PCI Compliance in the Cloud: A working example
0 likes237 views
The document details the implementation of PCI compliance for payment processing at UC Davis, highlighting the transition from an outdated server to a compliant cloud-based solution. It outlines the specific requirements of the PCI Data Security Standard (DSS), the various merchant levels, and the SAQ types needed to demonstrate compliance. Additionally, it discusses the advantages of cloud infrastructure in enhancing security, efficiency, and cost-effectiveness while also sharing the successful outcomes of the audit and fundraising initiatives.
PCI Compliance in the Cloud: A working example
- 1. PCI Compliance in the Cloud: A working example John Knoll jpknoll@ucdavis.edu https://github.com/jpknoll UC Computing Systems Conference July 10-12 2016 University of California Santa Cruz Scott Kirkland srkirland@ucdavis.edu https://github.com/srkirland Adam Getchell acgetchell@ucdavis.edu https://github.com/acgetchell
- 2. Goal: Give to UC Davis • Hired for Centralized Gift Processing • UC PCI Audit Starts • Priority Changes: Compliant Website that can take Credit Cards
- 3. Why a complete redesign? • Replace an onsite Windows Server 2003 • Oracle Forms Driven • Difficult Impossible to bring into compliance • Switch credit card processors • TouchNet to CyberSource • Modernize look and feel • Professional mockups & design • Be ready before the on site audit (less one year) • Agile or Bust!
- 4. Investigate Payment Processors • TouchNet • PayPal • Stripe • CyberSource / Authorize.Net
- 8. What is PCI? • Set of standards designed to make payment card processing security the responsibility of all parties involved. • Merchant ‐> Processor ‐> Bank • Contractually Enforceable via Bank’s Merchant Account • Fines, Fee, or Account Termination • Applies to anyone that accepts credit card payments, even if you don’t store cc details.
- 9. Goal Requirement Build and Maintain a Secure Network and Systems 1. Install and maintain a firewall configuration to protect cardholder data 2. Do not use vendor‐supplied defaults for system passwords and other security parameters Protect Cardholder Data 3. Protect stored cardholder data 4. Encrypt transmission of cardholder data across open, public networks Maintain a Vulnerability Management Program 5. Protect all systems against malware and regularly update antivirus software or programs 6. Develop and maintain secure systems and applications Implement Strong Access Control Measures 7. Restrict access to cardholder data by business need to know 8. Identify and authenticate access to system components 9. Restrict physical access to cardholder data Regularly Monitor and Test Networks 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes Maintain an Information Security Policy 12. Maintain a policy that addresses information security for all personnel
- 10. Meeting Compliance • The Entire PCI Data Security Standard (DSS) applies to all levels and all environment types. • Merchant Level (based on business size) Determines how you prove compliance: • Annual Self Assessment Questionnaire ("SAQ") • Annual Report on Compliances ("ROC") by Qualified Security Assessor ("QSA")
- 11. Merchant Levels Merchant Level Description 1 Any merchant — regardless of acceptance channel — processing over 6M Visa transactions per year. Any merchant that Visa, at its sole discretion, determines should meet the Level 1 merchant requirements to minimize risk to the Visa system. 2 Any merchant — regardless of acceptance channel — processing 1M to 6M Visa transactions per year. 3 Any merchant processing 20,000 to 1M Visa e‐commerce transactions per year. 4 Any merchant processing fewer than 20,000 Visa e‐commerce transactions per year, and all other merchants — regardless of acceptance channel — processing up to 1M Visa transactions per year.
- 12. SAQ Type Description # Q’s A Card‐not‐present merchants: All payment processing functions fully outsourced, no electronic cardholder data storage 14 A‐EP E‐commerce merchants re‐directing to a third‐party website for payment processing, no electronic cardholder data storage 139 B Merchants with only imprint machines or only standalone dial‐out payment terminals: No e‐commerce or electronic cardholder data storage 41 B‐IP Merchants with standalone, IP‐connected payment terminals: No e‐commerce or electronic cardholder data storage 83 C Merchants with payment application systems connected to the Internet: No e‐commerce or electronic cardholder data storage 139 C‐VT Merchants with web‐based virtual payment terminals: No e‐commerce or electronic cardholder data storage 73 D‐MER All other SAQ‐eligible merchants 326 D‐SP SAQ‐eligible service providers 347 P2PE Hardware payment terminals in a validated PCI P2PE solution only: No e‐commerce or electronic cardholder data storage 35
- 13. SAQ Type Description # Q’s A Card‐not‐present merchants: All payment processing functions fully outsourced, no electronic cardholder data storage 14 A‐EP E‐commerce merchants re‐directing to a third‐party website for payment processing, no electronic cardholder data storage 139 B Merchants with only imprint machines or only standalone dial‐out payment terminals: No e‐commerce or electronic cardholder data storage 41 B‐IP Merchants with standalone, IP‐connected payment terminals: No e‐commerce or electronic cardholder data storage 83 C Merchants with payment application systems connected to the Internet: No e‐commerce or electronic cardholder data storage 139 C‐VT Merchants with web‐based virtual payment terminals: No e‐commerce or electronic cardholder data storage 73 D‐MER All other SAQ‐eligible merchants 326 D‐SP SAQ‐eligible service providers 347 P2PE Hardware payment terminals in a validated PCI P2PE solution only: No e‐commerce or electronic cardholder data storage 35
- 15. Choosing a platform • Build Server + Continuous Integration • Web Servers • Load Balancer / Traffic Management • Database • Storage • Logging • Email • Search Provider • Web Jobs
- 16. Choosing a platform • Build Server + Continuous Integration: AppVeyor • Web Servers: Azure Web Sites • Load Balancer / Traffic Management: Azure • Database: Azure SQL Database • Storage: Azure Storage • Logging: Stackify • Email: SparkPost • Search Provider: Elastic Search via Compose.io • Web Jobs: Azure Web Jobs
- 20. Faster ‐ Deployment Strategies • Test Instances • Staging Slots • Continuous Integration • Automated build + test (Appveyor, OctoDeploy) • Deployment Notification • Slack/Chat, Email, Ticketing System
- 21. Cheaper ‐ Costs and Scaling • Build Server + CI: $40 • Web Server: $40 x 2 • Load Balancer / Traffic Management: Free • Database: $15 x 2 • Storage: < $1 • Email: $15 • Logging + APM: $40 (10GB / month) • Search Provider: $50 • Web Jobs: Free • Total: $255.99 / month
- 22. Stronger ‐ Reduced PCI Scope • Shared Responsibility Model • Decreased complexity • Less control over security modes (This is a good thing!) From Azure PCI DSS Responsibility Matrix 2016
- 24. Patch Management • Infrastructure Patching & Configuration • OS, Framework, WebServer • Managed by Azure, secure by default • Application Development • Secure SDLC • 3rd Party Libraries • Package management
- 25. Network & Firewalls • Partial Management by Azure • Single Endpoint • DB Servers have firewall rules too! • Business Justifications
- 26. Logging • Management by Azure • OS, IIS, ASP.Net • Application Level Logging • Stackify • Logs are useless if you don’t watch them • Demo
- 28. Goal Requirement Build and Maintain a Secure Network and Systems 1. Install and maintain a firewall configuration to protect cardholder data 2. Do not use vendor‐supplied defaults for system passwords and other security parameters Protect Cardholder Data 3. Protect stored cardholder data 4. Encrypt transmission of cardholder data across open, public networks Maintain a Vulnerability Management Program 5. Protect all systems against malware and regularly update antivirus software or programs 6. Develop and maintain secure systems and applications Implement Strong Access Control Measures 7. Restrict access to cardholder data by business need to know 8. Identify and authenticate access to system components 9. Restrict physical access to cardholder data Regularly Monitor and Test Networks 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes Maintain an Information Security Policy 12. Maintain a policy that addresses information security for all personnel
- 29. Goal Requirement Build and Maintain a Secure Network and Systems 1. Install and maintain a firewall configuration to protect cardholder data 2. Do not use vendor‐supplied defaults for system passwords and other security parameters Protect Cardholder Data 3. Protect stored cardholder data 4. Encrypt transmission of cardholder data across open, public networks Maintain a Vulnerability Management Program 5. Protect all systems against malware and regularly update antivirus software or programs 6. Develop and maintain secure systems and applications Implement Strong Access Control Measures 7. Restrict access to cardholder data by business need to know 8. Identify and authenticate access to system components 9. Restrict physical access to cardholder data Regularly Monitor and Test Networks 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes Maintain an Information Security Policy 12. Maintain a policy that addresses information security for all personnel
- 30. Difficulties – SSL and Early TLS RC4 Support (2015) TLS 1.0 Support (2018)
- 31. Difficulties ‐ Network Scanning • Uncontrolled Ports & Services • 454/455/1001: Internal Web Service Apps
- 32. Difficulties ‐ Penetration Test • Advanced Notice Required • Disruptive to Cloud Platform • Unknown protective measures, responses, reactions • Black Box by default
- 33. Difficulties – Understanding the Cloud • Auditor didn’t understand our infrastructure Adams, Scott. "Dilbert“, January 07, 2011
- 35. Results • 746 unique funds • 5000+ gifts, 173 recurring • Recurring is a new feature • $1,495,055.41 raised • 20% increase over previous year
- 36. Reference • PCI FAQs: – https://www.pcicomplianceguide.org/pci‐faqs‐2/ – http://www.pkfavantedge.com/it‐compliance/pci‐dss‐and‐the‐saqs‐that‐sucks/ • Microsoft Trust Center – https://www.microsoft.com/en‐us/TrustCenter/Compliance/PCI – Azure PCI DSS Responsibility Matrix 2016 • Amazon Web Services (AWS) Clour Security – https://aws.amazon.com/compliance/pci‐dss‐level‐1‐faqs/ • Azure UserVoice – https://feedback.azure.com/forums/169385‐web‐apps‐formerly‐websites/suggestions/7091994‐ disable‐insecure‐ciphers‐in‐azure‐websites – https://feedback.azure.com/forums/169385‐web‐apps‐formerly‐websites/suggestions/13097865‐ either‐sun‐set‐tls‐1‐0‐or‐give‐users‐the‐means‐to