[Autogenerated] testing segmentation is a new requirement.
Is APIs added to the pen testing?
So if you're using segmentation to isolate your cart,
all the data environment from, say, your corporate network,
you have to test that isolation by pen testing IT.
So I find I find a lot of problems with this.
If I don't get in front of that and intervene right with the client,
I find a lot of organizations just essentially running like port
scans from some arbitrary point to some other arbitrary point and
finding no ports open and saying, Yeah, segmentation,
right, we're done.
And and maybe that's part of it.
Yeah, sure.
But you know, the scoping guidance document talks about more than just,
uh, network A C l's right being part of your segmentation controls,
right?
You're the remote access gateways is part of that.
Uh, you know, maybe some I t shirt services error part of that.
And I think, uh, you know, very particularly again in the methodology.
Uh, you know,
you want to have some point where you engage with the assessor and you
engage with the pen tester and you work out together.
What are the segmentation scenarios that error worth testing, right?
We talked about this way back in requirement one, right?
Like maybe the the administrator laptop with a personal firewall
software on it or whatever controls on it,
Right?
Maybe you want to test from that vantage if I'm the bad guy and I'm
adjacent to that administrator laptop in the corporate domain,
can I suborn or impersonate that workstation?
Or go to the remote access gateway and pretend to be that
administrative work station and get through right,
So So So in this one, I actually agree with you.
It's It's almost essential for someone who really understands
the network and have the segmentation set up to work with the
pen testers to work out to test it.
And it's very likely that the pen tester just doesn't have
that familiarity with the environment, right?
And they're going to say, you know, this is what you told us to do,
and we did it right now.
I was on the council when this requirement was drafted and put there.
It's there for a really good reason,
because this was a source of masses of compromises that people would
actually get into the corporate network and then escalate themselves
across to the cardholder days for environment because the
segmentation was segmentation was lousy,
and they just believed it was in place or someone to tweak the
segmentation after being put in place on.
You don't see it with the firewall.
Real check.
You actually want a proper pen test and you'll notice if your
service provider you're doing this every six months,
not every 12 months.
Because this what I weigh in to lots of service
providers and it probably still is right.
It probably It probably still is because I think a lot of assessors
don't have sort of the wherewithal for whatever reason,
to really sort of hold people to this.
And a lot of pen testers, you know,
are running and map scans because that's what they know how to do.
I mean, absence, um,
more guidance or direction from the client about what to test,
right?
I mean, if you go to them and say, Hey,
I want you to test this remote access gateway.
Can you get around?
You know this mechanism, Can you suborn it?
Can you defeat the multi factor authentication?
They know how to do that right or that should,
uh,
but you have to sort of point them in the right direction because
they're not going to know the environment as well.
Yeah.
I mean, this has to be white box testing, not black box testing.
It's not like there's a port CDs over there.
Off you go.
It has to be.
Here's our segmentation.
Here's what the network looks like.
You know, pretend you're a criminal.
You've got You've found all that access.
Found what the systems are now see if you can get through and defeat.
It has to be completely white.
Box e.
I think it's come up with the specific scenario.
Right?
Uh, you know, and and work together collaboratively.
I want the pen testers input on what I think the scenarios are.
I want the clients input on what I think the scenarios are.
You know, personally,
I can't emphasize hard enough how this is nothing to do with compliance.
This is getting someone to check that your stuff is working, right?
Yeah.
And you learn things on a pan test that you learn in no other
way other than by having a good pen test.
Well, this this is verifying you know requirement zero, right?
Like, is your scope appropriate?
You're absolutely right.
And if this fails, right then,
you know the scope is problematic before you need to go fix your segmentation.
But if if this fails,
it means you've learned it from somebody you brought in to tell you it's failed.
Not because the car brands error ringing up because
you're a common point of purchase,
right on their detected that you've been taken by the criminals.
IT great is anything else we should talk about on pan testing.
Um, I think we're pretty wrapped up.
I think Way did.
This is a whole separate module because,
you know, personally and having seen data compromise reports for many years,
this is the one thing that people do really badly.
They buy bad pen tests from pen testing companies on.
They basically say, you know, we want to pass.
It's like the passing pan test is the worst pan test ever.
A pen test that finds nothing is just an absolute waste of money.
All you've learned is you spent some money to find nothing.
The best pen test finds lots of things for you to go
away and fix on to talk about.
And if it's your segmentation where someone's broken,
it's like, Okay, we need to restructure our network.
So?
So Pan testing is probably one of the most important
requirements in PC IDE s s for security,
not just compliance.