Security Testing
Security Testing
Testing written for the person who has to defend it in an assessment.
Who comes to us for this
Organisations whose last testing report did not survive the assessment: no source networks named, no methodology, no re-test, a scan presented as a test. Teams preparing a first Report on Compliance who want the internal network-layer test done before the segmentation test, because that is where the findings that matter are. And clients of our assessments who would rather the test be scoped by the person who will read it.
What we do
Scope it against the requirements.
The perimeter as the scope document defines it, the critical systems inside, every segmentation control, every out-of-scope network as a source, the applications that touch card data. The tester receives the scope document and the segmentation diagram, and is told the report will be read by a QSA.
Execute it with the right people.
Where we do not perform the testing ourselves, it is executed by specialist testing partners we have worked with, under our scope and our review. You always know who is doing what, and the independence the standard requires is documented.
Read it as the assessor.
The report comes to us first. We check it the way an assessment will: scope stated and matching, methodology named, dates in the period, source networks listed, exploitable findings with severity, a re-test for each. If something is missing, it is fixed before you see it.
Explain the findings.
Every finding comes with what it means for your environment and what closes it, because a finding is never just a line in a report. We came to assessment from running security, and it shows here.
What you do
Provide the scope document and the diagrams before the test, not after. Fix what is exploitable, and let us re-test. Keep both reports.
What you receive
A test report an assessor can use as evidence without a conversation: scope, methodology, sources, dates, findings, re-test. A short note from us on what the findings mean and in what order to fix them.
What we will not do
- Present a vulnerability scan as a penetration test.
- Test from one jumpbox and call it segmentation.
- Imply an in-house testing team where the work is done with partners.
- Issue a report we would not accept as the assessor.
Keep reading
Related knowledge
Security Testing3 min read
Penetration testing and PCI DSS: what the standard actually asks
Internal and external, network and application, once a year and after significant change, with exploitable findings fixed and re-tested. How it differs from the quarterly scan, how we scope and deliver it, and how an assessor reads the report.
Security Testing3 min read
Segmentation testing, explained
Segmentation only reduces scope if a test proves it. What PCI DSS asks for, how often, from where, what the report has to say, and the cloud details that most tests miss.
Security Testing4 min read
A segmentation test from one jumpbox is not a segmentation test
Segmentation takes networks out of scope, so the test that proves it carries the whole assessment. Three ways we have seen it fail, and one ending where it was not our call.
Where it starts
Usually alongside an assessment.
When the scope is already defined, testing follows the assessment or the gap assessment. On its own, when your last report did not hold up.
Talk to a QSAOr reach us directly
- +353 1 691 79 38
Dublin
- info@247cyberlabs.com
Read and answered by a QSA, not by a sales desk.