Can we use the same AD server for both PCI VLAN user and Non PCI VLAN users? How about proxy, we have a Proxy but both PCI and Non PCI user's traffic are flowing through those Proxy.

But we have segmented the VLAN for both PCI and Non PCI users Is it PCI compliant?


It all depends on how it's implemented but yes, it is certainly feasible. Let's say you have network segment A containing systems which handle cardholder data, network segment B with AD servers and network segment C with systems which do not handle cardholder data in any capacity, do not have access to segment A and management of systems within A and B is performed using a bastion host or jump server within segment B. In this scenario, there could be effective segmentation and, depending on security controls implemented, you should be looking good for using the same AD throughout. Throw in proper Role Based Access Control, monitoring and logging, risk assessment etc and you're getting closer to compliance.

As for the proxy, is the proxy transmitting cardholder data and what security posture/risk has it? The likelihood is that the proxy server will be considered to be in-scope though it could be used by both in-scope and not-in-scope systems.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.