RE: PCI DSS Compliance

["Lyal Collins" <lyal.collins () key2it com au>]

If you read the PCI scanning requirements, any IPS/IDP solution MUST be
disabled at least for the IP address conducting the vulnerability scan, for
the duration of the test.
See the documentation on scanning on sdp.mastercardintl.com, page 2-2 of
"Security Scanning
Requirements for Vendors."

However, if it's a firewall that's actively blocking/locking out the port
scanning IP, then maybe the port scan can be conducted slower to get under
the threshold, or a firewall rule adjustment performed for the duration of
the test period.

PCI requires a accurate vulnerability scan. Any PCI accredited scanner
provider would imho, be within their obligated rights to not issue a
'compliant' report in the event they can't perform a meaningful
vulnerability test.

Ultimately, I think its up to your client, the scanning company and youur
firm to negotiate a way for a meaningful vulnerability scan to be conducted.

Of course, it may be that the message they provided is boilerplate, and not
accurately reporting the situation they see.

My 2cents

Lyal



-----Original Message-----
From: Ademar Gonzalez [mailto:ademar.gonzalez () gmail com] 
Sent: Wednesday, 14 December 2005 3:37 AM
To: webappsec () securityfocus com
Subject: PCI DSS Compliance


A shared hosting client needs to get his site PCI DSS certified. He
forwarded us the following request from the company doing the assessment.

"Your site could not be certified. Your site appears to be running scan
detection software, that has prevented a reliable port scan. This test is
inconclusive. Please add our scanner ip: ##.##.##.## to your scan detection
software exclusion list to allow our scanner to make a complete assessment
of your system."

Is this request plain stupid or what ? Comments ?

I have deal with this kind of requests in the past and most of the time the
people running this automated scans knows nothing at all about security nor
anything else and it becomes a pain dealing with the client on one end that
wants his website certified and the other guy on the security company that
wants you to open your firewall so hi can run his nmap or whatever it is
they run. It looks like the client runs the risk of not being certified
'cause his website is over-protected. How would you proceed in this
situation ?


ciao ciao
ademar