PCI-DSS Penetration Testing
PCI-DSS Penetration Testing for performed for merchants of all PCI-DSS levels by our OSCP qualified penetration testers. Hedgehog Cyber delivers leading edge infrastructure penetration testing for service providers as well for the clients that use these services as a core part of our penetration testing offerings.
We have been performing PCI-DSS penetration testing since our very first days. Thats 10 years of testing experience across all of the levels of merchants. PCI-DSS penetration testing combines many different facets of testing. The key benefits of using Hedgehog for your PCI-DSS penetration test is our combined experience. increased technical assurance, and better understanding of the attack surface that your systems are exposed to. PCI-DSS environments can be tricky to test. Whether they are a physical or virtual platforms, they are prone to security misconfigurations, weaknesses, and security threats. Hedgehog can help rapidly test these and prove your compliance.
We start every engagement the weekend before the technical kickoff date by running an in-depth intelligence gathering exercise (often called OSINT). When we arrive on site, we will conduct extensive reconnaissance of your Cardholder Data Environment (CDE) as well as your connected administrative and user networks. We will assess the security of your Wireless where it is possible to connect from the wireless to one of your CDE connected networks.
Proving segmentation is in important part of every PCI-DSS penetration test, especially where segmentation has been used to reduce the scope of PCI in your business. We test segmentation from the CDE to all your networks and then conversely from all connected networks and non-connected networks to your CDE. This was you have definative proof of segmentation.
Get a Quote
Use our online quote generation service to design and build your perfect penetration test and receive a formal quote within hours, not days.
Although cloud providers offer increasingly robust security controls, it is you who is ultimately responsible for securing your company’s workloads in the cloud. According to the 2019 Cloud Security Report, the top cloud security challenges highlighted are about data loss and data privacy. This is followed by compliance concerns, tied with concerns about accidental exposure of credentials.
By conducting Cloud Penetration Testing, you are combining a mixture of external and internal penetration testing techniques to examine the external posture of your organisation.
Adding to this a Cloud Configuration Review, which is an assessment of your Cloud configuration against the accepted best practice of industry benchmarks, you get a truly holistic view your cloud deployment.
Examples of vulnerabilities determined by this type of active hybrid testing can include unprotected storage blobs and S3 buckets, servers with management ports open to the internet and poor egress controls.
Areas we specifically look at that are not usually covered in standard penetration tests are:
- Enumeration of external attack surface – Identify all possible entry points into the environment – O365, Web Applications, Storage Blobs, S3 Buckets, SQL/RDS Databases, Azure Automation APIs, AWS APIs, Remote Desktops, VPNs, etc.
- Authentication and Authorisation Testing – Ensure the users within the environment operate on a Principle of Least Privilege, are protected by robust multi factor authentication policies, as well as ensuring that known ‘bad passwords’ are prohibited from being used.
- Virtual Machines / EC2 – Azure supports two types of virtual machines – Classic and v2. Testing will ensure that these virtual machines are protected via Network Security Groups (NSGs – analogous to firewalls) and their data is encrypted at rest. Where possible, audits of missing patches and their effects are included. Where virtual machines are publicly accessible, this will lead on to the examination of their external interfaces.
- Storage and Databases – This area of testing will examine storage blob permissions and those of subfolders, ensuring that only authenticated and authorised users can access the data within. Examination of databases (either on virtual machines running SQL Server, or running via Azure SQL) for security best practices is also covered.
Threats for 2020
Our team consists of OSCP and CREST CRT certified experts. Our experienced consultants frequently publish research on all aspects of Penetration Testing.