The document discusses Payment Card Industry Data Security Standard (PCI DSS) compliance on Amazon Web Services (AWS). It provides an overview of PCI DSS requirements and guidelines for protecting cardholder data. It then describes how AWS services like Lambda, Step Functions, and a segmented cardholder data environment can help achieve PCI DSS compliance by leveraging the AWS shared responsibility model. Finally, it mentions the AWS PCI Quick Start, which automates deployment of a standardized architecture for PCI DSS workloads on AWS.

1. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AWS PCI Quick Start
http://bit.ly/aws-pci

2. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
The data on a credit card

3. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Guidelines for Cardholder Data Elements

4. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
PCI Security Standards Council
• Defines the PCI Security Standards
• Standards are technical and operational requirements to protect
cardholder data.

5. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
What are PCI Security Standards?

6. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
What are PCI Security Standards?
PCI Data Security Standard (DSS)
• Applies to all entities that store, process, and/or transmit cardholder data.
• Covers technical and operational system components included in or connected to
cardholder data.
• If you are a merchant who accepts or processes payment cards, you must comply
with the PCI DSS.

7. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
PCI DSS Goals and 12 High level Requirements

8. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
What is PCI-DSS Requirement 4.1?
Encrypt transmission of cardholder data across open, public networks
• 4.1 Use strong cryptography and security protocols such as SSL/TLS,
SSH or IPSec to safeguard sensitive cardholder data during
transmission over open, public networks (e.g. Internet, wireless
technologies, Global System for Mobile communications [GSM],
General Packet Radio Service [GPRS]). Ensure wireless networks
transmitting cardholder data or connected to the cardholder data
environment use industry best practices (e.g., IEEE 802.11i) to
implement strong encryption for authentication and transmission.
The use of WEP as a security control is prohibited.

9. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Encryption in Transit for Requirement – 4.1
Increased complexity with additional components and integration with other
applications or services
Middleware
Server
Data
base
App
Server
Web
Server
Internet Load
balancer
Load
balancer
SSL/TLS
SSL/TLS
SSL/TLS SSL/TLS SSL/TLS SSL/TLS
SSL/TLS

10. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Encryption in Transit for Requirement – 4.1
Issues with End-to-end encryption
• Affect Application Performance
• Multiple encryption and decryption
• Increase management overhead
• Each additional encryption and decryption point adds key and certificate
management overhead
• Increases PCI DSS testing procedures by QSA

11. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Let’s Build

12. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Achieving PCI DSS Compliant Via Shared Security Responsibility
Model
AWS
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Achieving PCI DSS Compliant Via Shared Security Responsibility
Model
AWS

13. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AWS Shared Responsibility Model
Customer Data
Platform & Application Management
Operating system, network, and firewall configuration
Client-side data
encryption (data
integrity, authentication)
Network traffic
protection encryption /
integrity / identity
Server-side encryption
(file system and/or data)
CustomerIAM
AWS
Endpoints
AWSIAM
NetworkingDatabasesStorageCompute
Edge
Locations
Availability
Zones
Regions
AWS Global
Infrastructure
Foundation
Services
Security IN
the Cloud
Managed by
customers
Security OF
the Cloud
Managed by
AWS

14. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Microservices

15. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
What are Microservices?
Microservices are small,
autonomous services
that work together [1].
Gather together those things that change
for the same reason, and separate those
things that change for different reasons,
Single Responsibility Principle
Golden rule: can you
make a change to a
service and deploy it by
itself without changing
anything else?

16. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
16
Lambda Functions
Serverless Computing
AWS Lambda is a compute service that runs developers' code in response to events and
automatically manages the compute resources for them, making it easy to build
applications that respond quickly to new information [2].
Triggered by events or API calls:
• AWS S3 bucket PUT
• DynamoDB table updates
• API Gateway endpoint call
• Mobile backend call
• Others...
Lambda simplifies:
• Real-time data processing
• Build services for scalable backends
• Connect and orchestrate applications
Execute code without server. Pay only for used processing. Be happy!

17. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
18
Step Functions
AWS Step Functions makes it easy to
coordinate the components of distributed
applications and Microservices using visual
workflows [3]
Building applications from individual
components that each perform a discrete
function lets you scale and change
applications quickly

18. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
21
Microservices Taxonomy Example
Central Cache
Handling
Cheque
Processing
λ5
Payments
Java
Code
Operational
Services
Payments
Execution
Step Function 1
Customer
Billing
λ6
Cross Product
Operations
Business Areas
Business Domains
Domain Service
(Microservices)
Service
Infrastructure
(Serverless)
Service
Implementation
CanonicalModel(BusinessView)
AWSPlatform
(TechnicalView)
Service Composition
Python
Code
Srv Oper 1
Flow
SrvOper
SrvOper
Capability Capability Capability Capability
Has
Has
Has
Has Has
λ2 λ3
Java
Code
Nodejs
Code
Srv Oper 4
λ1
Java
Code
Service Composite
λ4
Python
Code
SrvOper2
Srv.Oper3

19. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
22
Mapping Service Domain to Lambda (Java)
PaymentsExecution
Message IN/OUT (XML)
ExecutePayment (ExecutePaymentIN): ExecutePaymentOUT
One Lambda Function for each Operation of
PaymentsExecution
Manage payment
lifecycle
mapping λ1
execute ( ExecutePaymentIN ): ExecutePaymentOUT
update ( UpdatePaymentIN ): UpdatePaymentOUT
request ( RequestPaymentIN ): RequestPaymentOUT
notify ( NotifyPaymentIN ): NotifyPaymentOUT
UpdatePayment (UpdatePaymentIN): UpdatePaymentOUTλ2
RequestPayment (RequestPaymentIN): RequestPaymentOUTλ3
NotifyPayment (NotifyPaymentIN): NotifyPaymentOUTλ4
mapping
mapping
mapping
ExecutePaymentIN
Service Domain and Operations
Message IN/OUT (POJO Java)
ExecutePaymentIN
ExecutePaymentOUT ExecutePaymentOUT
PaymentsExecutionTransaction
Business Object (XSD)
mapping
reference
mapping
PaymentsExecutionTransaction
Business Object (POJO Java)
reference
messages
messages
mapping

20. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
23
Mapping Service Domain to Lambda (Java)
PaymentsExecution
ExecutePayment (ExecutePaymentIN): ExecutePaymentOUTλ1
execute ( ExecutePaymentIN ): ExecutePaymentOUT
update ( UpdatePaymentIN ): UpdatePaymentOUT
request ( RequestPaymentIN ): RequestPaymentOUT
notify ( NotifyPaymentIN ): NotifyPaymentOUT
Service Domain (Microservice)
Lambda Function Definition
Lambda Function Implementation (Java)

21. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
What if I am B2B, or a SAAS?
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
What if I am B2B, or a SAAS?

22. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Build a Segmented Cardholder data
environment

23. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Benefits of Segmented Cardholder Environment
• Isolates the cardholder data environment from the remainder of an entity’s
network
• Reduces the cost of the PCI DSS assessment
• Reduces the cost and difficulty of implementing and maintaining PCI DSS controls,
• Overall Reduces risk for the entity by limiting data exposure

24. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Sample Banking Environment
Data Center
Operations
Back office
Branch
- Systems processing and storing PCI data
- Systems for regular banking, internal services, operations, management, etc.
Service
providers

25. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
PCI-DSS Scoping – Non-segmented Environment
Data Center
Operations
Back office
Branch
- Systems processing and storing PCI data
- Systems for regular banking, internal services, operations, management, etc.
Service
providers
Environment
In scope for
PCI-DSS
Assessment
without
segmentation

26. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Data Center
PCI-DSS Scoping – Segmented Environment
Operations
Back office
Branch
- Systems processing and storing PCI data
- Systems for regular banking, internal services, operations, management, etc.
Service
providers
Environment
In scope for
PCI-DSS
Assessment
after
segmentation

27. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Once in operation

28. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
The Layers of Fraud Prevention
• Prevention Stopping the activity before it happens.
• Detection Identifying and reporting o behaviors that meet your
definition of “fraud”
• Enforcement Actions you use to exit a bad actor.
• Containment Limiting blast radius or trusting users as appropriate for
the amount of risk you are willing to tolerate.

29. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AWS Layered Model

30. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Prevention Containment / Enforcement
Detection
First Service Launch
AWS Layered Model

31. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Data
Gathering
Analysis
Decisions /
Rules
Investigations
Device Fingerprints
Browser Info
IP Layer
Usage History
Payment Instrument
Clickstream
Log Files
Behavioral Patterns
Derived Values
Relationships
3rd Party Data
Real Time
Binary Tree
Regression
Machine Learning
Deep Learning
Derived Values
Historical
Model Training
Back Testing
Anomaly Detection
Auto Pass
Auto Block
Investigate
Usage Limits
Gather more Info
Pass
Gather more Info
Fail
Supporting
Workflows
Amazon
EC2
AWS
Lambda
Amazon
S3
Amazon
RDS
Amazon
DynamoDB
Amazon
Kinesis
Amazon
Redshift*
Amazon Machine
Learning
Amazon
SWF
Amazon
SQS
Amazon
SNS
Risk Management Technology Stack

32. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Find out what vulnerabilities you have
FPO

33. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Get Advice- Trusted Advisor

34. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Who is doing what?
Who
?
When
?
What? Where
to?
Where
from?
Bill 3:27p
m
Launch
Instance
us-west-
2
72.21.198.64
Alice 8:19a
m
Added Bob to
admin group
us-east-
1
127.0.0.1
Stev
e
2:22p
m
Deleted
security
group
eu-west-
1
205.251.233.
176

35. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
How to think about logs

36. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
PCI DSS – Quick Start Reference Deployment
AWS Enterprise Accelerator – Compliance: Standardized Architecture for PCI DSS on
the AWS Cloud
• Deploys a standardized environment for organizations with PCI DSS workloads
• Utilizes AWS CloudFormation templates to automate the deployment
• Based on the requirements of PCI DSS version 3.1

37. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Standard Architecture Deployed by AWS Quick Start

38. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AWS PCI Quick Start
http://bit.ly/aws-pci

39. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AMAZON CONFIDENTIAL
Did We Scan Your Badge?
Remember to opt-in to AWS communications
and you will receive a post-event email with a
link to:
• AWS Developer Workshop Slides
• $200 in AWS Credits
@shaun_r_ray