Educause Security Discussion mailing list archives
Re: Pen Test vendors
From: Mike Lococo <mike.lococo () NYU EDU>
Date: Tue, 13 Jan 2009 17:15:38 -0500
Zach Jansen wrote:
With PCI requiring annual penetration tests of the cardholder environment, is that motivation enough for people to start their own pentest programs? Are .edu's who are subject to PCI outsourcing this or developing internally?
From section 11.2 of the PCI DSS:
Run internal and external network vulnerability scans at least quarterly and after any significant change in the network (such asnew system component installations, changes in network topology, firewall rule modifications, product upgrades). Note: Quarterly external vulnerability scans must be performed by an Approved Scanning Vendor (ASV) qualified by Payment Card Industry SecurityStandards Council (PCI SSC). Scans conducted after network changes may be performed by the company’s internal staff.
So you can't meet the requirement without a quarterly scan by an ASV, but you're *also* supposed to be doing internal scans.
It may be picking nits, but it's also worth noting that PCI requires a vulnerability scan, not a penetration test. Vulnerability scanning typically involves one or more (mostly) automated scan(s) for known vulnerabilities, optionally with manual verification of the results. Penetration testing typically involves attempting to find and exploit unknown vulnerabilities in custom code or to break into a deployment which is believed to have no publicly disclosed vulnerabilities. Folks typically have very different reasons for running vulnerability scans vs pen-tests, the quality of vendor you need is drastically different, and the price is also different by a few zeros.
Thanks, Mike Lococo
Current thread:
- Re: Pen Test vendors, (continued)
- Re: Pen Test vendors Jeff Howlett (Jan 09)
- Re: Pen Test vendors Peterman, Martin (mdp4s) (Jan 09)
- Re: Pen Test vendors Jay Tumas BSEE, NSA IAM/IEM (Jan 09)
- Re: Pen Test vendors Mike Waller (Jan 09)
- Re: Pen Test vendors Dick Jacobson (Jan 10)
- Re: Pen Test vendors Brenda B Gombosky (Jan 11)
- Re: Pen Test vendors Curt Wilson (Jan 12)
- Re: Pen Test vendors Bob Henry (Jan 13)
- Re: Pen Test vendors Zach Jansen (Jan 13)
- Re: Pen Test vendors Mark Houpt (Jan 13)
- Re: Pen Test vendors Mike Lococo (Jan 13)
- Re: Pen Test vendors Sarah Stevens (Jan 13)
- Re: Pen Test vendors Sarah Stevens (Jan 13)
- Re: Pen Test vendors Sarah Stevens (Jan 13)
- Re: Pen Test vendors Felecia Vlahos (Jan 13)
- Re: Pen Test vendors Zach Jansen (Jan 13)
- Re: Pen Test vendors Morrow Long (Jan 13)
- Re: Pen Test vendors Sarah Stevens (Jan 13)
- Re: Pen Test vendors Peterman, Martin (mdp4s) (Jan 14)
- Re: Pen Test vendors Curt Wilson (Jan 15)
- Re: Pen Test vendors Walter E. Petruska (Jan 20)