of duties concept implies that developers should not have access to production servers, so joining both via single vpn login would seem to be in violation of that.

Since PCI matters are very serious, you should ask a PCI expert in person before making an decisions.

Improve this answer
6
  • Understood, NO ONE in dev has access to the prod VPN. Only production guys do.
    – sdot257
    Feb 17, 2015 at 20:01
  • But the prod guys shouldn't be able to get to Dev either.
    – MrSynAckSter
    Feb 17, 2015 at 20:17
  • we need to support the environment.
    – sdot257
    Feb 17, 2015 at 20:21
  • @baordog that's not entirely true
    – Lucas Kauffman
    Feb 17, 2015 at 20:50
  • I'm no PCI expert, but from what I'm seeing, they want total separation.
    – MrSynAckSter
    Feb 17, 2015 at 20:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .