How PCI DSS Secured Cloud works

Multiple DMZ zones (PCI DSS commonly refer to networks as zones) are implemented for traffic to traverse through firewalls, onto load balancers and Web Application Firewall (WAF) devices before reaching further load balancers.

The web and application zones would be home to reverse proxies, potentially some more load balancers, and your application nodes.

If your application requires a database or multiple databases, this could potentially be the last zone or zones that the request reaches before being returned to the user.

HAProxy, Apache ModSecurity and NGINX NAXSI are deployed at various points in the network at these stages to ensure resiliency and compliance. Each zone that is passed through is subject to strict least privilege firewall controls. Administration access would be provided through a separate management zone or zones also, depending on the usage requirement.

All of the servers (hypervisors, virtual machines) are deployed with OSSEC agents, whether static or dynamic, who report into the managed security dashboard dedicated to your environment. The IDS server has a watchful eye on all of the traffic traversing between each zone.