Payment card industry (PCI) compliant architecture and associated methodology of managing a service infrastructure

A security appliance in communication with a plurality of network devices, the security appliance comprising:

• a memory;
• a global unit to identify network devices that include confidential user data and to identify network devices that do not include confidential data, the global unit organizing the network devices including confidential data into a first zone and organizing the network devices that do not include confidential data into a second zone, each of the first and second zones residing in separate sub-networks;
• an integrity unit to construct maps of file systems of at least each network device included in the first zone and to compare the constructed maps with previously constructed maps of at least each network device included in the first zone to detect differences between the constructed maps and the previously constructed maps, the constructed maps and previously constructed maps being stored and retrieved from the memory, respectively;
• and
• a scanning unit to perform periodic network scans to ensure security of at least each network device included in the first zone and to detect unrecognized devices on the network, wherein
• at least results of the periodic network scans and the comparison between the constructed maps and previously constructed maps are used to ensure that each network device located in the first zone is compliant with data security standards regardless of compliance with the data security standards of each network device included in the second zone,
• wherein the security appliance segments the first zone from the second zone via a firewall.

A non-transitory computer readable storage medium having computer executable instructions stored therein, which when executed by a processor in a security appliance causes the processor to execute a method comprising:

• identifying network devices that include confidential data from a plurality of network devices;
• identifying network devices that do not include confidential data from the plurality of network devices;
• organizing the network devices that including confidential data into a first zone;
• organizing the network devices that do not include confidential data into a second zone, each of the first and second zones residing in separate sub-networks;
• monitoring, by a global unit, functions of the security appliance and of other units of the security appliance;
• constructing maps, by an integrity unit, of file systems of at least each network device included in the first zone;
• comparing, by the integrity unit, the constructed maps to previously constructed maps of at least each network device included in the first zone to detect differences between them;
• and
• transmitting, to a control unit, at least information monitored by the global unit and results of the comparing the constructed maps to the previously constructed maps to determine whether each network device located in the first zone is compliant with the data security standards regardless of compliance with the data security standards of each network device included in the second zone,
• wherein the first zone is segmented from the second zone via a firewall.