Re: PCI DSS Compliance

[null0 () nepea com au]

The wording of the standard is in section 2-3. It basically states that an 
IPS/IDS is not to interfere with the scan. It does not NOT say that it "MUST 
be disabled at least for the IP address conducting the vulnerability scan". 

It lists a number of options, that can be used in order to prevent the 
IPS/IDS interfering with the scan. 

At the end of the day, is it such a bad thing for the CC companies to be 
laying down an industry benchmark for the safe use of Credit Card processing 
and storage? 

I understand that there may be issues with the state if security at 
companies, but since when has security through obscurity been the 'done 
thing'. 

Personally I would very much like to know about my network, and 
applications, especially if they had issues that could ultimately prevent my 
company doing business with Visa or Mastercard. 

null0 



> -----Original Message-----
> From: Lyal Collins [mailto:lyal.collins () key2it com au] 
> Sent: Thursday, 15 December 2005 9:34 AM
> To: 'Ademar Gonzalez'; webappsec () securityfocus com
> Subject: RE: PCI DSS Compliance 
>
> If you read the PCI scanning requirements, any IPS/IDP solution MUST be
> disabled at least for the IP address conducting the vulnerability scan,
> for
> the duration of the test.
> See the documentation on scanning on sdp.mastercardintl.com, page 2-2 of
> "Security Scanning
> Requirements for Vendors." 
>
> However, if it's a firewall that's actively blocking/locking out the
> port
> scanning IP, then maybe the port scan can be conducted slower to get
> under
> the threshold, or a firewall rule adjustment performed for the duration
> of
> the test period. 
>
> PCI requires a accurate vulnerability scan. Any PCI accredited scanner
> provider would imho, be within their obligated rights to not issue a
> 'compliant' report in the event they can't perform a meaningful
> vulnerability test. 
>
> Ultimately, I think its up to your client, the scanning company and
> youur
> firm to negotiate a way for a meaningful vulnerability scan to be
> conducted. 
>
> Of course, it may be that the message they provided is boilerplate, and
> not
> accurately reporting the situation they see. 
>
> My 2cents 
>
> Lyal 
>
>  
>
> -----Original Message-----
> From: Ademar Gonzalez [mailto:ademar.gonzalez () gmail com] 
> Sent: Wednesday, 14 December 2005 3:37 AM
> To: webappsec () securityfocus com
> Subject: PCI DSS Compliance 
>
>
> A shared hosting client needs to get his site PCI DSS certified. He
> forwarded us the following request from the company doing the
> assessment. 
>
> "Your site could not be certified. Your site appears to be running scan
> detection software, that has prevented a reliable port scan. This test
> is
> inconclusive. Please add our scanner ip: ##.##.##.## to your scan
> detection
> software exclusion list to allow our scanner to make a complete
> assessment
> of your system." 
>
> Is this request plain stupid or what ? Comments ? 
>
> I have deal with this kind of requests in the past and most of the time
> the
> people running this automated scans knows nothing at all about security
> nor
> anything else and it becomes a pain dealing with the client on one end
> that
> wants his website certified and the other guy on the security company
> that
> wants you to open your firewall so hi can run his nmap or whatever it is
> they run. It looks like the client runs the risk of not being certified
> 'cause his website is over-protected. How would you proceed in this
> situation ? 
>
>
> ciao ciao
> ademar 
>
>
> _____________________________________________________________________ 
> This e-mail has been scanned for viruses by MCI's Internet Managed 
> Scanning Services - powered by MessageLabs. For further information 
> visit http://www.mci.com 
>
> **********************************************************************
> This e-mail message and any attachments are intended only for the use of the addressee(s) named above and may contain 
> information that is privileged and confidential. If you are not the intended recipient, any display, dissemination, 
> distribution, or copying is strictly prohibited.   If you believe you have received this e-mail message in error, 
> please immediately notify the sender by replying to this e-mail message or by telephone to (02) 9646 9222. Please 
> delete the email and any attachments and do not retain the email or any attachments in any form.
> **********************************************************************