Learn how PCI compliance in the cloud affects your organization. "The cloud" brings up an idea of something mysterious and far away, but in reality, “the cloud” is a third-party-managed physical server.
The image of a cloud brings up an idea of something mysterious and far away, but in reality, “the cloud” is a third-party-managed physical server. The same security controls that apply to data stored on a server apply to data stored “in the cloud.”
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security controls, mandated to a merchant by the major credit card brands, if that merchant accepts credit cards.
The 12 requirements of PCI compliance are:
Yes, you can store credit card information in the cloud. But, it must be encrypted. If you can avoid storing credit card data in the first place, it’s a better strategy for PCI DSS compliance and security. It’s not against PCI DSS compliance to keep credit card data in the cloud, you just have to make sure you secure it appropriately with strong encryption and some very specific items such as key rotation. Key rotation is when you retire an encryption key and replace it with a new encryption key. This helps you meet industry standards and follow cryptographic best practices.
PCI DSS Requirement 3 deals with encryption, key access, separation of keys, etc.
See also: PCI Compliance IT Checklists
There are some considerations to keep in mind if you use cloud server storage and are PCI compliant:
When you store data on someone else’s server, you don’t have as much control over the infrastructure or data access, so you are relying on them to do a good job. Since a CSP’s business model relies on providing secure data storage, we would assume that they are invested in providing you with a secure infrastructure you can rely on. But, it can’t hurt to do your homework.
That being said, from a PCI perspective, you will want to make sure you have an AOC from your CSP on file. The PCI DSS requires that a business verifies their CSP is PCI DSS compliant on an annual basis in the form of a statement that acknowledges the CSP’s responsibility for PCI DSS compliance. If the CSP is PCI DSS compliant, they should already be providing that to customers anyway.
There are more businesses using the cloud infrastructure than just yours. That’s where the big risk lies. In this shared infrastructure, can someone break out of their environment and get unauthorized access to your data? How do you address this risk? Through encryption.
If you are PCI DSS compliant, your stored credit card numbers should already be protected with secure encryption no matter where they are stored. If they are stored in a cloud server environment, they need to be protected even more so. The bottom line is that you are entrusting a third party to protect and restrict access to your sensitive data.
Your CSP needs to clearly outline roles, responsibilities, and what will be done with your data. Clearly document what they provide and clearly ensure that you know what you are supposed to do. This is not only best practice, but it’s also a requirement from PCI section 12.
One major difference between storing protected health information (PHI) and credit card information in the cloud is the level of access: HIPAA requires that you track access to PHI and that you verify the access is appropriate. If you need to be HIPAA compliant in a cloud environment, you need to make sure those features are available in the cloud.
But in the PCI DSS realm, it would be preferable to have NO access to the credit card data stored in the cloud. The less available the credit card data, the better for PCI. If you are a non-healthcare merchant, you will likely still be able to run your business even if you can’t easily access stored credit card data–the bigger concern is data security. If you are a healthcare organization, access to PHI is crucial to both organizational function and HIPAA. Not having access to PHI could cripple your ability to function.
PCI DSS compliance is not all that different from PCI DSS compliance as it applies to on-site servers. The same controls are required, but when you use a cloud service provider, you need to take into account a third part and how they may affect your roles and responsibilities. To learn more about what the PCI Security Standards Council has said, check out their supplement, PCI SSC Cloud Guidelines.
.svg)
