Enterprises get new guidance on PCI compliance in virtual environments
PCI Security Standard Council's document should benefit greatly, analysts say
Computerworld - Enterprises got some much needed clarification on the implementation of PCI requirements in virtualized environments on Tuesday.
The PCI Security Standards Council, the body that administers the Payment Card Industry Data Security Standard (PCI DSS),has released a comprehensive set of guidelines that companies can use to ensure that their virtual environments are compliant with PCI requirements.
The council's 39-page guidance document (PDF document) describes in detail how each of the 12 broad PCI security controls that are mandated for logical environments, need to be applied in a virtual setting. One section provides examples of how virtualization can impact each PCI requirement, and recommends best practices for addressing them.
"The guidelines really address all aspects and usage of virtualization," by organizations that are covered under PCI rules, said Kurt Romer, chief security strategist at Citrix Systems and chairman of the PCI special interest group that drafted the document.
"We put out the document to help people understand how they should be looking at [virtualization]," from the PCI standpoint, Romer said.
One important area that the document covers relates to the hypervisor technologies that are used in hardware virtualization. The guidance makes it clear that hypervisors fall under the scope of PCI requirements if any virtual component connected to the hypervisor it is covered under PCI, he said.
Similarly, the document also makes some important recommendations for mixed-mode environments in which companies might choose to run PCI workloads alongside non-PCI data on the same virtual machine. The document for instance, spells out how in-scope and out of scope workloads need to be segmented and the additional measures needed to achieve that in a virtual environment, Romer said.
The PCI council's latest guidance also makes important recommendations with regard to PCI compliance in cloud environments. It spells out the extent to which enterprises are responsible for ensuring compliance and the extent to which cloud vendors are responding for ensuring the right controls are in place.
The document notes that companies which choose to have their PCI workloads hosted on multi-tenant, public cloud infrastructures need to ensure that their cloud vendors have additional controls for protecting their data.
Those challenges involved in protecting PCI data in a multi-tenant environment, "may make it impossible for some cloud-based services to operate in a PCI DSS compliant manner," the document noted. "Consequently, the burden for providing proof of PCI DSS compliance for a cloud-based service falls heavily on the cloud provider, and such proof should be accepted only based on rigorous evidence of adequate controls."


- Excel 2010 Cheat Sheet
- Register for this Computerworld Insider Cheat Sheet and gain access to hundreds of premium content articles, guides, product reviews and more.
- Demonstrate PCI Compliance through Better Change Management
- Demonstrating PCI compliance with policies and regulations is an IT necessity, especially when periodic audits are conducted. ITinvolve has a better approach to...
- Stop Hackers Before They Attack
- Hacktivism, Identify Theft, Financial Gain, Cyber War - regardless of motivation, stopping today's hackers requires a new proactive approach to protecting endpoints. Learn...
- A Proactive Approach to Server Security
- Learn why security-conscious organizations are taking a more proactive approach to server security. Download this Spire Research whitepaper to understand how you can...
- From the Frontline - Preventing APT
- Is your company's network secure? Are your endpoints and servers secured? Before you answer, read this case study on a US Military Command...
- Bit9 Parity Outperforms McAfee and Symantec
- Tolly Group conducted a review of APT attacks that were blocked and not blocked by vendors. Download the full report to see how... All Data Security White Papers
- Live Webcast
Data Privacy and Protection in Production Environments: New Research from Ponemon Institute - Date: Wednesday, June 13, 2012, 1:00 PM EDT / 10:00 AM PDT
In a recent study conducted by Ponemon Institute, fifty-five percent of respondents... - Data Privacy and Protection in Production Environments: New Research from Ponemon Institute
- Date: Wednesday, June 13, 2012, 1:00 PM EDT / 10:00 AM PDT
In a recent study conducted by Ponemon Institute, fifty-five percent of respondents... - Spear Phishing and the Modern Cyber Attack
- Learn how IT teams can protect against spear phishing tactics. Harry Sverdlove, chief technology officer of Bit9 offers a frank discussion about spear...
- Distributed Database Security with Real-time Monitoring
- View this demo and learn how IBM InfoSphere Guardium database activity monitoring can help protect your sensitive data in distributed DBMS environments with...
- InfoSphere Warehouse Packs Demo
- These flash modules make warehousing more tangible and relevant to business users through detailed explanations of the InfoSphere Warehouse Packs.
- Delivery Management -- Extending Lifecycle Management
- Date: Wednesday, June 20, 2012, 1:00 PM EDT
Siloed organizations continue doing the wrong things and doing things wrong, leading to increased costs,...
All Data Security Webcasts