What is PCI DSS Pentesting?

PCI DSS mandates penetration tests for CDE’s network and application mechanisms, critical components that may jeopardize CDE security, and the entire CDE perimeter. Moreover, testing to allow for the accurate segregation of the cardholder data environment from external systems. Pentesting, combined with scanning for internal and external vulnerabilities, satisfies most of PCI DSS Requirement 11, which mandates regular testing of security processes and systems.

The perimeter of CDE and all systems that could compromise CDE’s security must be the basis for testing. Systems that are isolated from the environment containing cardholder data are deemed outside the scope of a pentest. Strict firewall rules can eliminate false positives in the initial testing phase and reduce the cost of penetration testing.

Let’s take a look at the requirements.

Requirement 11.3

• An organization must implement internal and External Pentesting
• Third-party or internal pentesters must adhere to a set methodology aligned with NIST SP 800-115 and include appropriate tests (e.g., application layer).

Requirement 11.3.1

• External pentesting is required annually and after significant infrastructure or application changes or upgrades.
• For instance, integrating a web server or upgrading the operating system.

Requirement 11.3.2

• This requirement shadows 11.3.1, and hence, organizations are obliged to perform internal pentests only.
• Companies must verify annual internal penetration tests or conduct them after major application or infrastructure changes.
• Ensure qualified third-party or independent internal resources conducted the tests.

Requirement 11.3.3

• Organizations must fix exploitable vulnerabilities found during pentests and test until the fixes are verified.
• Vulnerabilities are loopholes exploitable by third-party or internal resources to access cardholder data, company networks, etc. Examine penetration testing results to ensure the exploit’s root cause is fixed.

 Requirement 11.3.4

• Organizations must review the testing methodology if segmentation was used to isolate cardholder data from other networks.
• When required, a qualified third-party or internal resource must perform annual testing on all segmentation tactics.
• This requirement validates effective segmentation methods, segregating in-scope systems that store cardholder data from out-of-scope systems.

 Requirement 11.3.4.1

• It’s a service-provider-only requirement. Service providers are entities that process, transmit, or store cardholder data for a third party or can impact data security.
• If segmentation is employed, pentests must be conducted every six months, and after any updates or modifications to segmentation controls to confirm PCI DSS scope.
• Ideally, this should be done as often as possible to keep the scope aligned with changing enterprise objectives.
• If cardholder data is discovered during a pentest, the pentester must secure it per PCI DSS guidelines.