{"id":5735,"date":"2023-08-23T15:34:16","date_gmt":"2023-08-23T19:34:16","guid":{"rendered":"https:\/\/solutionsreview.com\/endpoint-security\/?p=5735"},"modified":"2023-08-23T15:34:54","modified_gmt":"2023-08-23T19:34:54","slug":"pci-dss-4-0-why-pen-testing-is-key-for-compliance","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/endpoint-security\/pci-dss-4-0-why-pen-testing-is-key-for-compliance\/","title":{"rendered":"PCI DSS 4.0: Why Pen Testing is Key for Compliance"},"content":{"rendered":"

\"PCI<\/p>\n

Solutions Review\u2019s\u00a0Contributed Content Series<\/u><\/a> is a collection of contributed articles written by thought leaders in enterprise software categories. Eren Cihangir of Outpost24<\/a> makes the argument for why pen testing will be the key to meeting PCI DSS 4.0 Compliance.<\/strong><\/em><\/p>\n

In a world where cyber-attacks are rife, and data breaches are an unfortunate daily occurrence, we’ve witnessed the disastrous impact when credit card information is breached. In 2017, the Equifax data breach exposed over 209,000 credit card details and impacted over 147 million people. The aftermath resulted in Equifax settling with regulators for $700 million. In 2019, Capital One (the fifth largest credit card issuer in the US) suffered a hack that compromised 106 million customers across the US and Canada. If we look more recently, HRM Enterprises, which owns the US\u2019s largest independent hardware store, had 40,000 credit cards stolen because of a cyber-attack.<\/p>\n

To ensure that all merchants, credit card providers, and services that process, store, or transfer credit card data keep such information secure, they must adhere to the Payment Card Industry Data Security Standard (PCI DSS). This sets out the cybersecurity and privacy requirements to ensure these organizations maintain a safe environment. The compliance requirements are regularly being updated, with PCI version 4.0 announced in March 2022, with a deadline of March 31, 2024, for all organizations to be compliant.<\/p>\n

Yet, when examining the new version of this critical standard, penetration testing (pen testing) remains a necessity (under requirement 11), but in what capacity and who must perform this security assessment? Analyzing the new version of the PCI standard, pen testing, and vulnerability scanning are needed to protect payment cardholder data and keep systems secure. Payment card service providers will have to carry out pen test assessments twice a year, with vulnerability scans conducted once a quarter. Moreover, if your organization processes payment card information through business-critical web applications, then these will also need regular tests and scans, especially when these systems undergo significant changes and updates.<\/p>\n

So, what are the main differences between a PCI pen test and a PCI vulnerability scan, and what is expected from both?<\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\n

PCI DSS 4.0: Why Pen Testing is Key for Compliance<\/strong><\/h2>\n
\n

PCI Pen Test<\/strong><\/h3>\n

This security assessment is designed to unearth and exploit any vulnerabilities discovered in the cardholder data environment (CDE), including the organization\u2019s infrastructure, network, and applications, on a regular basis. This is to test the resilience of the defenses in place and typically, Pen testing is a manual process that can also incorporate automated solutions to locate and trigger the security flaw into operating. An actionable report is then produced based on the findings of the test which detail the vulnerabilities, threats, and risks posed to cardholder data.<\/p>\n

PCI Vulnerability Scan<\/strong><\/h3>\n

When conducted, a PCI vulnerability scan is an advanced test that produces a report after completion, displaying the most severe vulnerabilities and ranking them in order of importance. With the risk of external IPs and domains being exposed in the CDE, these must be scanned regularly, with PCI DSS demanding that tests be carried out at least four times a year. The tools used to carry out vulnerability scans are largely automated, but these often must be verified manually.<\/p>\n

The length of time both assessments take to finish also differs. Vulnerability scans can be completed in a matter of minutes, whereas pen testing can vary between days or weeks depending on the size and scope of the organization\u2019s CDE. Both these tests are integral in reducing the overall attack surface of the CDE and provide security teams visibility on where weaknesses may appear.<\/p>\n

With the requirements for PCI DSS readily available, organizations are obliged to define, document, and implement a penetration testing methodology to adhere to a variety of standards, such as:<\/p>\n