PCI DSS Compliance Penetration Test
Why is a PCI compliance penetration test needed?
PCI DSS (Payment Card Industry Data Security Standard) Requirements 11.4.1 and 11.4.2 state that internal and external penetration testing must be performed at least annually and after any significant changes – for example, infrastructure or application upgrades or modifications, or after installing new system components. Requirement 11.4.5 requires penetration testing of network segmentation controls.
Conducting penetration tests helps provide a crucial end-of-state check and can be used in the early stages of developing new processing systems to identify potential risks to cardholder data.
What is a PCI DSS compliance penetration test?
Performing penetration testing on your security systems, public-facing devices and systems, databases and other systems that store, process or transmit cardholder data means that you are attempting to discover your vulnerabilities before cyber criminals do.
The goals of penetration testing are to:
- Determine whether and how a malicious user could gain unauthorised access to assets that affect the fundamental security of the system, files, logs and/or cardholder data; and
- Confirm that the controls required by the PCI DSS are in place and effective.
Penetration testing is essentially a controlled, ethical form of hacking that involves assessing your chosen systems for any potential weaknesses. These weaknesses could result from inadequate or improper system configuration, known or unknown hardware or software flaws, and operational weaknesses in process-based or technical countermeasures.
Did you know?
Although Requirement 11 of the PCI DSS mandates regular testing of security systems and processes, Verizon’s 2017 PCI Compliance Report shows that security testing retains its traditional place at the bottom of the priority list, with only 71.9% of organisations achieving full compliance.
Payment card data is a prized commodity for cyber criminals and is usually the main target in attacks against commercial environments. The 2017 Trustwave Global Security Report identified that more than half of the incidents investigated targeted payment card data.
Is a PCI compliance penetration test right for you?
Annual* penetration test
Req. 11.4
- RoC++
- SAQ D for merchants
- SAQ D for service providers++
- SAQ C#
- SAQ C-VT#
- SAQ B-IP#
- SAQ A-EP+
Quarterly wireless network analysis
Req. 11.2
- RoC
- SAQ D for merchants
- SAQ D for service providers
- SAQ C
Annual web application vulnerability scan1
Req. 6.6
- RoC
- SAQ D for merchants
- SAQ D for service providers
- SAQ C
- SAQ A-EP
* Or after any significant infrastructure or application upgrade or modification (such as an operating system upgrade, a subnetwork added to the environment, or a web server added to the environment).
# Only required for testing network segmentation if any is present.
+ Only external penetration test required.
++ For service providers, any network segmentation must be tested every six months.
1 Or after any change to the application. Applicable if developing own applications or using a third-party non-PCI-certified web application.
Our engagement process
Our CREST-accredited penetration testers follow an established methodology based primarily upon the OSSTMM (Open Source Security Testing Methodology Manual) and OWASP (Open Web Application Security Project) Top 10 Application Security Risks. This approach will emulate the techniques of an attacker using many of the same readily available tools.