Ultra Secure Network Architecture

By PCIGuru

My former employer took down my page on this topic. Fortunately, I had it backed up. So here is the original Ultra Secure Network article.

200511-TheUltraSecureNetworkArchitecture

9 Responses to “Ultra Secure Network Architecture”

Feed for this Entry Trackback Address

1 Stacy
December 8, 2021 at 10:32 AM

I really like the image “Ultra-Secure” Web-based Network Architecture, and would like to use it (or a close facsimile, perhaps with some updates) in a presentation. Would that be alright, and if so, how would you prefer to be credited?

Reply
- 2 PCIGuru
  December 12, 2021 at 2:19 PM
  
  You are welcome to use it. Credit it as from Jeff Hall, aka PCI Guru.
  
  I keep meaning to update this, but just have not found the time.
  
  Reply
3 John Thomas
March 25, 2018 at 6:04 AM

Like all your posts, this is excellent reading. Middle of writing a RoC and Googling for a particular FAQ I couldn’t recall the number of I came across this and read it. Still great work. As a QSA doing 10 or more RoC a year, I find your writings awesome.
John T

Reply
- 4 PCIGuru
  March 29, 2018 at 4:03 PM
  
  Thank you. I really appreciate the kind words.
  
  Reply
5 Jake Gibb
November 23, 2016 at 12:09 PM

With the onset of virtual switching and SDN how does the PCI Council adopt this in a secure acceptable deployment? There are numerous PCI and PCI-DSS certified cloud providers stating they are compliant in a IaaS design or full on VDC. Thoughts?

Reply
- 6 PCIGuru
  November 23, 2016 at 2:08 PM
  
  A very good question. However I would argue that the controls required by the PCI DSS and other PCI standards transfer over to software defined networks (SDN) and virtualized networks. This is no different with other virtual environments for servers and storage.
  
  Where I have encountered problems is in how those controls are implemented and managed. Most providers and their customers run into trouble because too many people/processes have access and can make changes that could affect security. That needs to be locked down which can result in issues with provisioning and operations. But that is the whole point of those controls is to lock things down so that changes are NOT easily made without necessary consideration and approvals.
  
  Reply
7 Louis Seefried
October 13, 2014 at 5:22 PM

I enjoyed looking at this.

I saw something similar but it actually went a little further in regards to using different firewall vendors for each layer, IPS/IDS technology spanned with the firewalls (different IPS/IDS technology at each level), segregation by OS to some extent and the use of a backup network as well to prevent the backup traffic from clogging the production or management network.

Reply
- 8 PCIGuru
  October 14, 2014 at 1:42 PM
  
  It is now seven years old. Someday when I have time, I’ll update this to something more current.
  
  Reply
  - 9 Javier
    October 15, 2014 at 8:05 AM
    
    I would like to see that 🙂