Internal Pci

Who Should Handle Your PCI Penetration Testing?

Being a QSAC (Qualified Security Assessor Company), our clients frequently ask if they can achieve their continuing PCI penetration testing requirements in-house. This depends on a few variables.

An organisation's requirement for administering a yearly external and internal penetration test that also includes application testing is covered by PCI DSS requirement 11.3. This is different than the PCI DSS 11.2 requirement that deals with an organisation's requirement for running internal and external vulnerability scans quarterly, which must be run internally or by an ASV (Approved Scanning Vendor) respectively. Each of these activities must also be performed either when changes take place in the applications, which includes upgrades, network, and infrastructure of the organisation, or at the mandated intervals.

From a technical perspective there are key differences in these requirements as well. To determine the magnitude of the issues and full business impact, the penetration test tries to take advantage of the vulnerabilities by exploiting them, while noted issues are just identified and reported by the vulnerability assessment. The penetration testing must include application layer tests, and is more manual and comprehensive as compared to the vulnerability scans.

The yearly penetration test does not need to be conducted by a party external to the organisation according to the guidance supplied from the PCI SSC. The testing, however, needs to be completed by a party that is well qualified, who is organisationally separate from the management of the systems being tested. All in-scope locations should be included in the penetration test, and the test should be appropriate for the size and intricacy of the organisation. Results from either black box or white box penetration testing approaches should be documented, with all systems and networks in the cardholder data environment included in the scope of the testing. Smaller organisations that have only limited resources could have some difficulty in demonstrating their adherence to these requirements.

Outsourcing these requirements to an organisation that can deliver comprehensive independent results and that is also wholly focused on the delivery of these professional services is usually preferred by larger organisations. Penetration testing should not only be conducted to meet compliance obligations. What this testing should do is lead to an improved security posture, and this is believed by many to be best accomplished by seeking the services of a firm which specializes in this field.

About the Author

Sense of Security is Australia's premier provider of a range of IT security and risk management solutions. Its services include IT security reviews, penetration testing, audit and PCI compliance. Sense of Security provides PCI compliance services through its team of QSA's to many of the countries leading organisations.

3Com HomeConnect Adsl Modem PCI 1WAN Internal PCI 3CP3617B $36.09 3Com HomeConnect Adsl Modem PCI 1WAN Internal PCI 3CP3617B

Zoom / 3025CG V.92 PCI INTERNAL MODEM / 3025-00-00CG $54.9 Zoom - 3025CG V.92 PCI INTERNAL MODEM - 3025-00-00CG

Asus PCI Express - 150 Mbps - Internal PCEN10 $36.12 Asus PCI Express - 150 Mbps - Internal PCEN10

StarTech.com PCI - 16 bit - Internal PCISOUND4CH $20.3 StarTech.com PCI - 16 bit - Internal PCISOUND4CH

SIIG SoundWave 5.1 PCI - CMI8738 - Internal IC510012S2 $24.63 SIIG SoundWave 5.1 PCI - CMI8738 - Internal IC510012S2

SIIG VT1723 - PCI - 24 bit - Internal LP000022S2 $39.73 SIIG VT1723 - PCI - 24 bit - Internal LP000022S2

Asus AV200 - PCI - 24 bit - Internal XONARDS $60.11 Asus AV200 - PCI - 24 bit - Internal XONARDS

Asus CMI8786 PCI 24bit Internal Xonardg $32.61 Asus CMI8786 PCI 24bit Internal Xonardg

Diamond Multimedia PCI - 24 bit - Internal XS71 $28.18 Diamond Multimedia PCI - 24 bit - Internal XS71

Asus AV100 High-Definition - PCI - Internal 90YAA0E00UAN00Z $214.4 Asus AV100 High-Definition - PCI - Internal 90YAA0E00UAN00Z

Asus CMI8786 - PCI - 24 bit - Internal XONARDG $37.29 Asus CMI8786 - PCI - 24 bit - Internal XONARDG

Voyetra Turtle Beach PCI - Internal TBS3429 $37.55 Voyetra Turtle Beach PCI - Internal TBS3429

Startech.com / 3+1 INTERNAL PORT PCI EXPRESS / PEX13943 $46.36 Startech.com - 3+1 INTERNAL PORT PCI EXPRESS - PEX13943

Broadcom Wireless Internal Mini PCI Card IEEE 802.11b-g BCM4306KFB $24 Broadcom Wireless Internal Mini PCI Card IEEE 802.11b-g BCM4306KFB

TRENDNET PCI - 1 x SC - 100Base-FX - Internal TE100PCIFC $66.76 TRENDNET PCI - 1 x SC - 100Base-FX - Internal TE100PCIFC

Allied Telesyn PCI Express - 1 x RJ-45 - 10/100/1000Base-T - Internal AT2912T901 $105.22 Allied Telesyn PCI Express - 1 x RJ-45 - 10/100/1000Base-T - Internal AT2912T901

Mellanox ConnectX-3 10Gigabit Ethernet Card - PCI Express x8 - Internal MCX354AQCBT $960.35 Mellanox ConnectX-3 10Gigabit Ethernet Card - PCI Express x8 - Internal MCX354AQCBT

Intel PCI Express - 1 x RJ-45 - 10/100/1000Base-T - Internal EXPI9301CT $44.67 Intel PCI Express - 1 x RJ-45 - 10/100/1000Base-T - Internal EXPI9301CT

HP NC3121 Network Adapter 2-Ports 10/100Base-TX Internal PCI 317453001 $13.02 HP NC3121 Network Adapter 2-Ports 10/100Base-TX Internal PCI 317453001

Mellanox ConnectX-3 Gigabit Ethernet Card - PCI Express - 10/100/1000Base-T - Internal MCX312AXCBT $412.41 Mellanox ConnectX-3 Gigabit Ethernet Card - PCI Express - 10/100/1000Base-T - Internal MCX312AXCBT

StarTech.com PCI Express x4 - 4 x RJ-45 - 10/100/1000Base-T - Internal ST1000SPEX4 $240.35 StarTech.com PCI Express x4 - 4 x RJ-45 - 10/100/1000Base-T - Internal ST1000SPEX4

Diamond MultiMedia Supramax 56K V.92 Internal PCI 90500031 $14.13 Diamond MultiMedia Supramax 56K V.92 Internal PCI 90500031

US Robotics 56Kbps Internal Modem V.92 PCI USR5610B $16.29 US Robotics 56Kbps Internal Modem V.92 PCI USR5610B

US Robotics 56K Internal Fax/Modem V.92 PCI USR5699B $19 US Robotics 56K Internal Fax/Modem V.92 PCI USR5699B

Best Data 56K Internal Fax/Modem V.90 PCI RJ-11 MACH2PCI $21.28 Best Data 56K Internal Fax/Modem V.90 PCI RJ-11 MACH2PCI

3Com US Robotics 56K Internal Fax/Modem V90 PCI 3CP5610A $88.29 3Com US Robotics 56K Internal Fax/Modem V90 PCI 3CP5610A

US Robotics 56K Internal Modem V.92 PCI USR5699B $46.27 US Robotics 56K Internal Modem V.92 PCI USR5699B

US Robotics 56K Internal Fax/Modem V.90 PCI 3CP2977OEM 3CP2977 $18.83 US Robotics 56K Internal Fax/Modem V.90 PCI 3CP2977OEM 3CP2977

TREDware 56K Internal Fax/Modem V.92 PCI RJ-11 TFMPCIV92A $16.86 TREDware 56K Internal Fax/Modem V.92 PCI RJ-11 TFMPCIV92A

Dell GigaBit PCI-X Ethernet 10/100/1000 Internal M5531 $27.38 Dell GigaBit PCI-X Ethernet 10/100/1000 Internal M5531

Diamond Multimedia XtremeSound Sound Card - PCI - 16 bit - Internal XS51 $22.26 Diamond Multimedia XtremeSound Sound Card - PCI - 16 bit - Internal XS51

Avid Audiophile 192 Sound Card - PCI - 24 bit - Internal 99005076800 $90.17 Avid Audiophile 192 Sound Card - PCI - 24 bit - Internal 99005076800

M-AUDIO Delta1010LT 2 Cahnnel Internal PCI US41077 $195.93 M-AUDIO Delta1010LT 2 Cahnnel Internal PCI US41077

Sabrent SBT-SP6C 5.1 Channels Sound Card - CMI8738 - PCI - Internal SBTSP6C $21.2 Sabrent SBT-SP6C 5.1 Channels Sound Card - CMI8738 - PCI - Internal SBTSP6C

Emulex LightPulse LPe1150 PCI-Express Network Internal Adapter LPe1150-F4 $832.51 Emulex LightPulse LPe1150 PCI-Express Network Internal Adapter LPe1150-F4

3ware Internal PCI-E SATA II RAID 2-Ports 9650SE2LPKIT $244.93 3ware Internal PCI-E SATA II RAID 2-Ports 9650SE2LPKIT

3ware Internal PCI-X SATA II RAID Controller 8-Ports 9650SE8LPMLKIT $614.65 3ware Internal PCI-X SATA II RAID Controller 8-Ports 9650SE8LPMLKIT

StarTech.com PCI Express - 1 x ST Network - 1000Base-SX - Internal PEX1000MMST $164.58 StarTech.com PCI Express - 1 x ST Network - 1000Base-SX - Internal PEX1000MMST

Allied Telesyn PCI - 1 x LC - 1000Base-SX - Internal AT2916SXLC901 $176.53 Allied Telesyn PCI - 1 x LC - 1000Base-SX - Internal AT2916SXLC901

HP AJ878B 320 GB Internal Solid State Drive - PCI Express $11181.91 HP AJ878B 320 GB Internal Solid State Drive - PCI Express

This entry was posted on Friday, October 12th, 2007 at 7:01 am and is filed under Uncategorized. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.