Now, remember that all of those requirements apply to every system,
process,
and person in your organization that stores
processes or transmits cardholder data, and everything connected to it.
And so although it isn't as such a PCI DSS requirement,
most organizations will try to minimize the cardholder data environment and
minimize the number of systems that are connected to it.
And that could accomplished by network and application segmentation.
And this application and network segmentation is thoroughly recommended,
not just because it simplifies the task of compliance,
but because it also should make it harder for
criminals to get hold of cardholder data,
because the fewer systems you have that store,
process, or transmit the data,
and the fewer systems that are connected to the cardholder data environment,
the smaller your attack surface.
But remember, this isn't a requirement of PCI DSS.
However,
most merchants do try and do this and they try and reduce the
scope of their PCI DSS environment because we all know that as
well as reducing the attack surface,
having less components that you need to apply and validate
all those 280 PCI DSS requirements to is bound to make
achieving compliance cheaper.
And that's not actually just the first time you get compliant,
but because the CDE is less complex,
it will make it simple to maintain compliance in the business as
usual activities after your first assessment.
And so, when you've got rid of a program,
because what typically happens is there's a PCI program it finishes,
it transitions into BAU, business as usual,
that the smaller the cardholder data environment,
the more chance there is of keeping those 280 controls going
and operating fully for the next 12 months.
But this recommendation to reduce the scope of the CDE and the
connected two systems comes with a serious warning.
You see, it can be dangerous because in my time,
I've seen lots of successful criminal attacks on merchants and
on payment service providers where the criminal compromised the
system that everyone thought was segmented away from the
cardholder data environment, it wasn't in the CDE,
it wasn't connected to the CDE,
but a criminal compromised that and it turned out that it wasn't segmented
well enough and the criminal used that not connected system to gain access
to the CDE and steal the cardholder data.
And so, the really vital thing is if you use segmentation,
to have part of your network that's not subject to PCI DSS,
and part of your networking systems that are,
that you penetration test really hard from the systems that are not
in scope to the systems that are in scope to make sure that you
can't compromise a not-in-scope system and then gain access to the
cardholder data environment.
So yeah, do segmentation, but test it really well.