1. Compliance & Security Testing — Tổng quan
Why Compliance Matters for Pentest:
Business Need → Compliance Requirement → Security Testing
Accept payments → PCI DSS v4.0 → Annual pentest
SaaS for enterprise→ SOC 2 Type II → Continuous testing
Global operations → ISO 27001:2022 → Risk-based testing
Healthcare data → HIPAA → Security assessment
EU data processing → GDPR → DPIA + testing
Vietnam data → NĐ 13/2023 → Data protection audit
Compliance ≠ Security:
├── Compliance = minimum baseline
├── Security = comprehensive protection
└── Best: Use compliance as foundation, go beyond
Pentest Role in Compliance:
├── Validate controls are working
├── Identify gaps before auditors find them
├── Provide evidence for audit reports
└── Meet specific testing requirements
2. PCI DSS v4.0
PCI DSS v4.0 — Key Changes (effective March 2025):
New Requirements:
├── Targeted risk analysis for each requirement
├── Customized approach (alternative to defined)
├── Multi-factor authentication for ALL access to CDE
├── Automated log review mechanisms
├── Internal vulnerability scans via authenticated scanning
└── Script management (e-skimming protection)
Pentest Requirements (Req 11.4):
├── 11.4.1: Pentest methodology defined
│ ├── Industry-accepted (PTES, OWASP, NIST)
│ ├── Coverage of entire CDE perimeter
│ └── Testing from inside and outside
├── 11.4.2: Internal pentest at least annually
├── 11.4.3: External pentest at least annually
├── 11.4.4: Correct exploitable vulnerabilities
├── 11.4.5: Network segmentation testing every 6 months
└── 11.4.6: Service provider — test segmentation every 6 months
Additional Testing Requirements:
├── 6.2: Custom software — secure development
├── 6.3: Vulnerability management program
├── 6.4: Web application security (WAF + testing)
├── 11.3: Vulnerability scanning (internal + external)
└── 11.5: Network intrusion detection
PCI DSS Pentest Scope:
Cardholder Data Environment (CDE):
├── Systems that store, process, or transmit card data
├── Systems connected to CDE
└── Segmentation controls
Testing Must Include:
├── Network layer: Firewall rules, segmentation
├── Application layer: OWASP Top 10
├── Segmentation: Verify isolation of CDE
├── Social engineering (recommended, not required)
└── Wireless scanning
Report Requirements:
├── Methodology used
├── Scope of assessment
├── Timeline of testing
├── Findings with severity
├── Remediation verification
└── QSA/assessor credentials
3. SOC 2 Type II
SOC 2 Trust Service Criteria:
Security (Required):
├── Access control
├── Network security
├── Change management
├── Risk assessment
└── Incident response
Availability (Optional):
├── Performance monitoring
├── Disaster recovery
├── Backup procedures
└── Business continuity
Processing Integrity (Optional):
├── Data quality
├── Data processing
└── Error handling
Confidentiality (Optional):
├── Data classification
├── Encryption
└── Data retention
Privacy (Optional):
├── Notice and consent
├── Data collection
└── Data usage
SOC 2 Type I vs Type II:
Type I: Design of controls at a point in time
Type II: Operating effectiveness over 6-12 months
Pentest Role in SOC 2:
├── CC6.1: Logical access security
├── CC6.6: Security software/infrastructure
├── CC7.1: Detection of security events
├── CC7.2: Monitoring for anomalies
└── CC8.1: Change management validation
SOC 2 Evidence from Pentest:
What auditors need:
├── Pentest report with findings
├── Remediation evidence
├── Vulnerability scan results
├── Retesting after remediation
└── Continuous monitoring evidence
Common SOC 2 Control Failures (from pentest):
├── Default credentials on internal systems
├── Unencrypted data in transit
├── Missing MFA on critical systems
├── Insufficient logging
├── Overly permissive cloud IAM
└── Unpatched systems
4. ISO 27001:2022
ISO 27001:2022 — Annex A Controls (93 controls):
Organizational (37): A.5.1 — A.5.37
People (8): A.6.1 — A.6.8
Physical (14): A.7.1 — A.7.14
Technological (34): A.8.1 — A.8.34
Key Controls for Pentest:
A.5.36: Compliance with policies and standards
A.8.8: Management of technical vulnerabilities
A.8.9: Configuration management
A.8.12: Data leakage prevention
A.8.16: Monitoring activities
A.8.25: Secure development lifecycle
A.8.28: Secure coding
A.8.29: Security testing in development
A.8.34: Protection of information systems during audit testing
New in 2022:
├── A.5.7: Threat intelligence
├── A.5.23: Information security for cloud services
├── A.5.30: ICT readiness for business continuity
├── A.8.11: Data masking
├── A.8.12: Data leakage prevention
├── A.8.16: Monitoring activities
├── A.8.23: Web filtering
└── A.8.28: Secure coding
ISMS + Pentest Integration:
1. Risk Assessment → Identify assets and threats
2. Pentest → Validate controls against threats
3. Findings → Input to risk treatment plan
4. Remediation → Update controls
5. Audit → Present pentest as evidence of A.8.8
5. Mapping Pentest Findings to Compliance
Finding-to-Compliance Mapping:
Finding: Missing MFA on admin panel
├── PCI DSS: 8.4.2 (MFA for CDE access)
├── SOC 2: CC6.1 (Logical access)
├── ISO 27001: A.8.5 (Secure authentication)
└── NIST: IA-2 (Identification & Authentication)
Finding: Unencrypted PII in database
├── PCI DSS: 3.5.1 (Protect stored data)
├── SOC 2: CC6.7 (Encryption)
├── ISO 27001: A.8.24 (Use of cryptography)
├── GDPR: Art.32 (Security of processing)
└── NĐ 13/2023: Điều 26 (Bảo vệ dữ liệu)
Finding: SQL Injection in payment form
├── PCI DSS: 6.2.4 (Injection attacks)
├── SOC 2: CC6.6 (System security)
├── ISO 27001: A.8.28 (Secure coding)
└── OWASP: A03:2021 (Injection)
Pentest Report Enhancement:
For each finding, include:
├── Technical description
├── Business impact
├── Compliance mapping
├── Remediation steps
└── Verification criteria
6. Continuous Compliance
From Annual Pentest → Continuous Security Validation:
Traditional:
├── Annual pentest (2 weeks)
├── Quarterly vulnerability scan
└── Compliance audit (3-6 months cycle)
Problem: 11 months of unknown security posture
Modern (2026):
├── Continuous DAST in CI/CD (ZAP, Burp Enterprise)
├── Weekly automated scans (Nuclei, Qualys)
├── Monthly purple team exercises (Atomic RT)
├── Quarterly comprehensive pentest
├── Continuous compliance monitoring (Vanta, Drata)
└── Real-time security posture dashboard
Tools for Continuous Compliance:
├── Vanta: Automated SOC 2, ISO 27001, HIPAA
├── Drata: Continuous monitoring + evidence collection
├── Secureframe: Compliance automation platform
├── Prowler: Cloud compliance scanning
└── OpenSCAP: SCAP compliance scanning
7. Tổng kết
- PCI DSS v4.0: Annual pentest required, internal + external, segmentation testing
- SOC 2 Type II: Pentest validates security controls over 6-12 months
- ISO 27001:2022: Risk-based testing, maps to Annex A controls
- Compliance mapping: Link each finding to relevant standards
- Continuous: Move from annual pentest to continuous security validation
Bài tiếp theo sẽ chuyển sang Phần 6 — CVSS v4.0 Scoring.