Finally, PCI DSS In The Cloud Guidance
by Anton Chuvakin | February 12, 2013 | 9 Comments
As all of you already know, PCI Council has finally released an official “Information Supplement: PCI DSS Cloud Computing Guidelines” [PDF] aka “PCI DSS in the cloud.”
Here are some of my favorite quotes from the 52 page [sadly, a bit, wooly] mammoth of a document:
- “The allocation of responsibility between client and provider for managing security controls does not exempt a client from the responsibly of ensuring that their cardholder data is properly secured according to applicable PCI DSS requirements.” <- merchants, please ponder that one
- “clear responsibilities for operation, management and reporting need to be defined for each [PCI DSS] requirement.” <- obvious, but oh-so-uncommon.
- “The allocation of responsibility for managing security controls does not exempt a client from the responsibility of ensuring that their cardholder data is properly secured.”
- “Where the CSP maintains responsibility for PCI DSS controls, the client is still responsible for monitoring the CSP’s ongoing compliance for all applicable requirements.”
- “Segmentation on a cloud-computing infrastructure must provide an equivalent level of isolation as that achievable through physical network separation.”
- “Any shared infrastructure used to house an in-scope client environment would be in scope for that client’s PCI DSS assessment.”
- “If adequate segmentation is not in place or cannot be verified, the entire cloud environment would be in-scope for any one client’s assessment.”
- “The more security controls the CSP is responsible for, the greater the scope of the CDE will potentially be, thereby increasing the complexity involved in defining and maintaining CDE boundaries.” <- counter-intuitive, but so true! Whoever wrote this particular line, really gets it!
- “by keeping all encryption/decryption and key-management operations isolated from the cloud, the number of PCI DSS requirements that the CSP is required to maintain may be reduced, as these requirements will instead be applicable to the client’s own environment and personnel.” <- read and think about it as well.
- “It can be challenging to collect, correlate, and/or archive all of the logs necessary to meet applicable PCI DSS requirements [in public cloud].” <- I hereby nominate this line for The Understatement of the Year prize
- “Use of a PCI DSS compliant CSP does not result in PCI DSS compliance for the clients.” <- this is a repeat, but it definitely bears repeating!
- “The CSP should ensure that any service offered as being “PCI compliant” is accompanied by a clear and unambiguous explanation, supported by appropriate evidence, of which aspects of the service have been validated as compliant and which have not.”
- “Due diligence is not simply reading the provider’s marketing material or relying on a provider’s claims of “PCI compliance” or secure operations.”
- “End-to-end processes and data flows must be documented across both client and cloud provider networks, so that it is clearly understood where cardholder data is located and how it is traversing the infrastructure.”
Finally, if anybody cares for my opinion, the Council made a mistake by loading the document with so much stuff (BC/DR? Data classification? Evolving Security Technologies?) and thus making the clarity of “PCI in the cloud” guidance unachievable! Honestly, I don’t think anybody (much less merchants, much less smaller, cloud-happy merchants) will ever read it all the way to its end… To top it off, “Appendix D: PCI DSS Implementation Considerations” is an entire new document embedded inside. Sadly, the whole thing just bears signs of being designed by a committee full of members hating each other
Additional Resources
View Free, Relevant Gartner Research
Gartner's research helps you cut through the complexity and deliver the knowledge you need to make the right decisions quickly, and with confidence.
Read Free Gartner Research
Category: cloud compliance pci-dss
Tags: cloud-security compliance pci pci-compliance pci-dss
Anton Chuvakin
Research VP and Distinguished Analyst
8 years with Gartner
19 years IT industry
Who's Blogging
- Leah Reidy
- Olive Huang
- Dave Egloff
- Sally Witzky
- Clifton Gilley
- Jitendra Subramanyam
- Anthony Bradley
- Mark Mcdonald
- Scot Kim
- Vivek Swaminathan
- Hank Barnes
- Andrew White
- Steve Rietberg
- Marty Resnick
- Stephen White
- Kristina Laroccacerrone
- Ray Pun
- Jennifer Polk
- Emily Moquin
- Jason Mcnellis
- Jay Wilson
- Debbie Wilson
- Tony Iams
- Rajesh Kandaswamy
- Rick Franzosa
- Frances Russell
- Augusto Barros
- Jason Wong
- Marko Sillanpaa
- Bill Ray
- Craig Roth
- Augie Ray
- John Wheeler
- David Furlonger
- Christophe Uzureau
- Rick Lafond
- Danielle Henneberger
- Avivah Litan
- Daniel Sanchezreina
- Eric Schmitt
- Chris Ross
- Rene Buest
- Frank Buytendijk
- Jim Hare
- Michael Mccune
- Tim Barlow
- Manjunath Bhat
- Mike Mcguire
- Mark Raskino
- Claire Tassin
About
Comments or opinions expressed on this blog are those of the individual contributors only, and do not necessarily represent the views of Gartner, Inc. or its management. Readers may copy and redistribute blog postings on other blogs, or otherwise for private, non-commercial or journalistic purposes, with attribution to Gartner. This content may not be used for any other purposes in any other formats or media. The content on this blog is provided on an "as-is" basis. Gartner shall not be liable for any damages whatsoever arising out of the content or use of this blog.
