PCI Penetration Testing

Perform our PCI Penetration Test – an ethical hacking exercise that helps organizations unveil weaknesses, secure the CDE and meet PCI compliance requirements.

What is PCI Penetration Testing?

PCI DSS Penetration Testing is a cyber security assessment that involves testing an organization’s complete cardholder data environment (CDE) and systems impacting it under specific requisites of PCI DSS. Deverra PCI Penetration Testing services help identify potential ways a malicious user would try to access resources affecting an organization’s CDE.

PCI DSS is a mandatory requirement for any organization that accepts payment cards as a means of processing payments. To ensure the security of applications, networks and cardholder data, organizations shall perform periodic vulnerability assessments and penetration testing. In contrast to general pen testing, a PCI Pentest precisely focuses on the security of the cardholder data environment (CDE).

PCI ASV Services

ASV Scans are services that scan for vulnerabilities in the publicly exposed systems associated with your CDE. Authorized Scanning Vendors perform PCI ASV scans in PCI DSS Penetration Testing engagement. Deverra facilitates the ASV Scans until you acquire passing results every quarter.

PCI Segmentation Testing

Our security experts perform PCI Segmentation Testing (PCI DSS requirement 11.3.4 or 11.3.4.1) for organizations to isolate the CDE from other networks and reduce compliance scope, at least annually or half-yearly (service providers).

PCI External Penetration Testing

PCI DSS requirement 11.3.1 requires organizations to perform external penetration tests at least annually or after a significant change to the CDE or systems within the CDE.

PCI Internal Penetration Testing

PCI DSS requirement 11.3.2 mandates the need for performing internal penetration tests of the CDE to secure the systems and network from attacks against the payment infrastructure.

Quarterly Internal Vulnerability Scans

Internal vulnerability scans (PCI DSS requirement 11.2) help organizations detect and fix vulnerabilities. PCI DSS requires passing reports each quarter.

Quarterly Wireless Network Analysis

PCI Requirement 11.1 requires wireless network identification every quarter. Wireless network analysis in a PCI Pentest helps organizations identify rogue wireless networks.

Our PCI Penetration Testing Approach

Defining The Scope

Defining the complete coverage or scope in PCI Pentest is essential to ensure continuous compliance with PCI DSS Requirements. All systems & networks that store, process, or transmit cardholder data or sensitive authentication data and any technology that can affect its security should be part of the scope.

Reconnaissance

The assets in the scope get identified in the recon phase of the PCI Pen Testing.

Assessment

At this stage, we will perform the required security tests and exploitations as outlined in the PCI DSS Penetration Testing Guidelines.

Reporting

We will prepare QSA acceptable penetration test reports that include the methodology of tests, documentation of findings and remediation steps.

Re-Tests

Clean reports are critical for the success of your PCI Compliance. We can perform a re-test to validate the closure and issue a clean report once everything gets fixed.