The Payment Card Industry Data Security Standard (PCI DSS) is worldwide accepted set of standards that intend to enhance safety when handling information of customers in the credit, debit and cash cards.
Penetration testing has been introduced in PCI DSS process. It involves testing the security of the systems that are included in the storage, processing, and transmission of information of cardholders. It should be known that penetration testing is a crucial area of compliance with the PCI DSS requirements.
Difference between Vulnerability Scan and Penetration Test
Even thou both the vulnerability scan and the penetration test are both required in the PCI DSS compliance the two do have a difference. Vulnerability scan is an entirely automated process that scans networks for vulnerabilities.
A penetration test, on the other hand, is more than the vulnerability test since a tester aims at showing the risk of the exposed vulnerabilities to a business. Penetration testing involves a lot of work and costs more unlike the vulnerability scan that only requires the automated scan.
Types of a PCI DSS Penetration Testing
There are three types of the penetration testing which are;
In the black-box assessment the tester is not given information as he/she begins the examination. In the white-box assessment, the inspector is given all details of the networks and the applications. The grey-box penetration testing may include the tester being provided with part of the information of the systems.
Scope of a Penetration TestÂ
The PCI DSS penetration testing is carried out on all the systems within the range of the Cardholder Data Environment (CDE). The CDE is merely the people, process, and the applications that stores, processes or transmits the cardholder data. The method of determining the scope of PCI DSS penetration testing involves the following steps;
•   As noted in the guideline, it is essential for an organization to evaluate unique access to public networks and restricted access to individual IP addresses.
•   Penetration testing has to be carried out in internal systems/critical systems that access the information of the cardholders. It should be noted that the critical systems are systems that process and protects the cardholder’s data.
•   It is possible for penetration testing not to be carried out in a particular system. However, if the non-CDE environment is compromised, it should not at all affect the CDE.
The penetration testing is carried out on a half-yearly or annual basis. The examination is conducted by a service provider that is not in the management of the CDE. It is crucial that critical systems such as firewalls, systems that detect malicious users, authentication servers, systems that redirect e-commerce are all tested since they manage the CDE.
Importance of Penetration Testing for PCI DSS
The goal of penetration testing aims at determining whether a hacker can access the system and affect the security of files and data of the cardholders. The penetration testing also aims at checking if the scope, management of vulnerabilities, methods applied in the testing and segmentation are all in place.
Application Layer and Network Layer Testing
Application layer testing checks vulnerabilities in web applications, web services, and software integrations. Some of the areas that may require this testing are shopping carts, online questionnaires, and forms on booking. Application testing checks the operating system of an application and attempts to note areas where the information can be compromised. Application testing, however, doesn’t involve the off-the-shelf applications.
Network layer testing focus on detecting insecurity defects with infrastructure that supports the CDE environment. This includes the web servers, firewalls, email servers, VPN servers among others. These applications are off-the-shelf applications that are not tailored to the needs of a business. Network-layer testing makes sure that the implementation and maintenance of these systems are effective.
Conclusion
It is crucial that an organization assesses upgrades and modifications that can affect the security of information of cardholders. PCI DSS has not guided on such changes; however, if an implementation can risk the CDE, it is the duty of an organization to carry out penetration testing.
It is vital for any business that is involved in the processing, storing and transmitting of the card information to always be updated about the PCI DSS requirements and to set goals on the compliance of the standards. The business environment is still under threat, and it is essential to keep the CDE secure at all times.
It is certain that the PCI DSS penetration testing is costly and it can interrupt the daily processes of an organization hence there is a need to involve a professional penetration tester. Through conducting penetration testing, the expert will provide insights to threats and vulnerabilities that may affect a business.
Author Bio
Ken Lynch is an enterprise software startup veteran, who has always been fascinated about what drives workers to work and how to make work more engaging. Ken founded Reciprocity to pursue just that. He has propelled Reciprocity’s success with this mission-based goal of engaging employees with the governance, risk, and compliance goals of their company in order to create more socially minded corporate citizens. Ken earned his BS in Computer Science and Electrical Engineering from MIT. Learn more at ReciprocityLabs.com.
