1

The PCI SCC states the following in their penetration testing guidance:

Per PCI DSS Requirements 11.3.1 and 11.3.2, penetration testing must be performed at least annually and after any significant change—for example, infrastructure or application upgrade or modification—or new system component installations. What is deemed “significant” is highly dependent an entity’s riskassessment process and on the configuration of a given environment. Because of this variability, a significant change is not prescribed by PCI DSS. If the change could impact the security of the network or allow access to cardholder data, it may be considered significant by the entity. Penetration testing of significant changes is performed to ensure that controls assumed to be in place are still working effectively after the upgrade or modification

Therefore it is up to individual organisations to define what constitutes a significant change in their documentation. However, as the penetration test should include security assessments on any in-scope applications present, an organisation may have specified that new features in these applications constitute a significant change.

If that is the case, is it allowable under PCI DSS to only "pen test" the changed applications, or does PCI dictate that the whole infrastructure be retested too, even though these individual servers may not have changed? Yes, in any ecosystem there's the law of unintended consequences, however if it can reasonably be implied that the changes won't affect anything else does testing have to be fully repeated?

Of course if it is allowable, this should be documented as such that this is the line that the organisation is taking. Also, as there is an annual penetration test of everything in-scope, this would cover any new vulnerabilities that may affect the rest of the network.

  • 1
    In practice, I have witnessed QSAs accept a specific limited pentest which only addresses the "significant change" (e.g., new application). But that's not an answer unless I can track down some verbiage that documents that... – gowenfawr Jan 13 '16 at 12:58
  • 1
    This may be one of those many points that the PCI Reqs are so (un)lovable for deliberately leaving ambiguous. The last sentence ("Penetration testing of significant changes is performed...") and the deferential-to-the-entity's judgement stance of this section on the whole certainly implies that pen testing the stuff that's changed --and perhaps other elements that one might reasonably expect to be affected by the changes, as you said--is enough. And I know that in real-world that's a very commonly used approach. But I'm struggling to think of anything official that unambiguously says that. – mostlyinformed Jan 13 '16 at 14:01
  • @gowenfawr: Thanks for the info. Any luck with that? – SilverlightFox Jan 15 '16 at 8:34
1

Short version:

  • PCI documents leave room to support either stance
  • Your QSA's approval or disapproval trumps anything you think the documents say (as always!)
  • In practice, I have seen QSAs accept limited-scope pentests when "significant changes" were limited in scope to the environment

Long version:

On the face of it, the wording of the DSS seems absolute; that a complete pentest is required annually and upon significant change:

11.3 Implement a methodology for penetration testing that includes the following:

...

  • Includes coverage for the entire CDE perimeter and critical systems
  • Includes testing from both inside and outside the network

...

11.3.1 Perform external penetration testing at least annually and after any significant infrastructure or application upgrade or modification...

...

11.3.2 Perform internal penetration testing at least annually and after any significant infrastructure or application upgrade or modification...

However, when "significant change" is talked about, the 2015 Penetration Testing Guidelines are clear that this is an area where judgement is necessary:

What is deemed “significant” is highly dependent an entity’s risk assessment process and on the configuration of a given environment. Because of this variability, a significant change is not prescribed by PCI DSS.

If you go back to the 2008 Penetration Testing Guidelines, the equivalent section seems even more receptive to the argument that not all pentest requirements are equal:

Significance within a highly segmented network where cardholder data is clearly isolated from other data and functions is very different than significance in a flat network where every person and device can potentially access cardholder data. As a security best practice, all upgrades and modifications should be penetration-tested to ensure that controls assumed to be in place are still working effectively after the upgrade or modification.

I think that last sentence can be interpreted to mean that controls not assumed to be impacted by a "significant change" do not need to be retested along with that change.

One of the case studies in the 2015 Penetration Testing Guidelines also supports the idea that the scope of the assessment may vary based upon the judgement of what the subject (and their QSA) consider in scope for the penetration test:

The web applications for Brand A and Brand B will be completely in scope. The web application for Brand C is presumed to be an exact copy, exclusive of product information and look and feel. The tester will sample the web application for Brand C to verify that the applications are the same as Brand B. If it is determined that there are material differences between Brand B and Brand C web applications, Brand C will be brought fully into scope.

And when it comes to retesting vulnerabilities that were identified in the penetration test, the 2015 Guidelines make it clear that some latitude in test surface is expected:

The scope of a retest should consider whether any changes occurring as a result of remediation identified from the test are classified as significant. All changes should be retested; however, whether a complete system retest is necessary will be determined by the risk assessment of those changes.

So, while nothing explicitly says "You can reasonably limit 'significant change' penetration tests", it is in line with statements that recognize the variability of environments and risk profiles. As with many things in the PCI DSS, if you can convince your QSA to agree that it is reasonable, then it is accepted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.