PCI DSS Compliance Through Network Segmentation: A Complete Technical Walkthrough

PCI DSS is a security standard that encompasses not only the level of control but also the architectural aspects of the infrastructure. There are not as many decisions that directly impact the scope of compliance, and network segmentation is one of them.

Each new system that is added to the PCI scope creates some new challenges, such are more controls to audit, more logs to review, and others. A forgotten DNS server can pull half of the network into the scope.

Here, network segmentation testing is extremely important because it functions as a strategic boundary that shows where compliance starts and ends.

Defining Network Segmentation Testing  

Network segmentation testing can be described as a process of verifying that all the controls, such as firewalls, ACLs, and cloud-native rules, are isolated in CDE (Cardholder Data Environment) from the rest of the network. Such an approach guarantees that there won’t be any unintended communications between CDE and non-CDE systems.

The importance of Test Network Segmentation

Actively minimize the surface of PCI audit

With the help of network segmentation, it is possible to reshape the PCI scope, and there are only a few options that can be done at the architectural level. This approach functions on the basis of the precise boundaries around CDE, so you can directly minimize the audit surface.

If you have a hybrid or large deployment, such a method can also reduce the operational friction, compliance time, and engineering overhead. This can be a significant factor for the environments where are high resource cost and audit complexity.

Slow down the attackers

With the flat networks, there are so many options for the attackers to enter the system, whereas segmented networks are way more secure.

In case segmentation validation is currently in your security posture, issues outside CDE won’t escalate to PCI issues. This may be accepted as pre-breach containment. For most PCI SDD Service Providers, this is a crucial factor that can show the maturity of the security posture.

Minimal privileges at the network level

Segmentation can be characterized as the last line of defense mechanisms. This means even when the roles are misconfigured, segmentations guarantee that systems can communicate with one another only when it is explicitly allowed.

With such an approach, it is possible to realize zero trust in security groups, VLANs, and also give a possibility of a physical audit trail. Such a level of audit trails is expected by most leading PCI QSA companies.

Checklist for the network segmentation

Before the initiation of any processing, check that:

• Sample systems are identified for the needed zone.
• CDE boundaries are well documented.
• There are available and prepared testing tools.
•  All the segmentation rules and ACLs are checked.
• Test results captured and logged.

Step-by-step process of network segmentation testing

Determination of Segmented zones and CDE

The initial step is the identification of the areas where all the cardholder information is processed. Once that is done, it is crucial to determine the map of the adjacent systems, such as servers, databases, DNS, or support tools.

Then, determine which systems should be segmented to be out of scope and which should be in scope.

Determine systems for testing

The following step is the choice of testing systems, which are out-of-scope and in-scope. This may relate to the different networks, cloud, and data centers, specifically those that deal with system management and authentication.

Bidirectional access test

This process relates to the usage of different tools such as traceroute or nmap. They will be necessary for checking whether systems in CDE can initiate interaction with the outside ones.

Once that stage is finished, you should be sure that interaction between CDE and outside systems is done only when necessary and in a fully controlled environment.

Check support services

There are lots of services that should be checked after the completion of the access testing. This relates to syslog, DNS, Active Directory, NTP, backup servers, and others that can unite segmented zones. They should check whether the indirect paths are not introduced through them.

Complete documentation about the results

The documentation process of all the results is as important as the other above-discussed steps. Try to save all the details and even screenshots that are needed. That will simplify lots of tasks for the security and compliance teams.

Record all the details regarding zones, hostnames, IPs, and segmentation rules. Then organized all the info in a structured format. Also, documentation should be mapped to the CDE inventory.

Standard testing scenarios

Now, let’s proceed to some segmentation strategies that are most commonly used.

VLAN-Only

For PCI DSS compliance, the usage of only VLAN segmentation is no longer sufficient. It should only be used if enforced with a firewall, ACLs, or other additional control levels. Usually, such segmentation has a setup that lacks documentation or traffic enforcement, so the system is pulled into PCI scope.

Cloud environments

Azure, AWS, and other cloud platforms usually use Network ACLs, Security Groups, and NSGs. Such an approach offers more flexibility, high dynamics, and is inclined to drift. The standard tasks, such as autoscaling and rule changes, can negatively impact the whole system and break isolation. That’s why it is highly recommended to conduct regular validation of egress and ingress rules.

Hybrid environment

When a couple of approaches are united, private links and VPN tunnels can negatively impact the isolated zone. That’s why it is needed to plan better segmentation enforcement at tunnel endpoints. Such an environment needs more attention to routing policies and traffic flows.

How to select a proper partner for segmentation validation?

Since requirement 11.4.5 makes segmentation more important than ever before, you should clearly understand how to choose the right partner. Here are a couple of important criteria to pay attention to:

Real experience in PCI DSS, not just random security testing

The chosen provider should deeply understand PCI DSS v4.0, specifically in the aspects of audit defensibility, scope reduction, and the interpretation of 11.4.5. One more great thing will be if the chosen provider also collaborates with audits.

Hybrid approach to testing

Issues with the segmentation are rarely noticed with the basic testing strategies. The problems are usually discovered in DNS fallbacks, implicit trust paths, and legacy firewall rules.

A good choice will be a provider that uses both manual validation the automated tools. The testing should be done on the actual traffic flows, and that will give a deeper understanding than just the usage of the PCI compliance scan.

Familiarity with your infrastructure

The chosen partner should have practical experience with your infrastructure, whether it is VLAN, cloud, or hybrid. That means, such experts will have a better understanding of which specific areas should be better tested.

Availability of proper documentation

When searching for a provider, you should expect to have deeper testing with the availability of structured documentation that mentions all the necessary aspects.

You should have access to command outputs, zone definitions, screenshots, risk justification, and more.

PCI DSS network segmentation requirements

Why segmentation is your necessity?

Segmentation is not a mandatory thing for PCI DSS. That’s why you should clearly understand why you need segmentation. Such an approach gives you more understanding regarding what should actually be audited, so you can focus more on specific efforts rather than on everything at the same time.

Requirement 11.4.5 brings segmentation

Together with v4.0, a new requirement 11.4.5 appeared. Where can you find mandates that segmentation should be verified once in 6 months at least. Validation is not just an optional variant, but an expectation.

Logical division isn’t enough

CDE should not just be conceptually isolated, but technically. This may be achieved via diversity of options such as firewalls, cloud-native controls such as Azure, VLANs, or ACLs. There should be actual evidence of isolation, not just plans and intents.

Exclude CDE-Non-CDE Interaction

The riskiest situation is when, through your system, it is possible to reach those areas that you have no idea of. The major priority is to make sure that there are no unintended paths between non-CDE and CDE. This may relate to the shared services such as management networks, NTP, and others.  

Testing after every shift

The testing should not be conducted just twice a year, but every time after the environmental shift. This can relate to the restructuring of cloud resources, firewall updates, decommissioned zones, and more.

Validation methods for Segmentation audits

• Port scans: tools such as nmap should specify some parts where communication between the systems is denied. Scan logs or screenshots should clearly specify protocols and blocked ports.
• Network diagrams: they should specify real-world routing with the segmented zones, communication paths, and boundaries.
• Access logs: include system logs that will specify denied access. This information is necessary for the validation of live traffic controls.
• PCI DSS 11.4.5 traceability: all the documentation process and testing should map to requirement 11.4.5. That is needed so the audits can easily trace evidence and understand its relevance.  

Closing remarks

Network segmentation is one of those strategic approaches that is beneficial for security as well as for the reduction of audit scope. When everything is correctly planned and implemented, there will be achieved clear boundaries around the most vulnerable systems.

Segmentation validation should be accepted as a change to tighten control rather than just an obligation.