Introduction

In 2018, World Web Technology (WWT) approached Anitian with a challenge. They wanted to move a payment application into the cloud. They were considering Azure, Google, and AWS. They needed a flexible, auto-scaling environment that was also compliant with the Payment Card Industry Data Security Standard (PCI DSS).

Anitian proposed a package that would quickly deliver a compliant infrastructure in the AWS cloud. Using a combination of Anitian development software, native AWS automation, and third party security tools, Anitian was able to make WWT PCI compliant in a fraction of the typical time.

Anitian’s PCI Cloud Architecture

The first part of this service was Anitian’s PCI Compliant Architecture. This is a pre-configured AWS environment that provides a secure application hosting environment. It is specifically designed and configured to meet the requirements of the PCI DSS.

Some of the components of this architecture include:

  • Server images (called AMIs) pre-hardened to meet PCI requirements
  • Segmented network topology with strong access controls
  • Perimeter firewall
  • Web application firewall
  • Endpoint security, which offers system-level anti-malware, file integrity monitoring, intrusion detection, and configuration management
  • Identity and access management
  • Multi-factor authentication
  • Security Information and Event Management (SIEM)
  • Vulnerability management
  • Compliance monitoring
  • Auto-scaling

Since Anitian automates the deployment, we were able to stand up this architecture in just days. All we needed was a little bit of configuration data from WWT to get going.

Sherlock Managed Detection and Response

In addition to providing a pre-configured, pre-hardened architecture, Anitian also included our Sherlock Managed Detection and Response services. This provides round-the-clock security and compliance monitoring. Moreover, it includes an annual risk assessment. Risk assessments are not only a best practice for any environment, but also a PCI requirement.

PCI Compliance Assessment Included  

Furthermore, Anitian also provided a complete suite of services to assess, test, and certify WWT’s environment compliance with the PCI DSS. Once the code was deployed, Anitian had all the relevant artifacts to rapidly certify the environment.

Benefits

The combination of Anitian’s PCI Architecture, Sherlock Managed Detection and Response, and PCI Assessment services enabled WWT to launch a fully compliant AWS environment faster and at lower cost than traditional deployments of this type of secure environment. Because Anitian used native AWS automation and configuration features, the deployment, setup, and management of this environment was largely automated. Also, since WWT deployed on AWS, and used AWS services, they could leverage AWS’s PCI certification service as well.

All of this reduced the administrative burden on WWT. It allows them to focus on developing their software and serving their customers.

Conclusion

Anitian’s AWS cloud architecture development will provide WWT with application testing and production features that provide scalability, security, and flexibility as the company grows its services. Housing application resources and Anitian’s full stack of security products in AWS will help WWT comply with PCI and streamline its business growth needs.