What is PCI Penetration Testing and How it Works + Downloadable Template

For every lock, there is someone out there trying to pick it and break in. – David Bernstein. 

We check our home’s lock twice before leaving. Do you ensure the same thing in maintaining your customer data? Yes, we are talking about the PCI penetration testing.

Organizations that store, process, and handle credit cards and payment information need to be PCI DSS (Payment Card Industry Data Security Standards) compliant. 

To become PCI DSS compliant, you need to meet many technical requirements, like penetration testing. What is it, who needs to perform it, and how is it done? Let’s get into it.

What is PCI Penetration Testing

A PCI penetration testing is the process of evaluating and identifying vulnerabilities and threats in the systems that process and store cardholder information. The card holder environment (CDE) perimeter may include applications, third party services, IP addresses, and networks.  

PCI pen testing aims to mimic the attackers’ activity in the CDE and identify and exploit the vulnerabilities that give unauthorized access to the cybercriminals into the system.

Why is PCI Penetration Testing Important?

Credit card fraud is one of the most prevalent issues affecting millions of cardholders across the globe. When dealing with cardholder data, having a protective card environment should be at the top of the list considering security.

Within the PCI DSS requirements, 11.3.1 and 11.3.2, you are required to perform penetration testing at least once annually or after any significant changes in your systems (segmentation controls) to avoid problems such as 

• Non-compliance penalties
• Data breaches
• Financial and reputational damage

PCI pen tests help you identify your security gaps and vulnerabilities and enable you to act on them before bad actors and hackers exploit them. This is why it is crucial to perform regular pen tests from both security and compliance points of view.

Who Needs To Perform a PCI Penetration Test

As per the PCI DSS 11.3 requirements, the PCI Council specifies that a penetration test needs to be performed by a qualified internal resource or third-party professional. Also, the tester needs to be independent of the systems on which penetration tests will be performed. This means that they should not be involved in the setup, support, and management of the CDE systems.

There are guidelines specified for assessing the past experience of the pen tester. Below are some certifications mentioned in the guideline which may validate that professionals are qualified.

• Offensive Security Certified Professional (OSCP)
• Offensive Security Certified Expert (OSCE)
• Certified Ethical Hacker (CEH) – EC Council
• GIAC Exploit Research and Advanced Penetration Tester (GXPN)
• GIAC Certified Penetration Tester (GPEN)
• GIAC Web Application Penetration Tester (GWAPT)
• CREST Registered Penetration Tester

It is important to note that certifications alone are not enough and you need to follow other guidelines as well like looking at past experiences, projects, tests performed, and more while choosing the pen tester.

Also check out details on Penetration Testing for PCI DSS 4.0

How to perform PCI Penetration Testing?

A PCI DSS penetration test consists of 5 steps, each broken into three phases: pre-engagement, which involves the planning of scoping and information gathering; engagement, the evaluation process; and post-engagement, which involves reporting and retesting. Let us briefly elaborate on each step below.

1. Scoping

Before getting into the pen test, the scope (including details on objectives, assets, or environments that need to be tested) and the required approvals, are determined using PCI DSS requirements. This includes the entire CDE perimeter (both external and internal).

Any critical systems in the organization, like network connections, access points, and applications/servers that store, process, and transmit cardholder data come under the scope. All systems not connected with the CDE are considered out of scope for PCI penetration testing.

2. Reconnaissance & Discovery

Once the scope is defined, the pen tester will identify your network assets within the specified scope of the CDE. During this step, they try to gather information on the target through various reconnaissance techniques. 

Also, the tester will identify all the hosts in the target network and their services. This can be done using various techniques, such as banner grabbing, port scanning, and social engineering.

3. Exploitation & Evaluation

Using the scope and discovery, the penetration testing team now evaluates all your systems and applications for entry points and vulnerabilities. This is generally done using manual techniques and automated tools. 

The pen tester tries to exploit the identified vulnerabilities to gain access to the organization’s systems and cardholder data. Furthermore, they try to explore the CDE to identify additional attack vectors and evaluate the overall security parameters.

4. Reporting

After the evaluation, the pen testing team compiles a detailed report of the penetration testing methodology, the vulnerabilities discovered, the severity of each vulnerability, and the recommended remediation steps. 

Generally, a clear flow of the penetration testing steps to provide evidence is also mentioned in the report for the stakeholders. Based on the report, the relevant team addresses the identified vulnerabilities and implements the recommended remediation steps.

5. Retest

In the final phase, the company tests its systems again to ensure that it appropriately addresses the identified vulnerabilities and complies with the PCI DSS.

The pen test process is repeated regularly or whenever there is a change in your network or system infrastructure. This ensures that your previous pen testing efforts were effective and maintained the security of CDE in place.

Before we get to the top PCI penetration testing tools, let’s look at the difference between PCI pen testing and vulnerability scanning.

We have a free resource for you if you want to check how risk assessment approach works:

Difference Between PCI Penetration Testing and Vulnerability Scanning

Vulnerability scanning utilizes software applications for testing and identifying vulnerabilities in your network and applications. The scanner looks for known vulnerabilities in your software and reports those that need to be fixed.

While PCI penetration testing simulates an attack by hackers and identifies vulnerabilities in your network and applications. A pen tester uses manual and automated tools to identify and exploit vulnerabilities. Unlike vulnerability scanners, it also tests the security control of the organization, policies, and procedures with a comprehensive report. 

To sum up, both penetration testing and vulnerability scanning are essential for PCI compliance, and they have certain similarities. But penetration testing proves to be more efficient as it follows a more comprehensive approach to the organization’s security posture, while vulnerability scanning is targeted for testing specific vulnerabilities.

How does a PCI penetration test differ from a regular penetration test?

While both aim to identify vulnerabilities, a PCI penetration testing differs from a regular pen test in terms of audit requirements, scope, frequency, process, and objectives. Let’s break these down: 

	PCI pen test	Regular pen test
Objective	The PCI penetration scope is a key differentiator with a regular pen test. A PC