How is something like this not picked up in a pen test? Can only assume there never has been..
I've done tests several years on a row where I pop a service using the first years report.
But if you read their reports, it’s all “no, no, no, no way!!!!!!”
A lot of “consultations” are really “inform/get informed, and ignore it all and do what you were going to do all along anyway”.
But you can check the box to say you did your consultations.
In practice, PCI standards compliance is a mess of people selling "point and click compliance solutions," companies being too big to be properly audited, code churn between audits, companies misleading auditors or hiding key data. Security theater is especially pervasive in PCI compliance.
* run scanner
* print out report
not a lot of deep diving
Can you recommend companies that you've personally worked with who employ knowledgeable security engineers (hackers) to perform real penetration tests and conduct valuable security scans resulting in value-add reports your engineering team can work with?
Not looking for naming and shaming...but rather "Who doesn't suck at doing this?".
Trail of Bits is another big name because they hire and retain talent across a large number of enterprise, emerging tech, and research verticals.
Other established firms include Atredis Partners, IOActive, Security Innovation. There are more one could list.
Sometimes these companies work with partners who ask to publicly disclose some artifact resulting from the test. Here is a collection of those reports aggregated by firm: https://github.com/juliocesarfort/public-pentesting-reports (Edit: note this is not a great way to evaluate any particular company, but it does provide an objective listing of companies that exist in the pentesting space).
Each firm will also have variability in their personnel for your project which can yield different results for two independent tests on the same target from the same firm.
I could have done all of this myself and saved the company tens of thousands of dollars but I think management insisted it came from an outside company. It would be nice though to find an actual pen tester from the back alley of DEFCON who you have to pay in crypto or precious metals and have them do some actual hacking. :)