Cardholder Data Environment Analysis and Compromise Assessment
What the domain tests
CDE analysis and compromise assessment: can you find where card data lives and flows, then decide whether an attacker could have accessed it? The exam tests data-flow mapping, PAN discovery, memory analysis, and scope expansion beyond infected hosts.
Core rules
- Map authorization, settlement, batch, chargeback, backup, log, and support flows. Include flat files, databases, POS journals, print spoolers, and memory.
- PAN discovery should combine regex, Luhn validation, and context; validate findings to avoid false positives. Track data in memory is high-risk even if disk is clean.
- Compromise assessment uses IOCs and behaviors: rogue accounts, new services, scheduled tasks, WMI subscriptions, unusual outbound connections, AV gaps, and log clearing.
- Scope by access, not just malware placement. If an attacker reached a jump host or domain controller, every CDE system that trusts it is potentially in scope.
- Build a timeline from host, network, and application logs; correlate in UTC.
Worked example
A POS terminal has a memory scraper. Disk search finds no PAN, but memory contains track 2 data and the process connects to a rare IP over HTTPS. The back-office server shares credentials with the POS, and the firewall permits the POS VLAN to the back office. Assessment: PAN was exposed in memory; the back office and any system reachable with those credentials are in scope; exfiltration is likely and must be tested against proxy and DNS logs.
Traps
No PAN on disk means no compromise; scoping only to terminals with malware; treating every Luhn-valid string as a live PAN; ignoring backups and logs; trusting host clocks without skew analysis.