SAP ECC and PCI Compliance Segmentation

[Former Member]

I am working on a PCI compliance project for our new SAP implementation we are about to stand up. I'm trying to limit the scope of systems that are in scope for PCI and cannot find an answer to my question anywhere including the security library.

Basically, we are trying to understand the feasibility of firewalling off our ECC, Internet Sales, XI and Payer Direct servers from our BI, SLD, SRM, SCM, LiveCache, GTS, EP, Trillium, Sabrix, Sabrix Report, MDM, xMAM and GRC servers. The alternative is to include all the servers within our PCI segment which triples the size of our environment.

We intend to do a full traffic analysis to lock down the traffic to only that which is necessary but are concerned about the potential issues in delaying the packets as they traverse the firewall, especially between the ECC and BI servers among others.

Does anyone have any experience with segmenting off their servers along these lines?

Thanks

[Former Member]

Hi,

You can get this info from ccms.

Anil

[Former Member]

Sorry for my lack of knowledge but wouldn't ccms require that the infrastructure be built out first to monitor the segmentation and any performance hit? This is not feasible in my scenario as we have a short window for cutover and need to get it right the first time as opposed to building the segment with ECC, etc segmented off and monitoring the performance then buying more firewalls and enlarging the segmentation scope if the results were not saitsfactory.

Edited by: Kelly Clark on Jan 29, 2009 7:16 PM