PCI Penetration Testing

Penetration testing is one of the most important duties that your cybersecurity company performs for your business. Penetration testing is the process of performing controlled attacks against your systems through a simulated real-world breach attempt. These tests are performed to test the security controls and defenses your company has in place, and to help you improve your security defense as a whole. One form of penetration test is PCI penetration testing. The goal of this test, the PCI-DSS standard, and the PCI security council as a whole is “to enhance global payment account data by developing standards and supporting services that drive education, awareness, and effective implementation by stakeholders”.

PCI penetration testing is something that is both important and necessary for most businesses to conduct. This is because any business that accepts payments from outside services must meet these PCI, or Payment Card Industry data security standards.

The Goal of PCI Penetration Testing

PCI penetration tests are performed to ensure you meet the strict data standards for companies who handle payment cards. PCI tests are done to maximize your security controls by ensuring you maintain a secure network, have strict and sturdy access requirements in place, and consistently monitor and test your network for vulnerabilities and other possible exploits.

Performing PCI penetration tests will help you meet the PCI-DSS pentesting requirements, and ensure your company is in good standing. This good standing in regard to data security standards will ensure consumers that you are trusted source for their payment information, and that you can be trusted as a seller of a product or service. One misstep with consumer payment information will ensure you lose valuable credibility to your customers. Furthermore, poor care and handling of confidential payment information will drive consumers far away from the product you provide, no matter how valuable it may be.

Why PCI Penetration Testing is Important

For starters, PCI penetration tests are important to meet PCI-DSS requirements. This will ensure you are a trusted, reputable and safe company for business dealings. Consumers trust you with their confidential data, and a betrayal of that trust is a death sentence. Beyond this fact, PCI penetration testing has additional benefits. PCI testing will help your company reveal real-world threats that hackers might use to compromise POS (point of sale) devices, payment software, firewalls, and much more. Once these attack vectors are located, your cybersecurity team can work to fill the holes and bolster your defenses in preparation for a real attack.

Another fact that makes PCI penetration testing important to perform is the ability to see your payment security posture through the eyes of a hacker. Red Team PCI penetration testers often have developmental experience and will be able to use the information from the PCI test to discover where controls will need to be improved and tightened up. Developers often have to balance the need for security controls with the need for smooth operational structure. So, gaining insight on which areas are the most vulnerable will help concentrate your team’s focus to what matters and where you are susceptible to a compromise.

Common PCI Penetration Test Attack Vectors

While we have established what PCI standard are, the goal of PCI penetration testing, and the importance of performing these tests, it’s time to find out how attackers likely will target the payment information your company has saved. Here are three of the most common PCI attack vectors:

-Payment Phishing Attack

One of the most common ways that attackers receive consumer payment information is through phishing scams. These scams involve the widespread sending of emails to consumers of a product while posing as the business itself. These emails include fake invoices, company branding, and messaging that make them difficult to distinguish from a legitimate business email. Many consumers fall victim to this attack by providing the attackers with their payment information before verifying the credibility of the email. To help combat this attack, you should always confirm the authenticity and credibility of an email before opening it.

-Attacking a Partner Company’s Network

Another most common ways that an attacker gets their hands-on consumer payment information is through the compromise of business partner information systems. Many businesses operate on their own, but many rely on partnerships for additional services and applications. If an attacker knows that you’re partnered with a weakly-defensed business, they may attempt to compromise their security defenses. Once compromised, attackers use that partners network as a conduit to access your confidential information. A real-world example of this attack was the Expedia’s Orbitz compromise, which supplied attackers with the payment information of over 880,000 individuals.

-POS (Point of Sale) Device Malware

Point of sale devices are one of the most vulnerable systems on a company network because of their public location. These devices store consumer payment information, and handle hundreds of transactions a day, which also makes them a prime candidate for attack. Hackers perform a POS malware attack by entering the system through a process scanner. This process scanner helps scan and then infiltrate the RAM (random access memory) of a computer to find decrypted payment card data information. This data is then sent as unencrypted information to the attacker. Many POS malware attacks happen every year, and every company with physical store locations needs to ensure employees watch over POS devices at all times.