[Autogenerated] Now I know that was quite a bit to
think about in terms of ___________, testing.
And of all the PC IDE CSS requirements,
this is the one I've experienced the most variability
in how well organizations do it.
And it really comes down to whether the organization wants to
learn about security and find vulnerabilities or if it just
wants to take the 11.3 check box.
Sadly,
the box tickers the ones where the criminals end up
providing a free of charge ___________ test.
So for organizations that want to make the most of their ___________ testing on,
make sure they also comply with the spirit of PC.
Idea says.
The question I get asked most is,
what should the scope of the internal next colonel test be?
So, Taking our example Network,
Let me quickly explain how I'd scope the PC IDE CSS pen test.
Firstly, external test.
The tester shown here is that Purple Circle will be
somewhere out on the Internet,
and they'd be targeting all of the external interfaces the
organization has exposed on the Internet.
So it's a various obvious one.
They're off the web service and the web service connection to the internet.
But there's also that VPN connection between each store and head office.
Because those firewalls could have vulnerabilities or
there could be Miss Configured.
I'd expect the external pen test to look at both of those
firewalls and make sure there was nothing there.
Now let's think about the internal ___________ test and here, I'd first asked.
The test is to go to one of the retail stores and see what they can actors on
the in store systems and then also follow the VPN connection to see what systems
of data thead office are accessible from the store.
Because, remember,
the physical security controls at remote stores is usually pretty poor,
and I've actually been countless attacks launched from retail stores.
Next, the very obvious test,
which is having the test error connected into the 500.
On the scope of this will be the 500 the DMC,
and again I actually asked him to go back up the VPN into the stores.
I'll also ask the test to connect the DMZ,
targeting both systems in the DMZ and the core CD from the DMZ.
And finally I asked him to test from the Management Network to make sure that
it wasn't Miss Configured or it contained vulnerabilities,
and also that it was only allowed to connect to systems in the permitted ways.
So that's all the test side wants to his apartment internal ___________ test,
which then leaves the segmentation test to fulfill requirement 11.3 point four.
And I've sort of said here that you know that we've
gotten out of scope Corporate network.
So the most obvious place for the tested to start is on
that corporate network to validate.
There's no way through into the cardholder data environment or into the D.
M Z,
and also that the test they can't access anything other than the
permitted service in the management network and if it hadn't been
covered properly in the internal test.
I also want the segmentation between the DMC on the core CD
validated to to prove that it's a segmented separate network on
does not like in any any rule on that firewall,
meaning that we're now storing cardholder data on that on that database server,
which is effectively accessible to anyone from the outside.
So look,
because ___________ testing is one of the most
valuable requirements in PC IDE CSS.
But it's also the one where there's so much opportunity
for variability based on the tester, the environment,
the cure nested and organizations intent.
There is a really useful information supplements on the P CSS See
website and is really recommend reading it before you.
Commissioner ___________ test to learn about the
vulnerabilities in your cardholder data environment,
but also meet the requirements of 11.3.
Now let's join that conversation with Jacob where we
discuss ___________ testing methodologies.
How QoS Assess Requirement 11.3 on Jacob's thoughts
on on lousy ___________ tests.