3 ms·
It's been several years since I dealt with PCI, but the app I was on the team for handled $1B+ annually. Here's just a few points that I remember. Physically s
by cabaalis 8y ago
It's been several years since I dealt with PCI, but the app I was on the team for handled $1B+ annually. Here's just a few points that I remember.
Physically separate the key storage from the data storage. Different servers, different user auth mechanism. Make them compromise both systems.
Unique keys per client.
Use key-encrypting keys, periodically replace them.
PCI environment must be totally self contained and not mixed with standard working environment. If an employee is phished, their credentials for email/etc should not gain access to the env.
Don't allow developers to deploy or even read from prod db. Have a separate deployment team, all access to prod database audited via production tickets.