3 ms·

> Rewrite every software, so that every programs handle their own private keys ? Yeah, that's a nightmare, not gonna happen. PCI 4.0 disallows using Full Disk

> Rewrite every software, so that every programs handle their own private keys ? Yeah, that's a nightmare, not gonna happen. PCI 4.0 disallows using Full Disk Encryption to fulfill its encryption at rest requirements, because it demands a finer-grained encryption authorization model. For applications subject to PCI 4.0 compliance, my clients have to encrypt beyond the application level, and down to the service account level used by the application (most of these applications use multiple service accounts for representing teams that use the applications), with different files encrypted for different authorization groups. There are very few enterprise scale solutions addressing this at the moment, and the stopgap I've seen is indeed the application teams are resorting to handling their own keys if the enterprise doesn't offer a finer-grained solution. The QSA's don't yet understand how seismic a shift this is, nor how inadequate the assumed authorization schema is for the many edge cases out there that will be unable to adopt the assumption a single key for a single group is sufficient to model all use cases. It will be a little messy until folks sort through the edge cases coming down the pike.

motymichaely 2y ago
You’re absolutely right! Full disk encryption (FDE) does indeed fall short of PCI 4.0 requirements because it transparently decrypts data for anything running on the OS or accessed by the user, which isn't sufficient for finer-grained control. PCI 4.0 demands more granular encryption authorization models, where data is either encrypted at the file or column level, or access to plain data is restricted to more specific roles than just the OS user account. This is to reduce the risk of unauthorized access. There are a few dev-centric data protection solutions that address these requirements seamlessly. These solutions allow you to store and encrypt any type of data with simple APIs while transparently managing keys, rotation, and granular access controls. I am currently evaluating Piiano Vault (https://www.piiano.com/pii-data-privacy-vault https://www.piiano.com/pii-data-privacy-vault) as one such solution for a new product that I am currently working on that would require a PCI compliant zero-data solution. Seems like its delivery model is very flexible - it can be fully self-hosted or consumed as a managed SaaS, providing robust data protection tailored to my specific needs. Will update with my findings!

motymichaely 2y ago

You’re absolutely right! Full disk encryption (FDE) does indeed fall short of PCI 4.0 requirements because it transparently decrypts data for anything running on the OS or accessed by the user, which isn't sufficient for finer-grained control. PCI 4.0 demands more granular encryption authorization models, where data is either encrypted at the file or column level, or access to plain data is restricted to more specific roles than just the OS user account. This is to reduce the risk of unauthorized access. There are a few dev-centric data protection solutions that address these requirements seamlessly. These solutions allow you to store and encrypt any type of data with simple APIs while transparently managing keys, rotation, and granular access controls. I am currently evaluating Piiano Vault (https://www.piiano.com/pii-data-privacy-vault https://www.piiano.com/pii-data-privacy-vault) as one such solution for a new product that I am currently working on that would require a PCI compliant zero-data solution. Seems like its delivery model is very flexible - it can be fully self-hosted or consumed as a managed SaaS, providing robust data protection tailored to my specific needs. Will update with my findings!