Designing and Implementing a Honeypot for a SCADA Network

PCI DSS Requirement 11.3 obligates organizations that process, store, or transport credit card data to implement a methodology for web application penetration testing. This is a recurring commitmentónot once and done. This testing must be performed when there is significant change and at least yearly. Merchants as well as payment processors, financial institutions and service providers share this responsibility. This paper proposes a credible method to perform testing to achieve and sustain PCI DSS Requirement 11.3 compliance for web applications.