Payment Processor Microsegmentation and a Legacy SMB Exception
A payment processor runs a three-tier cardholder-data environment on 120 Linux workloads in a shared VMware cluster. The network is a flat /16 VLAN with a firewall only at the internet edge. PCI DSS segmentation is claimed between the cardholder-data environment and corporate IT, but a recent internal penetration test moved from a compromised developer workstation to the cardholder database using SSH with a shared local account. The company plans microsegmentation using a host-based firewall and an identity-aware proxy. The change advisory board wants a 30-day rollout across all 120 workloads. The application team says 14 workloads run a legacy batch job that requires unrestricted SMB to a NAS and cannot be changed before a peak season in 90 days. The CISO must approve scope and sequence while keeping the PCI assessment evidence credible.
1. Should the CISO approve the 30-day rollout across all 120 workloads? Recommend a sequencing and decision criteria.
Read the worked answer
Do not approve a binary 30-day rollout across all 120 workloads. Approve the design and a risk-based sequence: first map application dependencies, then enforce deny-by-default in monitor mode for the 106 standard workloads, then move the cardholder-data environment into a segmented zone. The 14 legacy workloads should not get unrestricted SMB; place them and the NAS in a dedicated enclave with host-firewall allowlists, a jump host, and logging. A 90-day exception can be time-bound with an owner and compensating controls. Decision criteria should include no shared local accounts, tested rollback, PCI evidence, and a post-rollout penetration test. The CISO should reject any plan that claims segmentation while leaving a flat /16 path from developer workstations to the cardholder database.
2. Design the exception for the legacy batch job so it does not invalidate PCI segmentation. What controls and documentation are required?
Read the worked answer
The exception must be an isolated enclave, not a firewall hole. Put the 14 workloads and the NAS in a separate VLAN with no route to corporate IT or the internet. Allow SMB only from specific source hosts to specific shares, require SMB signing and encryption, and use a unique least-privilege service account with rotation. Administrative access should go through a jump host with MFA and session recording. Add file integrity monitoring, IDS/IPS, and SIEM alerts for anomalous SMB volume. Document the business justification, risk owner, expiry date (90 days), review date, and compensating controls; provide the diagram and rule set to the QSA. The exception should be re-approved only if peak season changes the risk.
3. How would you validate the segmentation after rollout and detect east-west movement?
Read the worked answer
Validate with adversary testing, not just rule review. Run an internal penetration test from a compromised developer workstation and from corporate IT toward the CDE; confirm that SSH and SMB are denied and that the legacy enclave is reachable only through approved paths. Use traffic-flow analysis and host telemetry to baseline east-west behavior, then alert on new flows, denied connections, and anomalous SMB writes. Add canary credentials and files in the CDE to detect credential misuse. Review identity-aware proxy logs and shared-account removal. Repeat testing after the peak season and after any firewall change; segmentation evidence should include test results, not only configuration screenshots.