VMware

This Question is Possibly Answered

1 "correct" answer available (10 pts) 1 "helpful" answer available (6 pts)
4 Replies Last post: Oct 22, 2009 7:31 AM by Texiwill  

PCI certification requirements. posted: Oct 8, 2009 7:53 AM

Click to view jam's profile Enthusiast
jam
57 posts since
Dec 13, 2004

Have any of you been through PCI certification using Vmware infrastructure?

If so, did the auditors insist that ESX ran AV? The standard states that AV is require on all system components where appropriate, but the scope in not really defined.

Current the VMs all have AV, but not ESX, and I'd like to keep it that way if possible.

Were there any other issues regarding PCI certification with ESX?

Re: PCI certification requirements.

1. Oct 8, 2009 8:13 AM in response to: jam
Click to view NTurnbull's profile Expert
NTurnbull
429 posts since
Feb 11, 2008
Haven't looked at it myself but did you see the VMware whitepapers on PCI Compliancy? http://www.vmware.com/technology/security/compliance/resources.html

Thanks,
Neil

Re: PCI certification requirements.

2. Oct 8, 2009 8:34 AM in response to: NTurnbull
Click to view jam's profile Enthusiast
jam
57 posts since
Dec 13, 2004

I've looked through them and mostly they talk about AV on VMs.

It does mention requiring AV on management partition on Windows or Unix, but does this apply to ESX?

I'm hoping someone who's been through an audit can give me a definte yes or no.

Re: PCI certification requirements.

3. Oct 9, 2009 10:00 AM in response to: jam
Click to view AsherN's profile Hot Shot
AsherN
214 posts since
Mar 10, 2009

Keyworrds are 'where appropriate'.

If your management network is on a different subnet, and all computers on that subnet have AV protection, then it is not appropriate.

Re: PCI certification requirements.

4. Oct 22, 2009 7:31 AM in response to: AsherN
Click to view Texiwill's profile Guru
Texiwill
10,212 posts since
Jan 13, 2004
Hello,

Moved to Virtualization Security forum.

PCI is working on the correct guidance for VMs now. So you may wish to check directly with PCI with respect to PCI compliant virtualization hosts/VMs. I am sure there will be a combination of items required. AV being the least concern.


Best regards,
Edward L. Haletky VMware Communities User Moderator, VMware vExpert 2009, Virtualization Practice Analyst
Now Available: 'VMware vSphere(TM) and Virtual Infrastructure Security: Securing the Virtual Environment'
Also available 'VMWare ESX Server in the Enterprise'
SearchVMware Pro|Blue Gears|Top Virtualization Security Links|Virtualization Security Round Table Podcast

Actions

VMware Developer

SDKs, APIs, Videos, Learn and much more in the Developer community.

Learn More

Developer Sample Code

Increase your developer productivity with VMware API sample code.

Learn More

VMworld Sessions & Labs

Online access to the latest VMworld Sessions & Labs and online services.

Learn more

Purchase PSO Credits Online

Purchase credits to redeem training and consulting services online.

Buy Now

Community Hardware Software

View reported configurations or report your own.

Learn More

VMware vSphere

Come witness the next giant leap in virtualization.

Register Today

Communities