Application-Layer Penetration Test and PA-DSS

[Justy]

Thanks guys, the replies had been very helpful.

jbhall56, I agree with you on what's said but it's hard convincing the customer. Nonetheless, I will explain to them.

[ThomasJackson]

Jeff,

Re Testing quarterly - correct me if I am wrong but I read the std to say External and Internal Vuln Assessment Quarterly (11.2);

External and Internal Pen Testing once per Annum (11.3);

Was it a mistake in your post that all testing is reqd quarterly.

thanks
tj

Originally Posted by jbhall56

Correct. You need to implement the application per the vendor's implementation guide.

Caveat - some vendor's implementation guides are not necessarily clear as to those steps that are required to maintain PABP/PA-DSS compliance. For that matter, they may not even have steps identified for maintaining compliance or even provide such instructions. I'm not sure how they got away with this since it has always been a requirement, but some have. So, just because you have implemented the application per the vendor's instructions, it may not necessarily be compliant.

Once an application is implemented, it needs to be vulnerability and penetration tested PABP/PA-DSS compliance or not. And that testing needs to be conducted at least quarterly, regardless of whether or not the application is external facing or only internal facing.

Vulnerability and penetration testing when the application is not browser-based may seem a waste of time, but it is still required. The reason is that the server the application executes on may have vulnerabilities that could be leveraged to gain access to the application or the application's data stream.

If the application is storing cardholder data, the encryption keys need to be changed annually or if you believe the keys have been compromised.

Jeff,

[jbhall56]

Sorry for the confusion. The sentence ran together implying quarterly for everything..

At a minimum, you need to conduct external and internal vulnerability tests quarterly. If you make any changes, you then need to conduct the vulnerability testing again.

Penetration testing is the same except for the timing. Annual external and internal penetration tests need to be conducted. If you make any changes, the penetration testing needs to be performed again.

Hope that clears things up.