You run a web business on AWS, and due to your specific business requirements you have a need to perform payment processing. Whether you are selling subscriptions or shipping goods, there are both easy and hard ways to manage payments in a PCI compliant way. Learn tips and techniques from the pros to achieve PCI compliance on AWS without making your life more difficult than necessary.

2. AWS Loft
PCI Compliance
on AWS
Justin Lundy, CIO & CTO, Evident.io
https://evident.io/
jbl@evident.io
twitter.com/justinlundy_
February 26, 2015
AWS Loft San Francisco

3. ©2015 evident.io I confidential I evident.io
Agenda - PCI Compliance on AWS
1. Firewalls
2. Avoid Vendor Defaults
3. Protect Cardholder Data At Rest
4. Encrypt data in transit
5. Vulnerability Management
6. Secure Systems and Apps
7. Restrict Access
8. Use Multi-Factor Authentication
9. Restrict Physical Access
10. Regularly Monitor and Test Network
11. Regularly Test Security Systems and Processes
12. Maintain Information Security Policy
13. Parting Advice
3

4. ©2015 evident.io I confidential I evident.io
About
Evident.io is a team that is laser-focused on cloud
security, AWS, risk management, information
security, incident response, compliance, growth and
innovation.
Check us out:
https://evident.io/
We also love open source:
https://github.com/EvidentSecurity
2/9/15
4

5. ©2015 evident.io I confidential I evident.io
Firewalls to Protect Cardholder Data
1. Use VPCs to split nets into public and private subnets.
(AWS:VPC-001)
2. Cardholder Data goes in private subnets
3. Limit access based on need-to-know
4. Use Ingress and Egress VPC SG Policy
(AWS:VPC-005) and VPC NACLs (AWS:VPC-00{2|
3|9}) - all SG / VPC SG Checks - (CSA CCM IVS-12)
5. )
6. Institute a formal change management process: pro
tip - tickets/code commits for deployment history
7. UTM gateways are nice but not absolutely required
5

6. ©2015 evident.io I confidential I evident.io
Avoid Vendor Defaults
1. Operating System Minimization: Remove and
Disable unnecessary software and services
(AWS::DEMO-EC2-001)
2. Use one primary function per EC2 instance - do
not run your web server and database server on
the same instance.
3. Use SSH private keys with additional MFA like
Duo Security’s PAM module - its awesome
6

7. ©2015 evident.io I confidential I evident.io
Protect Cardholder Data At Rest
1. If using EC2, can leverage transparent encryption of EBS
volumes (AWS:EC2-032)
2. If using S3, can leverage server side bucket encryption
(AWS:SSS-002)
3. Can use commercial or open source encryption tools/
libraries if preferred (os layer, db layer, etc.)
4. Only store minimal card holder data
5. Rotate encryption keys regularly (AWS:IAM-007)
6. Store your encryption keys safely, can use AWS key
management service or CloudHSM
7. Limit access to cardholder data based on business need-to-
know (e.g. admins)
7

8. ©2015 evident.io I confidential I evident.io
Encrypt Data in Transit
1. Encrypt data using SSL with a secure cipher suite
(AWS:ELB-008)
2. Terminate SSL at the ELB or at the web server
8

9. ©2015 evident.io I confidential I evident.io
Vulnerability Management
1. Apply AV software on EC2 instances and ensure they auto-
update
2. Use Vulnerability Scanning to prepare for audits. (CSA
CCM AAC-02)
9

10. ©2015 evident.io I confidential I evident.io
Develop & Maintain Secure Systems
and Apps
1. Review, test and apply security patches regularly.
2. Develop software according to PCI AppSec / OWASP guidelines
3. Separate development, staging and production
4. Use IAM and remove any test IAM users from non-test
environments
5. Ensure MFA (AWS:IAM-00{3|4}) and IAM password policy
(AWS:IAM-002) are being used (CSA CCM IAM-03)
6. Rotate IAM user keys regularly (AWS:IAM-007)
7. Enable cloudtrail (AWS:CLT-001), ELB and S3 logging and collect
the logs for audit trail (AWS:SSS-003) (CSA CCM IVS-01)
8. Any changes to environment are to be documented and
approved.
9. Avoid manual deployments. Use CloudFormation, CodeDeploy,
Chef, Puppet, etc.
10

11. ©2015 evident.io I confidential I evident.io
Restrict Access based on business
need
1. Limit number of IAM users and restrict policies to specific
capabilities based on business need. (AWS:IAM-008)
2. Optionally Can Use SAML and SSO for AWS Management
Console users
11

12. ©2015 evident.io I confidential I evident.io
Secure Authentication
1. Do not use the root AWS account at all if possible
(AWS:GLO-002)
2. Ensure users are using IAM accounts or SAML/SSO
3. Enable multi-factor authentication for all AWS accounts
(AWS:IAM-004)
4. Virtual MFA software is free and runs on mobiles or get
hardware tokens
5. Do not use shared credentials anywhere - all users should
have unique user ids. That goes for IAM and SSH.
6. Some folks go so far as to launch AMIs without key pairs so
logging in via SSH is impossible. A bit extreme.
12

13. ©2015 evident.io I confidential I evident.io
Restrict Physical Access to
Cardholder Data
1. AWS covers this for you — assuming the scope of your
cardholder environment is entirely within AWS.
13

14. ©2015 evident.io I confidential I evident.io
Regularly Monitor and Test Network
1. Regularly review CloudTrail logs to identify critical activity
2. Use HIDS/HIPS/centralized logging to monitor login
activity, file integrity changes, security events, etc.
3. Ensure your clocks are all sync’d with NTP
14

15. ©2015 evident.io I confidential I evident.io
Regularly Test Security Systems and
Processes
1. Vulnerability Scanning
2. Penetration Testing
3. Inform AWS before Penetration Testing
4. Have a third party audit the environment
15

16. ©2015 evident.io I confidential I evident.io
Maintain an Information Security
Policy for All Personnel
1. Security policies should be documented and shared with all
personnel
2. AWS inventory, and account information should be
regularly updated.
3. Have an Incident Response plan ready before a breach.
4. Put 24x7 monitoring in place to enable rapid response.
16

17. ©2015 evident.io I confidential I evident.io
Parting Advice
1. If you can choose your payment gateway - you can save
even more time and effort by using Stripe in your App on
AWS
2. Only hire a PCI QSA that has experience with AWS and
certified environments on AWS before. Otherwise pain.
3. Request your PCI compliance documentation package from
AWS for complete details (under NDA)
4. Evident helps clients with PCI compliance control objectives
1, 3, 5, 6, 7, 8, 9, 10 and 11 on AWS.
5. Use Evident to help prepare for PCI audits to save time and
headaches!
17

18. ©2015 evident.io I confidential I evident.io
Evident.io
Loft Feb 26
18

19. ©2015 evident.io I confidential I evident.io
Connect
February 9, 2015
19
evident.io
11501 Dublin Blvd #200
Dublin, CA 94568
c. 855.933.1337
jbl@evident.io
http://evident.io