Penetration Testing
Network Segmentation Validation
We test what traffic actually passes between networks that should be separate. We show whether your cardholder data, production and management networks are isolated as designed.
What it is
Network segmentation testing measures whether the designed separation actually works. From each network segment, connections that should not be allowed are attempted to the others. Results are compared with firewall rules. Segments that must be isolated, such as cardholder data, production and management networks, are prioritized.
Scope
- Separation between the cardholder data environment and out-of-scope networks
- Access between client, server and management networks
- Access from guest, wireless and supplier networks to the internal network
- Transitions between the corporate network and production or OT networks
- Firewall rules compared with test results
The need
When organizations need it
- When segmentation is used to isolate your cardholder data environment. PCI DSS requires this separation to be tested at least every 12 months and after any change.
- After a firewall change, data center migration or addition of a new network segment.
- When an incident or audit reveals an unexpected connection between two networks assumed to be separate.
Method
How we work
-
Zone map
We extract the network segments and allowed traffic between them from your documentation.
-
Test points
We place a test point in each segment or use a system already present in that segment.
-
Access testing
From each segment, we attempt connections to the others and record any unexpected crossings.
-
Rule comparison
We match the results to firewall rules and retest after changes.
Outcome
What you have at the end
You receive an access matrix showing which network segments are truly isolated and which unexpected crossings exist. This matrix can also serve as audit evidence that the separation works.
Frequently asked questions
Is a firewall rule review sufficient?
A rule review shows intent, but a test shows what actually passes through. A forgotten rule, an incorrect network definition or a second connection path is only revealed by testing.
Does the test affect production traffic?
Connection attempts are performed at a low rate and within time windows agreed with you. The only goal is to determine if a connection can be established.
Penetration Testing
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting