Payment card industry (pci) compliant architecture and associated methodology of managing a service infrastructure

Abstract

A system to ensure compliance with data security standards includes a security appliance to perform multiple security functions, with the security appliance including an initial configuration. The system further includes a display unit to provide information of compliance performance of the system on a secure basis. The system also includes a control unit to monitor compliance performance in real-time and to implement additional procedures required based on the monitored compliance to ensure compliance with data security standards.

1 .- 19 . (canceled) 
     
     
         20 . A system to ensure compliance with security standards, the system comprising:
 a security appliance to perform multiple security functions, the security appliance including an initial configuration separating a plurality of security appliance units into respective isolated virtual server containers of the security appliance, each unit having a security boundary surrounding the unit which prevents interactions or observations between units, each unit having a different set of authorized users;   a display unit to provide information of security standards compliance performance of the system via a compliance portal on a secure basis; and   a control unit to monitor security standards compliance performance in real-time and to implement additional procedures required based on the monitored security standards compliance performance to ensure security standards compliance.   
     
     
         21 . The system according to  claim 20 , wherein the security appliance is updated to add at least one virtual server container. 
     
     
         22 . The system according to  claim 21 , wherein the added virtual server container is not associated with the security standards. 
     
     
         23 . The system according to  claim 21 , wherein the added virtual server container replaces at least one virtual server container that existed prior to the update. 
     
     
         24 . The system according to  claim 20 , wherein the plurality of units include at least:
 a global unit to encompass and monitor the functions of the security appliance and other units of the security appliance,   an integrity unit to construct maps of file systems of the network devices and to compare the constructed maps with previously constructed maps to detect differences between the constructed maps and the previously constructed maps, and   a scanning unit to perform periodic network scans to ensure security of the network devices and to detect unrecognized devices on the network.   
     
     
         25 . The system according to  claim 20 , further comprising:
 a remote server to establish a remote connection with the security appliance and modify the initial configuration to a final configuration, wherein   the control unit monitors security standards compliance performance in real-time in accordance with information from the security appliance in the final configuration to ensure compliance with data security standards.   
     
     
         26 . A security appliance to ensure security standards compliance, comprising:
 a memory loaded with an initial configuration of the security appliance, the initial configuration including at least a global unit, an integrity unit, and a scanning unit and separating the global unit, integrity unit and scanning unit into respective isolated virtual server containers of the security appliance, each of the global unit, integrity unit and scanning unit having a surrounding security boundary which prevents interactions or observations among the global unit, integrity unit and scanning unit, each of the global unit, integrity unit and scanning unit having a different set of authorized users;   the global unit to monitor the functions of the security appliance and other units of the security appliance;   the integrity unit to construct maps of file systems of the network devices and to compare the constructed maps with previously constructed maps to detect differences between the constructed maps and the previously constructed maps which are stored and retrieved from the memory, respectively; and   the scanning unit to perform periodic network scans to ensure security of the network devices and to detect unrecognized devices on the network in order to ensure security standards compliance.   
     
     
         27 . The security appliance according to  claim 26 , wherein the security appliance is updated to add at least one virtual server container. 
     
     
         28 . The security appliance according to  claim 27 , wherein the added virtual server container is not associated with security standards. 
     
     
         29 . The security appliance according to  claim 27 , wherein the added virtual server container replaces at least one virtual server container that existed prior to the update. 
     
     
         30 . The security appliance according to  claim 26 , wherein
 the global unit retrieves the initial configuration from the memory and communicates with a remote server to update the initial configuration to a final configuration that is stored in the memory, and   the global unit monitors the functions of the security appliance in the final configuration.   
     
     
         31 . A non-transitory computer readable storage medium having computer executable instructions stored therein, which when executed by a processor in a security appliance causes the processor to execute a method comprising:
 monitoring, by a global unit, the functions of the security appliance and other units of the security appliance;   constructing, by an integrity unit, maps of file systems of the network devices;   comparing, by the integrity unit, the constructed maps with previously constructed maps to detect differences between the constructed maps and the previously constructed maps; and   performing, by a scanning unit, periodic network scans to ensure security of the network devices and to detect unrecognized devices on the network in order to ensure security standards compliance, the global unit, integrity unit, and scanning unit being separated into respective isolated virtual server containers of the security appliance, each of the global unit, integrity unit and scanning unit having a surrounding security boundary which prevents interactions or observations among the global unit, integrity unit and scanning unit, each of the global unit, integrity unit and scanning unit having a different set of authorized users.   
     
     
         32 . The non-transitory computer readable storage medium according to  claim 31 , wherein the computer executable instructions further cause the processor to execute a method comprising:
 receiving at least one update to the security appliance; and   adding at least one virtual server container to the security appliance in accordance with the received at least one update.   
     
     
         33 . The non-transitory computer readable storage medium according to  claim 32 , wherein the added virtual server container is not associated with the security standards. 
     
     
         34 . The non-transitory computer readable storage medium according to  claim 32 , wherein the added virtual server container replaces at least one virtual server container that existed prior to the update. 
     
     
         35 . The non-transitory computer readable storage medium according to  claim 31 , further comprising:
 communicating, by the global monitoring unit, with a remote server to update an initial configuration of the security appliance to a final configuration, wherein   the global unit monitors the functions of the security appliance in the final configuration.   
     
     
         36 . The system according to  claim 20 , wherein the isolated virtual server containers are instantiated on a single operating system instance.