[Autogenerated] Now we come to what I think is the most
important assurance activity required by PC IDE CSS,
which is ___________.
Testing on this is the subject of requirement 11.3,
and the first requirement 11.3 is to have developed a methodology for
___________ testing before you start to do any testing.
And a reason for this requirement is that in many data breaches,
when the forensic investigators looked at the ___________
test that happened before the breach,
they found they were totally inadequate and really poorly scoped.
It was almost as if the organization didn't want the
___________ testers to find any vulnerabilities in the
organization that they sort of knew existed.
So it was almost like, Well, don't look over here.
Just look over there.
So the idea of the methodology is that when the use A
comes to do the annual assessment,
they can look at the methodology and how the ___________ test was scoped out
and then actually compare this the actual test results.
It's gonna be really honest.
There was also some not very good ___________ testing
companies that basically just did a vulnerability scan
and called the ___________ test.
So this requirement was added to make sure that the organization buying the
test can properly see what they're getting before they buy the test and know
what they're going to have as a result of it.
And if you look at the full standard,
you'll see the requirements of what needs to be in the
___________ destined methodology quite detailed.
There are eight items specified on the QC is gonna
look at the methodology used now.
This could be part of a set of your own policies and
procedures for the cardholder data environment.
Or it could be a ___________ testing methodology produced
in advance of each pen test separately,
because often the ___________ testing company will just
provide you with the methodology and saying,
This is what I'm going to do now.
Just as with vulnerability scans There are two types of ___________.
Test required.
An internal ___________ test on an external ___________ test.
On it is these external test that is the subject of requirement 11.3 point one,
which must at a minimum,
be performed annually and also after one of those significant
changes that could affect the security of the externally
facing part of the organization.
So the QoS is going to review the annual ___________ test report.
They're also gonna look at change control again to see
there any significant changes and if so,
they want to the ___________ test report.
Associating with that change a really good QoS A will want to validate
that the ___________ test for the methodology on an exceptional QoS A
will also match the scope of the ___________ test to their understanding
of the scope of the external elements.
Of the 500 requirement, 11.3 point two is almost identical to 11.3 point one,
except this time is concerned with the ___________ tests
performed inside the CD and again,
the requirement is that the test is carried out annually on After a
significant change and just as within external pen test,
the QoS is going to check the methodology and then check the internal pen
test report now having a ___________ test on its own.
Whether that's an internal test or an external test is only half the
story because of a test fires vulnerabilities,
they need to be addressed,
which is what required 11.3 point three is all about Ondas far as.
The standard is concerned.
This means that two things need to happen.
Firstly, the vulnerabilities found need to be rectified.
And secondly,
the part of the ___________ test that exposed the vulnerability needs to be
repeated to validate that the vulnerability was properly fixed.
So the QoS A will look at the initial pen test and then the follow
up pen test to validate this requirement was met.
A good QoS is going to also look at the change control system to
see that the change in release was followed.
That's required 6.4 at the same time.
Now we're almost at the end of ___________ testing.
But there's one more very important requirement that was
added in version 3.2 of PC IDE CSS as a result of some pretty
big breaches of cardholder data,
and it relates to using ___________ testing to validate segmentation controls.
So requirement 11.3 point four applies if you segmented your
network into the cardholder data environment,
where the PC IDE CSS supplies and then other networks,
other other networks that error your corporate networks that
you've isolated with technical control,
so they're not connected to the cardholder data environment,
and you've stated that they are not in scope of the PC IDE CSS requirements.
The requirement is that any technical segmentation is ___________
tested to simulate what an attacker would do if the attack had
compromised the out of Scope Network,
who was now trying to escalate their attack from the out of Scope
Network into the cardholder data environment.
To validate this requirements being fulfilled,
the QoS is,
firstly going to go right back to the network diagram to determine
what segmentation control should be in place.
They're also gonna look at the configuration and
operation of those segmentation controls.
Next,
the QoS is going to examine the ___________ testing methodology to see
how it proposed to test those segmentation controls.
And then finally,
the QoS is going to review the parts of the ___________ tests
that focused on the segmentation controls.
There's actually a further some requirement to 11.3 point four,
which applies just to service providers,
and that is that they must undertake the segmentation
___________ testing every six months, not just once a year.
Um,
on The reason for this is that there have been lots of data compromises
where the attacker started off in the out scope network on,
then escalated their way into the in scope network and stole the cardholder data