The Payment Card Industry Data Security Standard (PCI DSS) is a global cornerstone for safeguarding cardholder data. PCI DSS version 4.0, the most recent iteration, emphasises a dynamic, risk-based approach to security, compelling organisations to tailor their controls to their unique environments. PCI DSS penetration tests are crucial for meeting and maintaining security standards. Within this framework, PCI penetration testing remains an indispensable tool for identifying and mitigating vulnerabilities within the Cardholder Data Environment (CDE).

What is PCI DSS Compliance 4.0?

Released in March 2022, PCI DSS 4.0 builds upon previous versions by introducing a more flexible and risk-centric approach. It empowers organisations to prioritise security controls based on their unique environment, emphasising continuous improvement and a tailored security program.

Key changes in PCI DSS 4.0 include:

• Focus on Outcomes: The emphasis shifts from merely adhering to prescriptive controls to achieving measurable security objectives.
• Enhanced Prioritisation: Organisations can prioritise control implementation based on a comprehensive risk assessment.
• Emphasis on Defence-in-Depth: A layered security approach, incorporating diverse controls, is encouraged to create a resilient defence against potential threats.

Network penetration testing is an integral part of the risk-based approach in PCI DSS 4.0, ensuring that all network segments and systems are thoroughly evaluated for vulnerabilities.

What is PCI Penetration Testing?

Penetration testing (or pen testing) is a simulated cyberattack on your systems that handles sensitive cardholder data. By mimicking the tactics of real-world threat actors, pen tests reveal weaknesses and potential entry points before they can be exploited.

Think of it as a proactive stress test for your security measures. PCI DSS mandates regular penetration testing to ensure the ongoing protection of cardholder data, bolstering consumer trust and mitigating the risk of financial and reputational damage. This includes scoping and defining the scope of PCI penetration testing to identify and test against critical systems such as network connections, access points, applications/servers, and isolated environments that store, process, and transmit cardholder data within the cardholder data environment.

Beyond fulfilling PCI DSS requirements, penetration testing offers significant benefits for your organisation:

• Strengthened Security Posture: By proactively identifying and addressing vulnerabilities, you reduce the risk of a data breach and enhance overall security.
• Improved Risk Management: Penetration testing provides valuable insights into your organisation’s risk profile, allowing you to prioritise security investments.
• Enhanced Stakeholder Confidence: Demonstrating a commitment to security through regular testing can build trust with customers, partners, and investors.

What are PCI DSS Penetration Test Requirements 4.0?

PCI DSS penetration test requirements outline the specific requirements. Here’s a breakdown of the PCI DSS requirements.

Requirement 11.3.1 – External Penetration Testing

Simulates external attacks to identify vulnerabilities accessible from outside the organisation’s network. Must be performed annually and after significant changes to the CDE.

💡Suggested Read: External Penetration Testing

Requirement 11.3.2 – Internal Penetration Testing

Mimics attacks originating from within the network to expose vulnerabilities that malicious insiders could exploit. Requires annual execution and retesting after significant changes.

💡Suggested Read: Internal Penetration Testing

Requirement 11.3.3 – Segmentation Testing

Validates the effectiveness of network segmentation in isolating the CDE. It can be integrated into internal penetration testing.

Requirement 11.3.4 – Application-Layer Penetration Testing

It focuses on identifying vulnerabilities within web applications that interact with cardholder data. Frequency determined by risk assessment.

Requirement 11.4 – Penetration Testing Methodology

It mandates using a qualified penetration tester who adheres to a documented and industry-recognised methodology.

Requirement 11.5 – Remediation and Retesting

Discovered vulnerabilities must be prioritised, addressed promptly, and retested to confirm remediation effectiveness.

Frequency of PCI penetration testing

Here’s a breakdown of how often you need to perform PCI penetration testing:

• External Testing: At least annually and after significant infrastructure or application changes that could introduce new vulnerabilities. Annual PCI penetration testing is quite common across the industry.
• Internal Testing and Segmentation Testing: Ideally, it will be done every six months. Many organisations combine these tests for efficiency.
• Remediation and Retesting: Required for medium-risk or higher vulnerabilities to verify that fixes are effective.

Who needs PCI DSS penetration testing?

Any organisation that stores, processes, or transmits cardholder data must adhere to PCI DSS requirements, including penetration testing. This encompasses many entities, from retailers and financial institutions to service providers and e-commerce platforms.

How is PCI DSS penetration testing performed?

Undergoing a PCI penetration test involves several key phases that ensure a thorough assessment and compliance with PCI DSS standards. Here’s a breakdown of the process:

1. Scoping

Before the test begins, detailed information about your Cardholder Data Environment (CDE) is crucial. This includes:

• Number of systems (hosts) involved
• Number of network segments within the CDE scope
• A network diagram illustrating the CDE’s layout

Network penetration testing helps define the scope of PCI penetration testing by assessing the number of systems and applications in scope, the time required to complete the test, and the depth of documentation needed.

2. Rules of Engagement

Once the scope is defined, it’s time to establish clear guidelines for the testing process. This information will be documented and included in the final report submitted to your auditor. Key details to cover include:

• Testing windows: Specify the approved times for the testing to take place.
• Excluded systems: List any systems that should not be scanned automatically.
• Testing limitations: Identify controls that might hinder testing or require special considerations.
• Communication channels: Define how the tester and your team communicate throughout the process.
• Potential concerns: Raise any specific issues or questions for the tester.

3. Reviewing Past Issues and Test Results

Here’s how success criteria are determined:

• Testing techniques and depth: The defined criteria will guide the intensity and types of testing methods used.
• Validating impact: In some cases, demonstrating how a system can be compromised can be helpful. This can assist in validating the severity of an issue and ensuring proper logging is in place for future detection.

Unlike typical penetration testing, PCI DSS emphasises reviewing past issues and test results. This helps with:

• Verifying remediation: Confirming that previously identified vulnerabilities have been addressed effectively.
• Based on past findings, we identify potential weaknesses and gain insights into areas still susceptible to attacks.
• Control validation: Assessing how existing controls are functioning within your environment.

4. Control Deployment Review

To ensure compliance, PCI penetration testing involves additional evidence-gathering measures not typically seen in regular penetration tests. Understanding how security controls are implemented is crucial for validating their effectiveness during testing.

5. The Testing Process and Beyond

The core testing phase and post-testing activities (reporting, review meetings, and potential retesting) follow a similar structure as in regular penetration testing. However, the emphasis on scoping, defining success criteria, and leveraging past security data makes PCI pen tests a unique and compliance-focused exercise.

Who Should Conduct PCI Pentesting?

There are two options for conducting a PCI penetration test:

Internal Resource

A qualified staff member with the necessary expertise can perform the testing. However, this approach can be:

• Time-consuming: Finding dedicated time for internal testing can be a challenge.
• Resource-intensive: The staff member needs significant expertise.
• Potentially biased: Internal testers might overlook specific vulnerabilities.

External Third-Party Provider

This option is standard, especially for smaller businesses. Benefits include:

• Efficiency: External providers have the resources and expertise for swift testing.
• Reduced workload: Security teams can focus on other priorities.
• Objectivity: External testers bring a fresh perspective and minimise bias.

The PCI DSS penetration testing guidance covers choosing a qualified external provider. Here’s what to look for:

• Certifications: CREST, OSCP, OSCE, CISSP, CEH, and GSNA indicate a provider’s competence. Having testers with certifications like Offensive Security Certified Professional (OSCP) is crucial to demonstrating technical capabilities for conducting impartial testing against the environment.
• PCI DSS Experience: Choose a provider with a proven track record of conducting PCI DSS-compliant penetration tests.
• Experience Matching Your Needs: Ensure the provider has experience with businesses similar to yours in size and industry.

By carefully selecting a qualified provider, you can streamline your path to PCI DSS compliance and ensure a thorough and objective security assessment.

How much does PCI pen testing cost?

While there’s no one-size-fits-all price for PCI penetration testing, here’s a breakdown of factors that influence the cost:

• Scope: A full internal or external network penetration testing service might seem cheaper but can backfire. PCI requires remediation of medium-risk vulnerabilities, and a full test might uncover issues outside the Cardholder Data Environment (CDE) that still need to be addressed. This can lead to higher costs and potential delays.
• CDE Focus: Most organisations focus the penetration test solely on the CDE. This requires a clearly defined CDE to determine the testing scope and might impact the final price.
• Test Type: Unlike basic unauthenticated application tests, web application testing is a mandatory component of PCI penetration testing. Web application testing typically involves a more in-depth examination.

How do you choose a Qualified Penetration Testing Provider?

Selecting a qualified penetration testing provider is vital for a thorough and compliant assessment of your Cardholder Data Environment (CDE). Ensure your chosen provider meets these criteria:

• Certifications and Qualifications: Seek providers with industry-recognised certifications, such as CREST, OSCP, OSCE, and CISSP, demonstrating their expertise and commitment to professional standards. Cyphere is a CREST-accredited penetration testing services provider with proven PCI DSS compliance experience.
• Industry-Specific Experience: Opt for a provider familiar with your industry’s unique security challenges and regulatory requirements, ensuring a tailored approach to testing.
• Reputation and References: Research the provider’s standing within the cybersecurity community, seek client testimonials, and request references for direct feedback. We happily provide customer references to validate our expertise and sector experience.
• Comprehensive Methodology: Confirm using a documented, industry-recognised testing methodology, detailing the steps, tools, techniques, and reporting format for transparency and thoroughness.
• Post-Testing Support: Prioritise providers offering remediation guidance, verification of fixes through retesting, and ongoing support to address new security concerns, ensuring your vulnerabilities are effectively mitigated.

By selecting a provider meeting these criteria, you’ll receive a comprehensive and objective PCI DSS penetration test, enhancing your security posture and compliance.

Best Practices for PCI DSS Penetration Testing

Adhering to these best practices will maximise the effectiveness of your PCI DSS penetration testing:

• Regular Testing: Conduct tests at least annually and after significant changes to the CDE. More frequent testing, ideally every six months or quarterly, allows for faster identification and remediation of vulnerabilities.
• Comprehensive Scope: Clearly define the CDE’s boundaries, including all relevant systems, networks, and applications, to ensure no critical assets are overlooked.
• Risk-Based Approach: Prioritise testing based on a thorough risk assessment, focusing on high-risk areas and critical assets for efficient resource allocation.
• Layered Security (Defence-in-Depth): Implement multiple security controls, combining preventive, detective, and corrective measures to create a resilient defence against attacks.
• Thorough Methodology: Employ a documented and industry-recognised methodology encompassing automated and manual testing techniques to ensure comprehensive coverage.
• Prioritised Remediation and Retesting: Address identified vulnerabilities promptly, prioritising by severity and potential impact. Retest to verify the effectiveness of fixes and ensure new vulnerabilities haven’t been introduced.
• Communication and Collaboration: Maintain open communication with your penetration testing provider, establishing clear channels for updates, feedback, and collaboration.

Is your business responsible for conducting regular penetration tests? Contact us to discuss your concerns or learn our approach to delivering excellent investment returns.