Escape From PCI Land: How Growth Product Engineering Achieved PCI Compliance
•Download as PPTX, PDF•
3 likes•78,897 views
This document discusses moving a growth product engineering service out of PCI compliance. It describes orchestrating user data from backend services through a middle tier API service for user signup flows. The new system architecture uses client-side encryption with a public key to keep sensitive data like payment information encrypted. Moving to this new architecture took longer than initially estimated due to unexpected issues like integrating a JavaScript dependency, tuning a third party encryption library, and adjusting various system parameters.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Escape From PCI Land: How Growth Product Engineering Achieved PCI Compliance
Similar to Escape From PCI Land: How Growth Product Engineering Achieved PCI Compliance (20)
Recently uploaded
Recently uploaded (20)
Escape From PCI Land: How Growth Product Engineering Achieved PCI Compliance
- 1. Escape From PCI Land Rahul Dani Growth Product Engineering
- 3. Growth Product Engineering Charter Drive Signup – Middle tier service – Flow control, user state management, pre-signup session management via restful APIs – Orchestrate data from backend services • payments, subscriber, account, billing etc.
- 4. Edge Service M1 Payment s AppMn Browser /Device Company Infrastructure Billing App Browser /Device Browser /Device Sensitive data Sensitive data Billing AppBilling App Payment s AppPayment s App Sensitive data Sensitive data Mn Mn M1 GP Services Edge Service Edge Service In Scope Only Middle Tier App in PCI Scope In Scope
- 5. Edge Service M1 Payment s AppMn Browser /Device Company Infrastructure Billing App Browser /Device Browser /Device Sensitive data Sensitive data Billing AppBilling App Payment s AppPayment s App Sensitive data Sensitive data Mn Mn M1 GP Services Edge Service Edge Service In Scope GP Services No Longer in Scope In Scope
- 6. Browser/ Device 2 2 3 Out of scope In Scope Encryption key Public Key Distro 1 3 Out of band interaction with CDN Interaction with Netflix Plaintext Ciphertext System Architecture Client side encryption using public key
- 7. Surprises happen Actual Effort >> Initial Estimation Effort Estimated Actual
- 8. Why did moving out of PCI take so long • Javascript as a new dependency • Third party client encryption library • Retry logic fine tuning Client side changes • TTLs and timeout values needed adjustment • Flow modified • Error handling • Logging System tuning Differential impact of fraud
- 9. Questions ?
Editor's Notes
- Billing/Payments has to be in scope. GPE had to be in scope because we were talking to clients directly.
- Billing/Payments has to be in scope. GPE had to be in scope because we were talking to clients directly.
- Overflow slide