[Seaside] Anyone familiar wityh PCIDSS?

[James Foster]

The Payment Card Industry Data Security Standard (https://www.pcisecuritystandards.org/documents/pci_dss_v2.pdf) specifies in section 2.2.1: "Implement only one primary function per server to prevent functions that require different security levels from co-existing on the same server. (For example, web servers, database servers, and DNS should be implemented on separate servers.)"

My interpretation is that this does not specify the application server, so it can be co-located with the database server. I just talked to someone who thinks that it is fine to put the application server with the web server but not with the database server. If the application server and the database server have to be on separate machines, then this would prohibit image-based persistence (whether Pharo or GemStone).

Any comments?

James Foster