PCI compliance is a steep enough challenge, but what happens when your entire infrastructure is in AWS? Do the same concepts of network segmentation and separation apply, and if so how? At what point do AWS compliance efforts intersect with your compliance efforts? This session will cover how Warren Rogers Associates is using the Palo Alto Networks VM-Series for AWS to maintain separation of data and traffic in AWS to improve security and achieve PCI compliance. Warren Rogers Associates pioneered the development of Statistical Inventory Reconciliation Analysis (SIRA) and Continual Reconciliation for monitoring underground fuel tanks and associated lines. These methods are certified in accordance with EPA requirements and have been used by petroleum marketers for more than 25 years. Today, Warren Rogers specializes in statistical analysis and precision fuel system diagnostics for the retail petroleum industry and develops innovative ways to identify and combat fuel shrinkage and theft. Session sponsored by Palo Alto Networks.

1. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Matt McLimans, Network Security Engineer
Warren Rogers
August 11, 2016
Can You Achieve PCI Compliance in AWS?

2. So, what is this presentation about?
This is a true story of how I built a PCI Compliant
solution using Palo Alto Networks.
While securing thousands of endpoint devices using
GlobalProtect and Palo Alto Networks VM-Series
Firewalls within Amazon Web Services.

3. Content
Start Up
• About Warren Rogers
• Warren Rogers Data Collection Operation
PCI DSS Compliance
• Crash Course
• Levels & Requirements of PCI DSS 3.1
PCI Compliance within AWS
• AWS Security as a Whole
• Services & Regions
• Shared Responsibility
Warren Rogers PCI Plan
• Using Palo Alto Networks
• GlobalProtect & LSVPN
• Data Filtering & Policy Implementation
Wrap Up
• Palo Alto Networks tackling PCI, Tips, & Q&A

4. Warren Rogers Services
All-Point monitoring system that
provides the most accurate and
complete information of the fueling
operation.
Reporting Options
• Variance reports
• Tank activity
• Sales by hour
• Dispenser/Probe out
summary
• Delivery reports
• Unexplained removals

5. Customer Store Network
Warren Rogers’ Network
Our Operation
Our device
“OSP”

6. Aspects to Note
Deployments:
• On-Premise
• AWS Cloud
• Hybridized Deployment
Compliance Regulations:
• PCI DSS 3.1
• HIPAA
• SSAE-16
• And many more…

7. CRASH COURSE
PCI compliance and why it is important to you.

8. PCI DSS Players
Card Brands
Created the SSC. They are
responsible for approving
DSS controls and
framework.
PCI SSC
Developed the DSS, PA-
DSS, & PIN Standards.
They conduct training and
certification for QSAs and
ASVs.
Acquirers
Banks and payment
processors that are
responsible for enforcing the
DSS.
Merchants
Responsible for
implementing DSS controls
and demonstrating
compliance.

9. Merchant Levels
LEVEL 1:
• > 6 million transactions per year.
• Need QSA to validate.
LEVEL 2:
• 1 to 6 million transactions per year.
• Need QSA to validate.
LEVEL 3 & 4:
• < 1 million transactions per year.
• Can self-assess via the SAQ.
Knowing
your level is
critically
important to
achieving PCI
compliance
effectively.
Requirements v. Validation
SAQ v. QSA

10. A Simple Question
Yes
Do I have
to be PCI
Compliant?
Do you
handle
CHD?
No
You must
be
compliant.
You do not
need to be
compliant.
But I only
handle 1 card
number!

11. Myth 1: Compliance makes
my organization secure.
Why?
• Compliance is a snapshot in time.
• One size does not fit all.
• Vagueness among requirements.
“on devices not commonly
affected by malware.”
Usage
• Compliance as a “base-line security
model.”
• Encourage a continuous and vigilant
security culture.
Compliance does not equal security.

12. Myth 2: One vendor and one
product makes me compliant.
Neither one vendor nor one product
will make you compliant.
• Over-promising and under
delivering.
• “Silver Bullet” effect.
Implement holistic security strategy:
1. Technology
2. Infrastructure
3. People

13. A WALK THROUGH
PCI Compliance on AWS

14. AWS Security as a Whole
CISO probably likes AWS Security for
the following reasons:
1. Greater transparency
• All security in a single location.
2. Reinforcement of traditional
security measures
• Controls through automation.
• Relying on best practice
templates  specialization.
• Eliminates mistakes.
transparency
AWS is more
secure than
our on-premise
datacenter
CISO

15. AWS as Level 1 Service Provider
A BA B
Lowest cost PCI
complaint cloud
service.
Reduce and simplify
scoped environment.
If required,
provides forensic
investigations

16. Is there a special PCI Compliant environment I
need to specify when bringing up servers or
uploading objects to store?
No!

17. AWS PCI Compliant Services
CloudWatch BeanStalk
SNSSES
FederationIAMCloud TrailCloud FormationOpsWork
SQS Elastic Transcoder Cloud Search SWF
Dynamo ElastiCache RedShift EMR DataPipeline Kinesis CloudFront
Ec2 WorkSpaces S3 Route53ELBDirect ConnectStorage Gateway VPCGlacier
Monitoring Deployment & Management Identity & Access
Application Services
Databases Analytics
Compute Storage Networking
Content Delivery
AppStream
EBS
Deployment
&Management
Application
ServicesFoundationServices
RDS

18. Is AWS compliance
applicable globally?

20. Can I rely on the results of the AWS
PCI Report on Compliance?
….or will additional testing be
required to be fully compliant?

21. What is your responsibility to achieve
compliance?
Security of the Cloud v. Security in the Cloud
Responsibility Matrix

22. Platform, Applications, Identity & Access Management
Operating System, Network & Firewall Configuration
Client side Data
Encryption & Data Integrity
Authentication
Server-Side
(File System and/or Data)
Network Traffic Protection
Encryption/
Integrity/Identity
Customer Data
Storage Database Networking
Edge Locations
Regions
Availability Zones
Compute
AWS Global
Infrastructure
Customer Responsibility
Security in the Cloud
AWS Responsibility
Security of the Cloud
Shared Responsibility Model

23. Requirement
AWS
Responsibility
Customer
Responsibility
Req.1 Install and maintain a firewall configuration to protect cardholder data.
Req. 2 Do not use supplier-supplied defaults for system passwords and other security parameters.
Req. 3 Protect stored cardholder data.
Req. 4 Encrypt transmission of cardholder data across open, public, networks
Req. 5 Use and regularly update anti-virus software or programs.
Req. 6 Develop and maintain secure systems and applications.
Req. 7 Restrict access to cardholder data by business need-to-know.
Req. 8 Assign a unique ID to each person with computer access.
Req. 9 Restrict physical access to cardholder data.
Req. 10 Track and monitor all access to network resources and cardholder data.
Req. 11 Regularly test security systems and processes.
Req. 12 Maintain a policy that addresses information security for employees and contractors.
Responsibility Matrix

24. In other words…
Your QSA can rely on AWS’s PCI compliance.
But you are responsible for satisfying all testing requirements
including management and documentation.

25. WARREN ROGERS PCI PLAN
Using Amazon Web Services & Palo Alto Networks

26. Customer Store Network
Warren Rogers’ Network
The PCI Challenge for Warren Rogers
How do we protect ourselves?

27. Obstacles
Challenges
1. Previously non-compliant.
2. Thousands of remote devices.
3. Various deployments within diverse
customer environments.
Questions to Answer
1. How can we secure transmission to
AWS?
2. How do we know if we inadvertently
collect cardholder data?
3. How do we ensure all our boxes are
running PCI required applications?
4. How can we standardized access to our
OSPs?

28. CIDR: 10.0.0.0/16 CIDR: 172.17.0.0/24 CIDR: 192.168.3.0/8
Customer A Network Customer B Network Customer n Network
What we had…
Warren Rogers Network
VPN
Client 1
VPN
Client 2
VPN
Client n
Secure Comm.
One Access
Method
WR Custom IP Range 1 WR Custom IP Range 3WR Custom IP Range 2
Warren Rogers Network
Customer A Network Customer B Network Customer n Network
What we wanted…

29. Using Palo Alto Networks to
Achieve Our Goal
GlobalProtect
• Encryption
• HIP Profiles
LSVPN
• Reducing latency
• Increasing redundancy
• Increasing global presence
Access Policies
• Data filtering
• Removing uncertainty
• Jump server

30. GlobalProtect: Use Case
A Unique Deployment
• Installed on OSP
• Pre-Log On
Benefits
• User-ID
• Exceeding PCI requirements.
• Complete insight into data
transmission
• Centrally managed & IP Assignment
• HIP Checks & LDAP Segregation
Control
HIP Check

31. Stages
1. GlobalProtect agent collects information.
2. Agent submits host information.
3. Gateway matches host information against
HIP objects and HIP profiles.
Key Advantages
• Centrally managed from Palo Alto Networks.
• Easy configuration changes & granular
policies.
• Custom application IDs.
• Allow box to connect, but notify personnel of
compliance mismatch.
• Routine checks on all OSPs, removes worry.
Firewall Status Data Encryption
Patch Management Anti-Virus
Host Information in Policy
Enforcement (HIP)

32. Data Filtering for CHD
CHD Filtering
• Predefined data pattern.
• Looks for 16 digit card numbers
through hash algorithm (less false
positives)
• Scan all data or only certain file
types (.pdf .txt .csv ….)
Alerting on CHD Detected
• Contact customer immediately
that their network is passing CHD
to our OSP.
CHD Detected
Out of
Scope for
Complianc
e

33. LSVPN
1. Amazon Data Centers
2. Geo-located OSPs
3. Palo Alto Networks VM-300 Portal
4. Palo Alto Networks VM-300 Satellites
5. Connecting LSVPN.
6. GlobalProtect to WR defined satellites.
Key
LSVPN Tunnel
GlobalProtect
AWS Data Center
OSPs
Palo Alto
Networks
VM-Series
CA.SAT02
OR.SAT01
PORTAL
VA.SAT01
CA.SAT01

34. ADDS & Group Policy
Break devices into organizational units.
• Geography
• Customer type
• …really anything
Advantages of ADDS
• Sync with Palo Alto Networks Firewalls.
• Addressable remote devices by DNS.
• Powerful tools available.
Group Policy
• “Touch one, configure many.”
• Floor to ceiling security model.
LSVPN
Portal Private
Network
Active Directory
Servers
Oregon
Satellite 1
Virginia
Portal
OSP
Satellite Private
Network
Active Directory
Servers
Default PCI Policy
Customer A
Policy
Site 1
Policy
Group Policy Hierarchy

35. RDP
Logging & Controlling
Access to OSP Units
PCI Requirement
• “Must control & log access to
PCI DSS Environment.”
Jump Server
• Single access point for
authorized staff.
Log Server
• Central “Log Aggregation” and
alerting.
• Synchronization with tools like
Splunk.
M.F.A
On-Premise
Customer A
Customer B
Customer C
Portal
Satellite 2
Satellite 1
Satellite 3
Jump

36. Access Policies
• AWS has no preferred access method to Ec2 instances.
• OpenVPN is frequently used.
• Cannot base access policies on applications or people.
• No data filtering on policies.
• Policies by IP assignment only.
An Ideal Access Policy for Easy PCI Compliance

37. Making Compliance Easy
with Palo Alto Networks
Least Access Control
• Active Directory
• Proof of policy controls
• App-ID
• User-ID
• Content-ID
Logging & Flexibility
• Changes are unavoidable for
productive organizations.
Segmentation, segmentation
segmentation!
• Reduced Scope = Reduced Cost
• Reduced Scope = Reduced
Threat
Flat Network v. Segmented Network
Flat
Network
Segmented
Network
Cardholder servers 4 4
Total servers 100 100
Open to audit scope 100 4
Reduction of audit scope 0% 96%
CHD
Network
Non-CHD
Network
Flat Network Segmented Network
Whole Network

38. Some Tips Before I Go…
Reach beyond PCI requirements for security.
• If you don’t have a security plan, use PCI as a base line.
Avoid expensive mistakes!
• Involve a QSA, a Palo Alto Networks Engineer, and your team on
all major design decisions.
Remember, a single credit card number is a liability.
• Cost of CHD Compromise > Cost of PCI Compliance
Evaluate whether or not you can eliminate the reasons for
necessary compliance.
• Ensure the benefit of touching CHD is greater than the liability.
Compliance with and without is Palo Alto Networks
• “Uncertainty in Compliance” v. “Certainty in Compliance”

39. Learn More at
Booth XYZ

40. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Matt McLimans, Senior Network Security Engineer
August 11, 2016
Thank you
Questions?