Part 1 - What, Why and How / The landing zone of a PCI-DSS compliant application inside Microsoft Azure

This is the first article from a series of them about how to build a PCI-DSS-compliant application on top of Microsoft Azure and Kubernetes. Together we cover the journey of building a PCI-DSS compliant application. The final output is a blueprint that can be used as a starting point to build an application.

What is PCI-DSS?

Payment Card Industry Data Security Standard is a regulatory requirement that aims to secure credit and debit card transactions against data theft and fraud. The compliance is divided into 4 levels depending on the number of transactions. Level 1 starts at 6M transactions per year compared to Level 4, with less than 20k transactions per year.

Each level involves different levels of audit, as we can see below:

Level 4: yearly SAQ assessment + quarterly PCI scan (may be required)
Level 3: yearly SAQ assessment + quarterly PCI scan (may be required)
Level 2: yearly SAQ assessment + quarterly PCI scan (may be required)
Level 1: yearly an internal audit by an authorized PCI auditor + quarterly a PCI scan by an ASV (Approved Scanning Vendor)

PCI-DSS Core Mission

Increase and enhance the cardholder data security for the organizations that transmit, process and store credit card data by reducing the vulnerabilities and preventing fraud. This is done by increasing the control at all layers where cardholder data is transmitted, processed and stored.

The standard applies to all legal entities that maintain CDE (Cardholder Data Environment) from banks that issue credit cards and online payment services to retail or service providers that offer online services for payment processing.

The technical view

From the technical point of view, PIC-DSS requirements cover 6 main categories: Security network, Secure cardholder data, Vulnerability management, Access Control, Networking monitoring and testing. Let's take a look in more detail at what each of these categories requires:

Secure network:

- Firewall needs to be installed and managed

- System password needs to be in place and not inherited from the vendor

Secure cardholder data:

- Stored data of the cardholder must be protected

- Cardholder information transmitted over the network needs to be protected (encrypted)

Vulnerability Management:

- Anti-virus software must be used and managed (updated)

- Secure application and system needs to be developed and maintained

Access control:

- Access to cardholder data must be restricted to business need-to-know basic

- Unique ID must be assigned for each person with computer access cardholder

- Physical access to cardholders must be restricted a

Network monitoring and testing:

- The access to cardholder data and network resources must be monitored and tracked

- Security systems and processes must be regularly tested

Information security:

- Maintain a policy that addresses information security for all personal

In total, there are over 300 requirements that are grouped into the above 12 categories. Depending on the category some requirements are prescriptive related to the technology and products that need to be used.

PCI-DSS and Cloud

Yes, it is! What do we mean by YES? Large cloud providers like AWS, Google Cloud and Microsoft Azure provide services that are certified as a PCI-DSS Level 1 Service Provider. Each cloud vendor offers a list of services certified as PIC-DSS Level 1, but it doesn't mean that all their services are certified.

The service certification can be only for specific tiers. For example, there are tiers from different computation services that are not certified because they are using a shared model and not dedicated resources. It is up to us how we use, configure and build the application on top of them.

Above, we can see an extract from Microsoft Azure Compliance Offerings where two services are not certified.

Why Database Modernization Matters for AI

When companies transition to the cloud, they typically begin with applications and virtual machines, which is often the easier part of the process. The actual complexity arises later when databases are moved. To save time and effort, cloud adoption is more of a cloud migration in an IaaS manner, fulfilling current, but not future needs. Even organisations that are already in the cloud find that their databases, although “migrated,” are not genuinely modernised. This disparity becomes particularly evident when they begin to explore AI technologies. Understanding Modernisation Beyond Migration Database modernisation is distinct from merely relocating an outdated database to Azure. It's about making your data layer ready for future needs, like automation, real-time analytics, and AI capabilities. AI needs high throughput, which can be achieved using native DB cloud capabilities. When your database runs in a traditional setup (even hosted in the cloud), in that case, you will enc...

Cloud Myths: Migrating to the cloud is quick and easy (Pill 2 of 5 / Cloud Pills)

The idea that migration to the cloud is simple, straightforward and rapid is a wrong assumption. It’s a common misconception of business stakeholders that generates delays, budget overruns and technical dept. A migration requires laborious planning, technical expertise and a rigorous process. Migrations, especially cloud migrations, are not one-size-fits-all journeys. One of the most critical steps is under evaluation, under budget and under consideration. The evaluation phase, where existing infrastructure, applications, database, network and the end-to-end estate are evaluated and mapped to a cloud strategy, is crucial to ensure the success of cloud migration. Additional factors such as security, compliance, and system dependencies increase the complexity of cloud migration. A misconception regarding lift-and-shits is that they are fast and cheap. Moving applications to the cloud without changes does not provide the capability to optimise costs and performance, leading to ...

Cloud Myths: Cloud is Cheaper (Pill 1 of 5 / Cloud Pills)

Cloud Myths: Cloud is Cheaper (Pill 1 of 5 / Cloud Pills) The idea that moving to the cloud reduces the costs is a common misconception. The cloud infrastructure provides flexibility, scalability, and better CAPEX, but it does not guarantee lower costs without proper optimisation and management of the cloud services and infrastructure. Idle and unused resources, overprovisioning, oversize databases, and unnecessary data transfer can increase running costs. The regional pricing mode, multi-cloud complexity, and cost variety add extra complexity to the cost function. Cloud adoption without a cost governance strategy can result in unexpected expenses. Improper usage, combined with a pay-as-you-go model, can result in a nightmare for business stakeholders who cannot track and manage the monthly costs. Cloud-native services such as AI services, managed databases, and analytics platforms are powerful, provide out-of-the-shelve capabilities, and increase business agility and innovation. H...

Cloud as a Story - Vunvulea Radu

Search This Blog