Do You Need to Perform a Pen Test from Inside the CDE for PCI?

But what about Pen Testing from inside the CDE? Is that required?

PCI 3.x has no requirement to Pen Test from within the CDE. This is a common misunderstanding, propagated by a long-standing lack of guidance. With the March 2015 Information Supplement: Penetration Testing Guidance, we were finally able to address this directly: 

Scope

"It is not a requirement to test from within the CDE to the servers inside the CDE; and testing exclusively from within the CDE perimeter will not satisfy the requirement. However, when access to the CDE is obtained as a result of the testing, the penetration tester may elect to continue exploring inside the network and further the attack against other systems within the CDE, and may also include testing any data-exfiltration prevention (data-loss prevention) controls that are in place."

This is not a requirement and should only be done with care. When we have compromised the CDE of a organization, we will examine data-exfiltration controls and egress rules any time it is safe to do so. 

Hopefully this information can clear up any misconceptions about scanning and scope and what’s required for the latest version of the Standard.

Do you need to do an internal pen test when the CDE is in the Cloud?

Client: 
We have a Cloud based, virtual data center that we access and manage using a 2-factor, on-demand VPN to a remote jump-box from anywhere in the world. As a result, our corporate network and admin machines are considered out-of-scope for PCI. Do we still need to do an internal penetration test?


Answer: 
Our experience is that these tests are limited and quick, however they must be done.  While it’s true that in this case the in-scope systems could just as easily be administered from a Starbucks, the administrator’s workstation in a Starbucks cannot easily be compromised by exploiting other systems in the coffee shop, whereas in the corporate network the administrator's system is often joined to a domain and can be affected by other systems in the domain. The environment where users routinely access in scope systems will present an attacker with a unique opportunity to steal those credentials or manipulate that traffic.  Such an opportunity would not be afforded to an attacker in a Starbucks. The interrelationship of systems inside the corporate network creates a unique set a threat vectors that must be tested.


So for PCI Pen Testing, a corporate network is defined as having a common network connect AND localized common resources such as file shares and authentication mechanisms.