01Introduction
Achieving PCI DSS v4.0 QSA Audit Readiness
02Problem Statement
- Online retailer processing $500M/year in card transactions; PCI DSS v3.2.1 lapsed
- QSA audit scheduled in 120 days; 47 open findings from prior assessment
- CDE scoped across 3 AWS accounts, 2 on-prem networks, third-party payment gateway
- Challenge: remediate 47 findings, complete v4.0 transition, pass QSA in 120 days
- Risk: non-compliance could result in $100K/month fines and card brand penalties
03Proposed Solution
Phase 1
CDE Scoping + Segmentation + Control Implementation
- CDE re-scoped: isolated VPC with no internet-facing access; gateway via PrivateLink
- Network segmentation validated: penetration test confirmed no lateral movement paths
- WAF (AWS WAF) with OWASP Top 10 ruleset protecting all payment endpoints
- IDS/IPS: Suricata on network perimeter; CrowdStrike on all CDE endpoints
- Tokenization: Braintree vault for PAN storage; CDE stores no raw PANs
Phase 2
47-Finding Remediation Sprint
- Prioritized findings by risk: critical (P1) remediated in weeks 1-2, high (P2) by week 6
- Requirement 8: MFA enforced for all CDE access; privileged access via PAM (BeyondTrust)
- Requirement 10: Centralized logging with 12-month retention in immutable S3
- Requirement 11: ASV scans quarterly; internal vulnerability scans weekly via Tenable
- Evidence collection automated: scripts pull compliance artifacts on-demand for QSA
04Technologies
- Vulnerability Management
- Tenable.ioASV scanningOWASP ZAP
- Endpoint Security
- CrowdStrike Falcon (CDE endpoints)Suricata IDS
- WAF
- AWS WAF with managed rule groups + custom PCI rules
- PAM
- BeyondTrust Privileged Access Management
- Logging
- Amazon S3 (immutable)CloudTrailCentralized SIEM