The process for scoping internal PCI pen tests

I wanted to lay out the typical process that I go through when meeting with a client who needs a penetration test for PCI compliance.  I think this will be helpful for those of you involved in these types of engagements.

  1. You have a meeting with the client who needs a pen test for PCI
  2. You quickly realize that your client does not know that a clarification was issued that states that pen testing is defined as INTERNAL and EXTERNAL, not just external
  3. When you mention this clarification, they look at you like you've lost your mind
  4. Then they look incredulous
  5. Then they question your sanity
  6. Then they think you are trying to rip them off
  7. Then you produce the clarification document (this is a 11.3 supplement document – have this with you AT ALL TIMES)
  8. Then they look incredulous again
  9. Then they start thinking about how this is going to cost them more money
  10. Then their ears start smoking
  11. Then their eyes start bleeding
  12. Then they rant and rave at PCI and how it is not fair
  13. Then they come full circle and start breathing normally again because they think it can’t be too bad because they have credit card data on only two servers
  14. Then you ask them if they have segmented off their internal credit card environment
  15. They say no (almost always) and you resist the urge to shake your head and laugh
  16. Then you state that they will need to perform an assessment of their entire environment
  17. Then symptoms from numbers 10 and 11 return
  18. Then you finally get the information you need from them and scope the engagement
  19. They get the SOW and start crying
  20. Then they become incredulous… AGAIN
  21. Then they say there is no way they can pay for this
  22. You tell them they would not have to pay this much if they segment off their CC environment
  23. They talk to their QSA, who gives them a different scope
  24. Confusion and cursing ensue
  25. You scope again and you put down in writing that you don't accept responsibility if they don't pass an audit because the scope of the penetration test was not correct
  26. The client gets nervous and goes back to the QSA
  27. The client is informed that their auditor has left the company and they are assigned a new auditor
  28. Their new auditor redefines the scope

100.  Skipping to the end… the client commits suicide…

And the process begins again with the poor bastard who gets promoted.

Related:

Copyright © 2009 IDG Communications, Inc.

  
Shop Tech Products at Amazon