3 ms·

Are you sure? I think that you may be mistaken. The bar is just set higher in a "virtualized environment"... "In a public cloud environment, additional control

by dfc 15y ago

Are you sure? I think that you may be mistaken. The bar is just set higher in a "virtualized environment"... "In a public cloud environment, additional controls must be implemented to compensate for the inherent risks and lack of visibility into the public cloud architecture. A public cloud environment could, for example, host hostile out-of-scope workloads on the same virtualization infrastructure as a cardholder data environment. More stringent preventive, detective, and corrective controls are required to offset the additional risk that a public cloud, or similar environment, could introduce to an entity’s CDE. These challenges may make it impossible for some cloud-based services to operate in a PCI DSS compliant manner. Consequently, the burden for providing proof of PCI DSS compliance for a cloud-based service falls heavily on the cloud provider, and such proof should be accepted only based on rigorous evidence of adequate controls." From: https://www.pcisecuritystandards.org/documents/Virtualization_InfoSupp_v2.pdf https://www.pcisecuritystandards.org/documents/Virtualizatio... Amazon: http://aws.amazon.com/security/ http://aws.amazon.com/security/

nirvdrum 15y ago
Amazon getting a PCI compliance pass was a big deal. The last time I looked, you needed to be able to ensure secure access to the facility, enumerate who has physical access to the hardware and when, and things of that effect. And you need to be able prove all that in the event you're ever compromised.
- ceejayoz 15y ago
  > The last time I looked, you needed to be able to ensure secure access to the facility, enumerate who has physical access to the hardware and when, and things of that effect. And you need to be able prove all that in the event you're ever compromised. None of that should be particularly difficult for a VPS provider as large as Linode.
  - epochwolf 15y ago
    > you needed to be able to ensure secure access to the facility This part isn't doable if you don't own the datacenter. Slicehost has a problem with this because they never owned the datacenters they used.
    - orofino 15y ago
      You don't need to own the datacenter, but you do need your own, secured space in a datacenter.
- dfc 15y ago
  Securing physical access is a requirement for anyone wishing to obtain pci compliance.

by dfc 15y ago

nirvdrum 15y ago

Amazon getting a PCI compliance pass was a big deal. The last time I looked, you needed to be able to ensure secure access to the facility, enumerate who has physical access to the hardware and when, and things of that effect. And you need to be able prove all that in the event you're ever compromised.

ceejayoz 15y ago
> The last time I looked, you needed to be able to ensure secure access to the facility, enumerate who has physical access to the hardware and when, and things of that effect. And you need to be able prove all that in the event you're ever compromised. None of that should be particularly difficult for a VPS provider as large as Linode.
- epochwolf 15y ago
  > you needed to be able to ensure secure access to the facility This part isn't doable if you don't own the datacenter. Slicehost has a problem with this because they never owned the datacenters they used.
  - orofino 15y ago
    You don't need to own the datacenter, but you do need your own, secured space in a datacenter.
dfc 15y ago
Securing physical access is a requirement for anyone wishing to obtain pci compliance.