PCI Full Environment

When to Use

Apply this pattern where you are a Merchant or Payment Services Processor storing, transmitting or processing Payment Cards.

When NOT to Use

Do not use this pattern where you plan to reduce the compliance scope using tokenisation (SP-027), or remove the environment from scope using a 3rd Party Payment services gateway (SP-028)

Typical Challenges

PCI-DSS is a proscriptive and detailed security standard. You need to ensure that you fully understand the scope of the Cardholder Data Environment with accurate network diagrams that show the relevant systems with Cardholder data flows. You'll need to demonstrate to the Qualified Security Assessor (QSA) that there are suitable control points that delimit the CDE. These control points (e.g. firewalls, remote access servers etc) will be checked as part of the assessment to confirm that the scope represented is accurate.

• Documentation will need to be accurate and current, you may wish to check this in advance of the assessment. Many aspects of documentation are interlinked, for example Build Standards will be needed to meet the PCI requirements on vendor defaults, but also play an important part in implmenting effective File integrity monitoring (11.5)
• You will need to provide evidence of control operation- make sure you have the repeating activites in place such as quarterly security scans
• Encryption requirements may be challenging, think carefully during the design phase about how you can secure data within the environment and the best approaches to key management
• You may need to make use of compensating controls in your environment if there are specific PCI-DSS requirements that cannot be met due to business process requirements that conflict. This is permissible if the QSA assesses the risks and determines that the original intent of the control is still met. You

Threat Resistance

This pattern is designed to resist the threat of non-compliance with the PCI-DSS v2.0 requirements. It provides a good basis for securing a confidential data set against motivated criminal actors.

Assumptions

This pattern assumes that you have a basic working knowledge of PCI-DSS requirements and if not that you will go and download the standard and spend a couple of days properly reading it...