Retail: Segmenting Store Networks for Payments and IoT

Networking · 4 min

Payment terminals, electronic shelf labels, cameras and customer Wi-Fi coexist on store networks. Learn how to separate zones, control access and validate isolation.

Retail: Segmenting Store Networks for Payments and IoT

TL;DR

A store network without adequate isolation can allow less-protected devices to create access paths to payment systems.
PCI DSS does not require segmentation in every case, but effective isolation can reduce the scope of the assessment.
Segmentation should consider functions, trust levels and authorized communication flows, with default deny between zones.
Network models per store type and centralized policies make it easier to apply controls consistently.
Isolation should be validated periodically and after changes to segmentation mechanisms.

The store has become a multi-tenant network

In retail and distribution, a store may run checkouts and payment terminals, scales, electronic shelf labels, video surveillance cameras, refrigeration and HVAC systems, customer Wi-Fi and remotely managed vendor equipment on the same communications infrastructure. In many chains, this diversity is the result of successive rollouts, refurbishments and technology integrations. The challenge for IT and compliance teams is to organize the network so that a vulnerable device, or improper access by an external technician, cannot create a path to payment systems. At the same time, the architecture must remain operationally viable for dozens or hundreds of stores, each with different needs and equipment.

In PCI DSS, segmentation defines the assessment perimeter

PCI DSS is a payment card industry security standard, whose application stems from the rules of the entities participating in the payments ecosystem and their respective agreements. The validation method depends, among other factors, on the payment acceptance model and the criteria applicable to the organization, which should be confirmed with the acquirer or the relevant assessor. Network segmentation is not mandatory in every scenario, but it can reduce the scope of the assessment when it effectively isolates the cardholder data environment (CDE) from other systems. However, systems connected to the CDE or able to affect its security must also be considered. Creating separate VLANs is not enough: effective controls over communication flows and validation of the implemented isolation are required.

Zones designed by function and trust level

A recommended approach is to group devices by function, criticality and trust level, rather than considering only the connection type. Points of sale and systems associated with payment processing can be part of a dedicated zone; store operations equipment, such as scales and electronic labels, another; building systems, such as HVAC and power, a third; and video surveillance, a zone of its own. Customer Wi-Fi should have restricted access to the necessary services, normally just the Internet. Between zones, the baseline rule should be to block communications by default and authorize only the necessary flows, properly documented and justified. In a LAN and SD-WAN networking project, this design should be defined before equipment selection and validated against the needs of each store.

A replicable model for every store

Segmentation becomes easier to manage at scale when there is a reference model per store type, whether hypermarket, convenience store or warehouse, with consistent addressing, defined security zones and centrally managed policies. When the connection between stores and headquarters uses an architecture such as the one described in SD-WAN and SASE as an alternative to MPLS, controls must remain consistent in communications with central services and the cloud as well. Unknown devices can be subject to a restricted-access policy, using network access control (NAC) mechanisms such as 802.1X, where supported. For devices that do not support it, additional measures may be needed, duly assessed. Remote vendor access should be authorized, limited to the needs of the intervention, authenticated and logged, avoiding permanent uncontrolled connections to the store network.

Proving that the separation keeps working

A diagram documents the intended isolation; tests demonstrate whether the controls work in practice. Under PCI DSS v4.0.1, when segmentation is used to isolate the CDE and reduce the scope of the assessment, requirement 11.4.5 provides for penetration testing of segmentation controls at least once every 12 months and after changes to those controls or methods. For service providers covered by requirement 11.4.6, the minimum frequency is six months, in addition to testing after changes. In retail, store openings, refurbishments, new kiosks and equipment replacements can introduce unplanned connections. Integrating checks into store openings, comparing configurations against the reference model and periodically reviewing the rules between zones helps identify deviations. Limitations remain, such as legacy equipment that depends on open communications or vendors that require permanent access. These situations should be assessed individually and handled with appropriate mitigation measures, without assuming that compensating controls automatically waive the applicable requirements.

An architecture decision more than a compliance one

Segmenting a store network can reduce the scope of PCI DSS assessment and limit the spread of certain security incidents, provided the controls are effective and properly validated. The outcome depends on the payment architecture, existing equipment, dependencies between systems and the discipline with which policies are applied at each location. Treating segmentation as a reference architecture, subject to maintenance, monitoring and testing, is more sustainable than approaching it as a one-off project. This way, the network can evolve with new stores, devices and services without losing control over communications and the associated risks.