Comments on: PCI DSS 11.3: Penetration Testing Requirements Clarified

By: Joseph Pierini

Joseph Pierini — Fri, 18 Nov 2011 19:06:57 +0000

Your definition of the scope is incorrect.

The scope of penetration testing is the Cardholder Data Environment (CDE) and all systems and networks connected to it. The PCI Security Standards Council defines the CDE as “The people, processes and technology that store, process or transmit cardholder data or sensitive authentication data, including any connected system components.”

As recommended by the PCI Security Standards Council’s Information Supplement: Requirement 11.3 Penetration Testing dated April 2008, testing should include locations of cardholder data, key applications that store, process, or transmit cardholder data, key network connections, key access points and other targets appropriate for the complexity and size of the organization.

Testing should not be performed inside the CDE.

By: Information Secuity

Information Secuity — Fri, 04 Nov 2011 06:33:02 +0000

India has called for global coordination to ensure that internet continues to thrive without the fear of its misuse at the London Internatinal Cyber Conference that give the nature of the task and the fact that IT networks can be attacked from anywhere in the world.

By: Mohamed Farid

Mohamed Farid — Mon, 18 May 2009 17:45:57 +0000

Regarding the external pen test – the pen tester will evaluate the Scope from the Internet or through any Public Connection …

What about the Internal Pen Testing – Will it be evaluated from the DMZ towards the Scope ( Live Production ) ? or internally from the Scope Directly ?

My Concern is Evaluating it from inside is ignoring the Firewalls and the Access-lists around the scope – and also it will give a lot of false positives which are already protected using the boundary security products.

By: Penetration Testing

Penetration Testing — Wed, 06 Aug 2008 19:26:35 +0000

What are your thoughts on situations where Operational Security and other areas of Information Security have separate reporting lines – i.e. they may have separate line management but report into the same CSO or head of security? Would it still be feasible to have non-ops infosec conducting penetration testing in your opinion?