Segmenting a Network for PCI Compliance - Nightmare!

[Keydogg]

Hi,

I'm currently having a nightmare at work trying to become PCI Compliant with our Card Merchant. For those who have never heard of PCI, it is basically a requirement for any business who have a card machine for taking VISA, Mastercard etc payments which means that you must protect the cardholder's data.

From what I gather this basically means that if your card machine is attached to your network (which ours is), then you must take action to make sure that "Rogue" systems cannot get access to that network and possible hack the card machine. I have read up on this and the only advice I can get is to physically separate the card machine onto it's own individual network and for that I would have to purchase and install a stand-alone firewall at the router and then create some network infrastructure to get back to the card machine which it 3 rooms away from the router, or of course take away all wireless APs and then we can't offer Free WiFi to our customers which we like doing.

My question is does anyone have another way around this? It's going to be a massive upheaval to install another network and I really can't be arsed with it!

My network is as follows:

Any help would be greatly appreciated.

 

[*Badger*]

Separate VLANs and Access Control Lists surely then some data encryption?

 

[Keydogg]

Badger: I'm a bit of a novice when it comes to proper networking. I've set up multiple home networks but never gone too advanced however am a pretty quick learner when it comes to this stuff because it interests me.

To create separate VLANs does that mean use different subnets? All the LANs I have ever made have all used the same IP tree and subnet (192.168.1.x and 255.255.255.0).

 

[*Badger*]

Yeah split your /24 into separate subnets, and assign each subnet to a VLAN.
Subnetting is easy, just decide either how many hosts you need, or how many networks you need first and calculate.

 

[ChrisR]

Are you ever transmitting cardholder data over wireless, or is all that happening just over wired?

I'm sure you have done already, but make sure you take a look at all the stuff on the PCI site that can be useful, docs like this

https://www.pcisecuritystandards.org/pdfs/PCI_DSS_Wireless_Guidelines.pdf

From what I remember with PCI you need to firewall off your non CDE from your CDE, VLANS aren't enough iirc.

 

[Jay_A]

Have a look at the p2pe (point to point encryption) documents. https://www.pcisecuritystandards.org/security_standards/documents.php?association=P2PE

If your card machine supports the new standard, then you maybe able to mitigate the issue that way.

 

[iain187]

Separate VLANs and Access Control Lists surely then some data encryption?

not had to deal with peoples monies before but i really hope you cant get away with vlans!


edit: ok you cant