Payment card industry (PCI) compliant architecture and associated methodology of managing a service infrastructure

A security appliance located at a merchant's site to perform multiple security functions, the merchant's site having a plurality of network devices, the security appliance configured to identify each network device from the plurality of network devices as being included in one of a first zone containing cardholder data and a second zone not containing cardholder data, the security appliance comprising:

• a global unit to monitor the functions of the security appliance and other units of the security appliance;
• a logging unit to log data from at least each network device included in the first zone at the merchant's site and from other units of the security appliance;
• an integrity unit to construct maps of file systems of at least each network device included in the first zone and to compare the constructed maps to previously constructed maps of the files systems of at least each network device included in the first zone to detect differences between them;
• and
• a scanning unit to perform periodic network scans to ensure security of at least each network device included in the first zone and to detect unrecognized devices on the network, wherein
• the security functions performed by the security appliance ensure that each network device located in the first zone containing cardholder data is compliant with payment card industry data security standards regardless of the compliance of each network device included in the second zone with the payment card industry data security standards.

A method to be performed by a system to ensure compliance with payment card industry data security standards for merchants that store, process, and transmit secure data, the method comprising:

• performing, in a security appliance located at a merchant's site, multiple security functions, the performing including
• identifying each network device from the plurality of network devices as being included in one of a first zone containing cardholder data and a second zone not containing cardholder data;
• monitoring, in a global unit, functions of the security appliance and of other units of the security appliance;
• logging data, in a logging unit, from at least each network device at the merchant's site and from other units of the security appliance;
• constructing maps, in an integrity unit, of file systems of at least each network device included in the first zone and comparing the constructed maps to previously constructed maps of at least network device included in the first zone to detect differences between them;
• and
• performing periodic network scans, in a scanning unit, to ensure security of at least each network device included in the first zone and to detect unrecognized devices on the network;
• providing information, through a display unit, of compliance performance of the system on a secure basis;
• automating and managing, in a back-end unit, compliance-related tasks and data security events and ensuring integrity of the network devices;
• and
• monitoring, in a control unit, compliance performance in real-time and implementing additional procedures required based on the monitored performance to ensure that each network device located in the first zone containing cardholder data is compliant with the payment card industry data security standards regardless of the compliance of each network device included in the second zone with the payment card industry data security standards.

A system to ensure compliance with data security standards for merchants that store, process, and transmit secure data, comprising:

• a security appliance located at a merchant's site, the merchant's site having a plurality of network devices, the security appliance identifying each network device from the plurality of network devices as being included in one of a first zone containing confidential user data and a second zone not containing confidential user data, the security appliance performing multiple security functions, the security appliance including:
• a global unit to monitor the functions of the security appliance and other units of the security appliance;
• a logging unit to log data from at least each network device included in the first zone at the merchant's site and from other units of the security appliance;
• an integrity unit to construct maps of file systems of at least each network device included in the first zone containing cardholder data and to compare the constructed maps to previously constructed maps of the file systems of at least each network device included in the first zone to detect differences between them;
• and
• a scanning unit to perform periodic network scans to ensure security of at least each network device included in the first zone containing cardholder data and to detect unrecognized devices on the network;
• a display unit to provide information of compliance performance of the system on a secure basis;
• a back-end unit to automate and manage compliance-related tasks and data security events and to ensure integrity of the network devices;
• and
• a control unit to monitor compliance performance in real-time and to implement additional procedures required based on the monitored compliance to ensure that each network device included in the first zone containing the confidential user data is compliant with data security standards regardless of the compliance of each network device included in the second zone with the data security standards.