My former employer took down my page on this topic. Fortunately, I had it backed up. So here is the original Ultra Secure Network article.
Leave a Reply Cancel reply
Announcements
If you are posting a comment, be patient, as the comments will not be published until they are approved.
If your organization has a PCI opportunity, is in need of assistance with a PCI issue or if you would like the PCI Guru to speak at your meeting, you can contact the PCI Guru at pciguru AT gmail DOT com.
I do allow vendors to post potential solutions in response to issues that I bring up in posts. However, the PCI Guru does not endorse any specific products, so "Caveat Emptor" - let the buyer beware. Also, if I feel that the response is too "sales-ee", I reserve the right to edit or not even authorize the response.
PCI Guru Search
PCI Guru Recent Posts
- Join Me On September 3
- PCI Dream Team Is Back On BrightTalk
- The Security/Compliance Disconnect
- The 2020 PCI Community Meetings Go Virtual
- DevOps And PCI – Part 2
- DevOps And PCI – Part 1
- The Last (Hopefully) Scoping Discussion
- Upcoming PCI Dream Team Events
- The Joke That Is SAQ A
- Surprise! PCI Largely Ignores Disaster Recovery
PCI Guru Top Posts
- One-, Two-, And Three-Factor Authentication
- PCI Compliance Scam? You Tell Me
- Ultra Secure Network Architecture
- Network Segmentation Testing
- Third Party Service Provider PCI Compliance
- In Scope versus Out of Scope
- Links To Card Brand Security Programs
- Work From Home PCI Considerations
- Disaster Recovery And PCI
- DevOps And PCI – Part 1
Blogroll
- Anton Chuvakin Blog – "Security Warrior"
- Chip and PIN Blog
- Froud On Fraud
- Herjavec Group Blog
- Krebs On Security
- Nige The Security Guy
- NuArx Blog
- Online Business Systems Blog
- PCI DSS News And Information
- PCI France
- Postmodern Security
- PYMNTS.com
- SANS Cloud Blog
- Shift4 4titude Blog
- Ultra Secure Network Architecture
Professional Organizations
- Carnegie Mellon University CERT Division
- ETA's Encyclopedia Of Terminology
- Information Systems Audit and Control Association (ISACA)
- Information Systems Security Association (ISSA)
- InfraGard
- NIST Computer Security Resource Center
- PCI Security Standards Council
- US Department of Homeland Security CERT
Calendar
| M | T | W | T | F | S | S |
|---|---|---|---|---|---|---|
| 1 | 2 | 3 | 4 | 5 | 6 | |
| 7 | 8 | 9 | 10 | 11 | 12 | 13 |
| 14 | 15 | 16 | 17 | 18 | 19 | 20 |
| 21 | 22 | 23 | 24 | 25 | 26 | 27 |
| 28 | 29 | 30 | ||||
Like all your posts, this is excellent reading. Middle of writing a RoC and Googling for a particular FAQ I couldn’t recall the number of I came across this and read it. Still great work. As a QSA doing 10 or more RoC a year, I find your writings awesome.
John T
Thank you. I really appreciate the kind words.
With the onset of virtual switching and SDN how does the PCI Council adopt this in a secure acceptable deployment? There are numerous PCI and PCI-DSS certified cloud providers stating they are compliant in a IaaS design or full on VDC. Thoughts?
A very good question. However I would argue that the controls required by the PCI DSS and other PCI standards transfer over to software defined networks (SDN) and virtualized networks. This is no different with other virtual environments for servers and storage.
Where I have encountered problems is in how those controls are implemented and managed. Most providers and their customers run into trouble because too many people/processes have access and can make changes that could affect security. That needs to be locked down which can result in issues with provisioning and operations. But that is the whole point of those controls is to lock things down so that changes are NOT easily made without necessary consideration and approvals.
I enjoyed looking at this.
I saw something similar but it actually went a little further in regards to using different firewall vendors for each layer, IPS/IDS technology spanned with the firewalls (different IPS/IDS technology at each level), segregation by OS to some extent and the use of a backup network as well to prevent the backup traffic from clogging the production or management network.
It is now seven years old. Someday when I have time, I’ll update this to something more current.
I would like to see that 🙂