Security risks associated with payment applications have never been greater or more publicized. The Payment Application Data Security Standard (PA-DSS) and application penetration testing under the broader PCI DSS requirement 11.3 both aim to address application threat vectors, albeit through different tools and mechanisms. In this presentation, we will cover: • An overview of PA-DSS and application penetration testing • The shared elements and compare and contrast some of the more detailed differences • The requirements, where they apply, and how they play a role in securing payment applications

1. PA-DSS vs Penetration Testing | 1
PA-DSS and Application
Penetration Testing
Complementary Tools to Address
Payment Security Risk and Compliance

2. PA-DSS vs Penetration Testing | 2
Setting the Stage
• We are not here to scare you
• PA-DSS and Application Testing work
together for PCI compliance and payment
application security
• As with all payment security, the devil is in
the details!

3. PA-DSS vs Penetration Testing | 3
Comparison of Key Activities
PA-DSS PenTest
Architecture/Design Review
Application Penetration Testing
Forensic Analysis (Lab)
Testing of Production Environment

4. PA-DSS vs Penetration Testing | 4
PA-DSS Overview
• Parallel and subsidiary standard to PCI DSS
• Facilitate and not preclude PCI DSS
compliance
• Test the application’s function
–Usually in our lab
–Sometimes in the software vendor’s lab

5. PA-DSS vs Penetration Testing | 5
PA-DSS Scope and Applicability
•For applications that run in the customer’s
environment
–I.e., not for SaaS products
•Applications that facilitate authorization and
settlement of transactions
•Applies to a specific version of an application

6. PA-DSS vs Penetration Testing | 6
PA-DSS Scope and Applicability
•Not intended for applications developed for
own use
•PCI SSC will not accept most applications on
mobile devices

7. PA-DSS vs Penetration Testing | 7
Process and Documentation
• Software development practices
– Demonstrate competence in software
security
– Application threat modeling
– Developer training

8. PA-DSS vs Penetration Testing | 8
Process and Documentation
• PA-DSS Implementation Guide
– Specific, clear guidance for proper use of
application
– For users and resellers of application
– We submit this to PCI SSC

9. PA-DSS vs Penetration Testing | 9
Testing in a Lab
• Test the payment application as it would be deployed
by a user
– Examine application function and security features
– Error conditions
– Test transactions
• Use forensic tools and methods
• Perform penetration testing in test environment

10. PA-DSS vs Penetration Testing | 10
Forensic Tools and Methods
• Search for cardholder data
• Examine authentication or cryptographic
processes
• Confirm data retention and deletion

11. PA-DSS vs Penetration Testing | 11
Forensic Tools and Methods

12. PA-DSS vs Penetration Testing | 12
Forensic Tools and Methods

13. PA-DSS vs Penetration Testing | 13
Pen Testing for PA-DSS Validation
• Test all web interfaces
– Not just Internet-facing web interfaces
– Test for OWASP/PCI DSS 6.5 vulnerabilities
– Examine the software vendor’s process for
fixing these issues

14. PA-DSS vs Penetration Testing | 14
Broader Application Testing
• Not in a lab -> In production
• Network vs Application
• Type of applications
– COTS and in-house developed
– Web, Thick Client, Mobile and Web Services
– Integrated solutions

15. PA-DSS vs Penetration Testing | 15
App Pen Testing and PCI-DSS
• Primarily addresses requirement 11.3
– External and Internal
– Network and Application
• Results may influence other controls:
– Architecture (1.3 and segmentation)
– System Configuration (2.2)
– Masking PAN (3.3)
– OWASP (6.6)

16. PA-DSS vs Penetration Testing | 16
Tools and Techniques
• Vulnerability scanners
• Man-in-the-Middle (MitM) Proxies
• REST Clients
• Web debuggers
• Browser plugins
• Integrated Development Environments (IDE)

17. PA-DSS vs Penetration Testing | 17
Summary
•Application security has significant attention in the PCI
DSS and industry-wide
•PCI includes a multi-faceted approach including core
requirements and PA-DSS where applicable
•Techniques can overlap but differ in approach and
context
•The goal and mission remain the same, a comprehensive
approach to application security

18. PA-DSS vs Penetration Testing | 18
Learn More: PA-DSS Validation