QASource Quarterly Expert Series

Payment Card Industry Data Security Standard (PCI DSS) refers to a set of security standards for companies that are involved in accepting, processing, storing or transmitting credit card information to ensure the maintenance of secure environment.

PCI DSS Compliance Requirements

PCI DSS specifies 6 groups (Control Objectives) for compliance requirements, listed below:

Penetration Testing Approach

For PCI DSS compliance, both vulnerability scan and penetration testing are required. While vulnerability scan identifies vulnerabilities through automated procedures, penetration test exploits those vulnerabilities primarily through manual techniques.

• Pre Penetration Testing Phase

  • Identify system components dealing with CDE(Cardholder Data Environment)
  • Detailed documentation including diagrams and process flows of the scoped components
  • Define rules of testing
  • Define depth of pen testing and success criteria

• Penetration Testing Phase

  • Application layer - Access control check and unauthorized access to data
  • Network layer - Automated network scans and attempts to bypass authentication controls and authorization across the CDE(Cardholder Data Environment)
  • Social engineering - Convincing someone non-technically to open a door for attack

• Post Penetration Testing Phase

  • Notification if the cardholder data is accessed
  • Execute incident response plan
  • Retest identified vulnerabilities
  • Build the best practices for handling found vulnerabilities
  • Clean the whole testing environment

Tool Evaluation - HackerGuardian

PCI SSC approved tool for businesses and any service providers dealing with card data to stay compliant with the PCI DSS. This is comparatively a low cost tool as compared to its competitors like Qualys PCI and CoalfireOne.

Features

• Ability to scan the entire network of organization and scale globally
• Organized process for acquiring and maintaining PCI DSS compliance
• Centralized updates for policies across all applications
• Highly useful report generation
• Generates compliance status reports to be submitted to banks
• Reports are downloaded manually from cloud
• Scanning time is a bit longer as compared to its competitors

Have Suggestions?

We would love to hear your feedback, questions, comments and suggestions. This will help us to make us better and more useful next time.
Share your thoughts and ideas at knowledgecenter@qasource.com