Network and application penetration tests are different from vulnerability scans in that penetration tests are more focused. Rather than providing a laundry list of potential vulnerabilities, the PSC Penetration Tests simulate an attack, using the methods and tools favored by script-kiddies and determined hackers. PSC evaluates the protection of Client information technology assets (people, process and systems), with a special emphasis on the effectiveness of logical access and system software controls. The objectives of these tests are to obtain command and control of the targets systems or extract the sensitive data they are intended to protect. PSC evaluates the protection of Client information technology assets (i.e., data, systems, and processes), with a special emphasis on the effectiveness of logical access and system software controls as they relate to PCI DSS. PSC tests to determine that:
- Unauthorized access to cardholder data can not be achieved
- Unauthorized access to source code can not be achieved
- Guests cannot obtain unauthorized access to the corporate network
- No cardholder data exists on any system outside of the cardholder environment
While performing all tests, it is PSC's goal to go beyond PCI and provide value to the Client's security initiatives by identifying opportunities to increase due diligence in areas such as brand integrity, physical security, intellectual property and fraud.
It is important to note, that the only procedures required for compliance with PCI 11.3 are the application layer and network layer assessments.