Tenable PCI Scans

PCI DSS v3.0 Scanning Requirements

Vulnerability scans can be automated or manual, but they should always be performed by qualified individuals who are reasonably independent of the system components being scanned.

PCI Requirement 11.2 – Every 90 days you are required to scan for internal and external vulnerabilities. Also, any time a significant change is made to your environment, you must perform a scan.

Quartely INTERNAL Vulnerabibility scans via ASV: 

PCI Requirement 11.2.2 is very similar in nature to PCI Requirement 11.2.1, but PCI Requirement 11.2.2 requires that you perform external vulnerability scans. Where PCI Requirement 11.2.1 allowed an internal qualified resource to perform that activity, PCI Requirement 11.2.2 is a little different there: you must use an ASV to perform that activity on your behalf. KirkpatrickPrice would be happy to help you with that service, and we provide that service for many of our clients. There are many other organizations that can do that as well.

Nevertheless, effectively anything with the CVSS sore of 4.0 or higher needs to be addressed within that quarterly timeframe. Understand that a lot of organizations might miss a scan or forget to do it for whatever reason, and then ask us to help them define a compensating control. We’ll talk about compensating controls later, but understand that this is one of those controls that is very difficult to define, especially defining a compensating control for a failure in your program. So, understand that it is different if you identify vulnerabilities versus forgetting to scan—those are really two different conversations. Your assessor in both of these cases, for PCI Requirement 11.2.1 and PCI Requirement 11.2.2, is going to be asking for evidence of your quarterly scan and then any remediation scans that you have done to demonstrate that any vulnerabilities identified have been fixed.

Scans of public-facing web applications and review detected vulnerabilities

Per PCI DSS v3.0 requirement 6.6, merchants are required to perform scans of public-facing web
applications and review detected vulnerabilities. Using the PCI module you can meet the web
application scans requirement. Note that web application scanning is available when this option is
turned on for your subscription. Please contact your Account Manager or our Support Team if you
would like to use this option.

Other related PCI Controls

PCI DSS 3.1
- About 394 Controls
- Six Control Objectives
- 12 Subject Areas

The sub-requirements of Requirement 11 include:

PCI Requirement 11.1 – Identify rogue wireless devices that may have been placed in your environment, at least quarterly. You must keep a list of what is authorized so you can define what isn’t authorized. Physical inspection is the best way to meet this objective.

PCI Requirement 11.2 – Every 90 days you are required to scan for internal and external vulnerabilities. Also, any time a significant change is made to your environment, you must perform a scan.

PCI Requirement 11.3 – You must perform a penetration test at least annually and after any time a significant change is made. It must be performed by a qualified individual, cover internal and external, cover the application and network layers, validate if the segmentation is effective, and keep the results of the test and remediation for your audit.

PCI Requirement 11.4 – Install an IPS ISD at the perimeter and at critical locations within the CDE. It needs to be configured and maintained according to the manufacturer standards. It can also be host-based IPS IDS.

PCI Requirement 11.5 – Install a File Integrity Monitoring (FIM) Solution, which needs to monitor critical files and needs to run analysis at least weekly and follow-up on any expectations.

Tenable Vulnerability Management Portal PCI Scan

• General Settings:Avoid potential false alarms
• Disable CGI scanning
• Web Applications:
• Disable web application scanning

• General Settings:Avoid potential false alarms
• Enable CGI scanning
• Perform thorough tests
• Web Applications:Start crawling from "/"
• Crawl 1000 pages (max)
• Traverse 6 directories (max)
• Test for known vulnerabilities in commonly used web applications
• Perform each generic web app test for 10 minutes (max)
• Try all HTTP methods
• Attempt HTTP Parameter Pollution

Report

Cloud Scanner IP Address Segments

Reference