The Shared Responsibility Model in Cloud Compliance

The foundation of any discussion regarding cloud compliance is the Shared Responsibility Model. This model delineates the division of compliance responsibilities between the cloud provider and the customer.

The PCI guidelines clarify this division, as illustrated below:

Source: PCI Council

The extent of responsibility varies based on the chosen cloud service model. The most fundamental model is Infrastructure as a Service (IaaS). In more advanced models, such as Software as a Service (SaaS) or serverless computing, the customer retains even less responsibility, notably regarding operating system patching and vulnerability scanning, which can be particularly challenging in PCI DSS compliance.

Amazon Web Services (AWS) provides a clear definition of the Shared Responsibility Model, stating that AWS is accountable for the security of the cloud infrastructure, while customers are responsible for security within the cloud. For example, while AWS ensures that their cloud infrastructure complies with PCI DSS, it is up to the customer to configure their environment appropriately to meet compliance standards.

To illustrate, consider Amazon S3, which is potentially PCI DSS compliant. However, this potential is contingent upon the correct configuration by the user; mere use of S3 does not guarantee compliance.

Recognizing the implications of the Shared Responsibility Model can significantly alleviate the compliance workload for your teams. Remember the crucial principle: using a PCI-certified cloud provider does not automatically certify your environment; you must ensure your controls align with PCI requirements.

Verifying Your Cloud Provider's PCI DSS Compliance

Before migrating existing PCI workloads to the cloud, organizations should verify that their cloud provider maintains PCI DSS compliance. Most providers readily share their compliance status and offer access to portals where businesses can download current PCI certificates and Attestation of Compliance (AOC).

These portals also typically contain a PCI responsibility matrix that details which obligations fall to the cloud provider versus the customer.

Major cloud provider portals include:

• Amazon Web Services Artifact
• Azure Audit Reports Blade
• GCP Compliance Reports

Managing PCI Assessments in the Cloud

After clarifying responsibilities, the next step involves actual compliance efforts. Implementing PCI DSS in the cloud is not vastly different from on-premises environments, but there are key distinctions. The same standards apply, but controls can be deployed via management consoles or command-line interfaces (CLI). For instance, AWS native tools can be used to set encryption through AWS KMS and deploy patching with Systems Manager. Additionally, many robust third-party solutions familiar from on-prem environments are available.

A significant advantage of cloud environments is the ability to automate compliance processes, which can be transformative for maintaining PCI compliance.

Setting PCI Compliance Scope

One notable difference in the cloud is the ability to define compliance scope effectively. Cloud platforms offer powerful capabilities for environment segmentation. Anyone familiar with PCI audits knows that properly segmenting the PCI zone is crucial for minimizing audit scope and associated risks.

Using AWS as an example, PCI zones can be isolated within AWS accounts. Each account serves as a strong boundary, ensuring that resources are logically separated from those in other accounts, thereby preventing unintended connections between PCI and non-PCI zones.

Source: Author

The next layer of segmentation is the Virtual Private Cloud (VPC), which mimics on-premises network design through subnetting and security groups. The cloud's automation capabilities allow for consistent maintenance of PCI compliance over time.

Leveraging Cloud Automation for PCI DSS Compliance

One of the primary benefits of cloud technology is its potential for automation. Not only can organizations achieve PCI DSS compliance in the cloud, but they can also continually monitor their compliance posture and implement automation to ensure that this posture remains intact.

The following tools are available across the three major cloud providers:

• AWS Security Hub
• Microsoft Azure Blueprint
• GCP Security Command Center

For organizations operating in a multi-cloud environment, a Cloud Security Posture Management solution may be beneficial.

Many cloud providers also offer deployable templates that automate the remediation of PCI DSS violations. AWS, for instance, has a publicly accessible template that addresses PCI violations in Security Hub.

Innovating PCI DSS Solutions with Cloud Services

Beyond automation, AWS services can assist in addressing unique challenges that arise in PCI compliance, which may be difficult to tackle on-premises without significant investment. For example, organizations processing cardholder data may inadvertently store sensitive information in emails or tickets, posing a considerable risk.

AWS offers tools like Amazon Comprehend, which can analyze unstructured text to identify and redact sensitive information, such as cardholder data. More details can be found here.

Additionally, organizations can use AWS services to detect and redact cardholder data in images. The following flow illustrates this process:

1. An image is uploaded to an S3 bucket.
2. Amazon Rekognition identifies card numbers in the images and sends the data to Amazon Comprehend.
3. Amazon Comprehend extracts and redacts the card numbers, which are then processed by AWS Lambda to edit the image and update it in S3.