PCI Requirement 11.3.2 – Perform Internal Penetration Testing at Least Annually

by Randy Bartels / December 16, 2022

 Internal Penetration Testing PCI Requirement 11.3.2 requires that organizations perform internal penetration testing at least annually and after any significant upgrade or modification. Internal penetration tests focus on servers, workstations, and other network devices that are within the target environment. The goal is to identify exploitable weaknesses that could allow an attacker to gain access to these systems, ultimately leading to access to sensitive data. When determining what constitutes…

PCI Requirement 11.3.1 – Perform External Penetration Testing at Least Annually

by Randy Bartels / December 16, 2022

 External Penetration Tests PCI Requirement 11.3.1 requires that organizations perform external penetration testing at least annually and after any significant upgrade or modification. External penetration tests focus on servers, workstations, and other network devices that are within the target environment. The goal is to identify exploitable weaknesses that could allow an attacker to gain access to these systems, ultimately leading to access to sensitive data. When determining what constitutes…

Fortify your defenses

PCI Requirement 11.3 – Implement a Methodology for Penetration Testing

by Randy Bartels / December 16, 2022

 What is Penetration Testing? They key component of PCI Requirement 11.3 is penetration testing. Who can perform the testing? What’s involved? When should it be performed? PCI Requirement 11.3 outlines the qualities of an effective penetration testing methodology, which include: Based on industry-accepted penetration testing approaches Includes coverage for the entire cardholder data environment perimeter and critical systems Includes testing from both inside and outside the network Includes testing…

PCI Requirement 11.2.3 – Perform Internal and External Scans, and Rescans as Needed, After Any Significant Change

by Randy Bartels / December 16, 2022

 Significant Changes in Your Cardholder Data Environment PCI Requirement 11.2.3 requires that any time that you have made a significant change in your environment, whether it be internal or external, you run a vulnerability scan. A significant change could be something like new system component installations, changes in network topology, firewall rule modifications, or product upgrades, but what constitutes a significant change depends on the configuration of your environment.…

PCI Requirement 11.2.2 – Perform Quarterly External Vulnerability Scans via an Approved Scanning Vendor

by Randy Bartels / December 16, 2022

 What is an ASV? To comply with PCI Requirement 11.2.2, you must use a PCI SSC Approved Scanning Vendor (ASV). An ASV is defined as, “An organization with a set of security services and tools (‘ASV scan solution’) to conduct external vulnerability scanning services to validate adherence with the external scanning requirements of PCI DSS Requirement 11.2.2. The scanning vendor’s ASV scan solution is tested and approved by PCI…