Re: RE: PCI Compliance (Vulnerability Scans)

From: 09sparky@gmail.com
Date: Sun Dec 17 2006 - 16:43:14 EST

('binary' encoding is not supported, stored as-is) Thanks for all the great information (all). I am now wondering though, if you use an automated tool (VA Scanner that claims to be PCI compliant), does that mean whatever it finds and whatever it rates it (i.e. HIGH), is the final word, and the company fails? I guess what I am asking, I was under the impression that PCI scans could be much automated and very little to no user intervention was required (unlike a Vulnerability Assessment/Penetration test). However, many automated tools have false positives. Doesn't a company fail if they have any "HIGH" findings? With that said, are you required to go through each finding and validate? If so, then you have just turned it into a Vulnerability Assessment.

Also, The Automated Tool I have been evaluating claims to be PCI compliant. However, for its discovery phase, it only uses ports 22,23,25,80 and 445. Upon finding any Host with these ports open, it will then run a common port scan. Is this way off? What do most of you do for host discovery (i.e. nmap scans of what ports? or different tools?

Any thoughts?
Thanks,
Sparky

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------

This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:57:28 EDT