PCI compliance in the cloud: challenges and best practices

Every year, the cloud becomes more dominant as a hosting and delivery system for businesses. Online merchants rely on the cloud to transfer and store credit card information. At the same time, companies must secure financial data stored in the cloud. If they fail to do so, businesses risk data breaches, loss of customer trust, and PCI-DSS penalties.

This article explores how PCI-DSS regulations relate to cloud environments. This is not a simple matter. Data protection systems for on-premises or network-hosted assets are not always transferrable to the cloud. And meeting regulatory obligations can be complicated without proper planning.

Key takeaways

• The cloud's dominance in hosting and delivering services requires businesses to prioritize PCI compliance. Organizations must protect credit card information to avoid data breaches and penalties.
• Cloud environments present unique PCI-DSS compliance challenges. This is due to shared responsibility with CSPs, complex deployments, and constant changes.
• To meet essential PCI requirements cloud merchants should ensure data encryption, adopt secure data management, and implement access controls.
• Companies should choose PCI-compliant cloud providers, implement secure configurations, encrypt data in transit and at rest, and adopt secure DevOps practices.
• Ensuring physical security, regular security testing, and monitoring access are critical for maintaining PCI compliance in cloud-based cardholder data environments.

Understanding PCI compliance in the cloud

PCI-DSS certification proves that an organization complies with PCI data security rules. This means that the organization has sufficient security controls to protect cardholder data. But only up to the standards required by PCI-DSS.

Sometimes PCI standards may be out of date or inadequate to meet business needs. Securing cloud environments is an example with important implications for online merchants.

Dynamic cloud environments also change constantly. Meeting PCI-DSS data protection requirements can be difficult when apps and storage containers change daily.

These reasons make it critical to understand PCI-DSS compliance in the cloud. Companies need strategies to deal with core PCI compliance challenges. Without a cloud security strategy, data breaches and regulatory penalties are extremely likely.

Challenges in cloud PCI compliance

Businesses operating in the cloud face a range of PCI-DSS compliance challenges. Important examples include:

1. Achieving PCI-DSS compliance in complex cloud environments

PCI-compliant organizations know the location of critical data at all times. Every piece of cardholder data is encrypted, logged, and secured. Data flows are also legible and encrypted. No grey areas or storage containers should be beyond the view of administrators.

This is not always easy in complex cloud deployments. Data may be held in multiple locations. This makes it harder to apply network segmentation to separate the cardholder data environment from the wider network.

Cloud environments may involve numerous third-party providers. Authenticating and authorizing third parties can be challenging. Companies need to ensure that third-party organizations have suitable security controls and meet PCI-DSS requirements.

Cloud deployments can also change rapidly. The cloud allows flexible app development. IT teams can provision resources as required, adding new users, services, or storage systems. But every new element of the cloud environment must be secure. Ensuring a consistent cloud security policy can become extremely challenging.

2. Managing large amounts of cardholder data in the cloud

Larger companies process thousands or millions of customer records. Every item of personal information must remain private. Consistent data retention systems must delete financial information according to PCI-DSS guidelines. However, achieving this level of control is difficult in cloud environments.

Companies must ensure that data is stored in jurisdictions that meet PCI-DSS requirements. They must apply segmentation to all cardholder databases and make sure that their CSPs encrypt data to the required standard. Organizations need to manage their encryption keys, creating secure key storage containers. These core security tasks are difficult at scale.

PCI-DSS regulations also demand tight auditing of cardholder data. Security teams may struggle to audit data flows in complex cloud environments. Incident response times can increase while the quality of audit logs declines.

3. Securing public cloud deployments

The core problem with public cloud systems is control. In the public cloud, organizations rarely manage their underlying infrastructure. And they rely on SaaS apps to deliver services.

This style of deployment allows companies to rapidly develop efficient sales and customer management systems. But relying on public cloud infrastructure brings a series of PCI compliance challenges.

For instance, companies need to check every CSP they work with. Off-the-shelf public cloud providers may not meet PCI compliance standards. And their data security systems may not be suitable for all cloud business platforms.

Public cloud deployments also tend to scale easily, and sometimes, this creates security problems. Dynamic infrastructure delivers many benefits. But adding new access systems or web assets can create new pathways to the CDE. Every addition to cloud deployments must be secured to PCI standards.

4. Showing evidence of compliance in the cloud

Proving evidence of compliance is a critical element of PCI-DSS requirements. Companies must generate audit trails showing user activity and access requests. Administrators should be able to track any changes to network assets. Every item of cardholder data should be recorded and tracked.

The cloud presents some important challenges to this auditing model. Assets may be located worldwide and hosted by many providers. Data may also be subject to a huge range of security controls. Auditors need to verify the integrity of these controls, creating a huge workload in complex cloud settings.

Auditors need to prove that data is protected from breaches in multi-tenancy environments. They must document and verify physical security controls at each storage location. And they may have to assess an array of cloud APIs when working with third-party providers.

In some cases, auditors struggle to obtain access to hosting infrastructure. This makes it virtually impossible to carry out thorough PCI-DSS assessments. Proving compliance becomes very difficult.

Essential PCI requirements applicable to cloud environments

The PCI-DSS regulatory framework is built around 12 PCI compliance requirements. These requirements provide a guide to achieving compliance. However, applying the core PCI principles is not always simple.

The list below covers PCI requirements that apply to cloud environments. Requirements 7-9 are general access control and authentication issues that are not cloud-specific. But the other elements all relate to important cloud security concerns.

Requirement 1: Put in place firewall protection

PCI-DSS-compliant companies should invest in cloud-native firewalls that reside alongside cloud assets. Make use of firewalls provided by hosting providers. And document every firewall configuration as part of your information security policies.

Requirement 2: Avoid Vendor-Supplied Defaults

PCI rules require changes to every default password. This applies to cloud apps as much as physical routers. Change default settings when adding new cloud services. Use automated Cloud Security Posture Management (CSPM) tools to streamline app configuration and avoid human error.

Requirement 3: Protect stored Cardholder Data

PCI-DSS-compliant organizations should assess all CSPs and select partners that encrypt data to PCI standards. Use native encryption features on cloud services like Microsoft Azure or AWS. And use managed hosting providers that protect encryption keys according to PCI rules.

Requirement 4: Encrypting Cardholder Data in transit

PCI-DSS requires the use of strong encryption for all cardholder data transfers. Use later versions of TLS, or SFTP for all sensitive network traffic. Document the use of encryption protocols in security policies.

Requirement 5: Antivirus software

Every asset in the cloud environment should be protected by antivirus software. Ensure antivirus tools are compatible with CSPs, and automate patching processes to make sure antivirus software is up-to-date. If possible, integrate local endpoint protection systems with cloud-hosted antivirus tools. This delivers holistic threat detection across the network surface.

Requirement 6: Secure network systems and applications

IaaS and PaaS users must secure their app development processes. This includes real-time threat analysis to check for vulnerabilities. Code should be tested before deployment, and all cloud apps should be regularly updated.

Requirement 10: Monitor access to network endpoints and critical data

Use cloud-native threat detection systems to monitor cloud environment assets. All traffic entering the CDE should be monitored and logged. Systems should record all access requests and escalate suspicious behavior for security assessments. CSPs may also provide logging and analysis tools. Leverage these tools to supplement your security systems.

Requirement 11: Regular Security Testing and File Integrity Monitoring

CSPs often provide testing services to ensure PCI-DSS compliance. Organizations can use these tools to carry out quarterly network scans and highlight security vulnerabilities. Companies can also bring in third-party experts to carry out holistic scans that cover the entire cloud environment.

Requirement 12: Create and maintain policies to manage cloud security

Cloud policy management performs two important cloud security roles in the PCI-DSS framework. Firstly, policies document security controls for cloud resources. Readers know exactly how cloud assets are protected. This makes it easier to audit procedures and ensure a consistent level of security across the cloud environment.

Secondly, policy management informs cloud users about secure behavior and processes. Employees and other cloud users know how to access resources safely. Policies also include information about penalties for non-compliance. This allows admins to enforce secure user behavior at all times.

Best practices for achieving PCI-DSS compliance in the cloud

Using the cloud is not optional for most businesses. And PCI-DSS compliance is crucial for companies that handle credit card data. But how can organizations secure financial data in cloud environments?

This list of PCI-DSS best practices provides a solid foundation for companies seeking to meet their compliance obligations.

1. Choose PCI-compliant cloud providers

Check every potential cloud service provider before deployment. Compliant partners will have an Attestation of PCI-DSS Compliance and should provide full details of their compliance policies. Specifically, choose partners that provide:

• Secure and flexible encryption
• Compatibility with access controls
• Full activity logging for PCI audits
• Incident response features

2. Adopt secure configuration and management of cloud resources

Always change default vendor passwords and any other relevant configurations. Apply role-based controls to all cloud services and ensure that all apps are covered by encryption and threat detection systems. Automate updates to protect against exploits and configure cloud resources to provide PCI-compliant audit data.

3. Encrypt data and manage keys securely

Leverage data encryption tools provided by cloud service providers. 256-bit AES encryption should be sufficient to meet PCI requirements.

Remember to store encryption keys securely. Use key management systems supplied by your cloud service provider and rotate encryption keys regularly. Store any network-wide encryption keys in separate containers away from cardholder data. Use cloud key management systems to ensure consistent key management policies.

4. Implement secure transmission of cardholder data

Use the latest version of TLS to secure data in transit. Check PCI 4.0 regulations for the most recent guidance, as earlier versions of TLS and SSL have been deprecated. Couple strong encryption with network security tools like segmentation and firewall barriers. Implement robust access controls to ensure that only legitimate users can transfer cardholder data.

5. Put in place endpoint protection and cloud-native antivirus

Protect endpoints with cloud-native security solutions. Monitor all access points with real-time threat detection systems and firewall configurations. Install antivirus software that protects all cloud resources. And regularly update endpoint software and antivirus tools.

6. Follow secure DevOps practices in the cloud

Data security should be a component of every app development process. Require DevOps teams to adopt secure coding practices. Run vulnerability scans before deploying cloud services, and include code verification as part of the development pipeline. Secure DevOps environments with robust access controls.

7. Apply access monitoring and network security

Monitor and log access to the CDE, including user IDs, access times, and instances of failed access requests. Track user activity within the cardholder data environment. Ensure that every action generates an audit trail. Schedule regular reviews of access controls, and clean up unused accounts or accounts with excessive privileges.

Create a protected environment around the CDE with multi-factor authentication and role-based access controls. Apply Zero Trust principles to tightly restrict access to payment card industry data.

8. Regularly carry out security testing to detect vulnerabilities

Carry out quarterly scans on the cloud environment. Leverage tools supplied by your cloud service provider or bring in approved scanning vendors with cloud expertise. Remedy any vulnerabilities detected by scans. And log the results of security testing, whether vulnerabilities are discovered or not.

Cloud facilities and physical security for PCI compliance

Physical security is a common issue when securing cloud-based cardholder data environments. PCI-DSS rules require strict access controls for any devices that store or transfer cardholder data. This is not easy to achieve in cloud settings. But companies can optimize physical security by keeping these key considerations in mind:

• Choose CSPs that meet PCI-DSS standards. Check for certifications like ISO 27001 and a PCI Attestation of Compliance when sourcing cloud storage capacity. This demonstrates that CSPs operate appropriate physical security controls.
• Check physical controls for added verification. If possible, visit data storage or infrastructure hosting sites. Ensure that access is confined to authenticated personnel. Check for video surveillance and comprehensive access logs. If visits are impossible, make contact to double-check that these features are present.
• Demand assurances about data protection and destruction. Require data protection clauses in contracts signed with every cloud service provider. The Service Level Agreement (SLA) should include enforceable undertakings to protect and destroy data safely.

Adapt security practices to meet PCI-DSS regulations in the cloud

Companies must be aware of the challenges involved when making cloud computing systems PCI-compliant. Read our guide and apply cloud security best practices to lock down data and avoid data breaches. And make sure your cloud deployments are completely aligned with PCI requirements.