Re: RE: PCI Compliance (Vulnerability Scans)

[09sparky () gmail com]

Thanks for all the great information (all).  I am now wondering though, if you use an automated tool (VA Scanner that 
claims to be PCI compliant), does that mean whatever it finds and whatever it rates it (i.e. HIGH), is the final word, 
and the company fails? I guess what I am asking, I was under the impression that PCI scans could be much automated and 
very little to no user intervention was required (unlike a Vulnerability Assessment/Penetration test).  However, many 
automated tools have false positives.  Doesn't a company fail if they have any "HIGH" findings? With that said, are you 
required to go through each finding and validate?  If so, then you have just turned it into a Vulnerability Assessment. 
 

Also, The Automated Tool I have been evaluating claims to be PCI compliant.  However, for its discovery phase, it only 
uses ports 22,23,25,80 and 445.  Upon finding any Host with these ports open, it will then run a common port scan.  Is 
this way off?  What do most of you do for host discovery (i.e. nmap scans of what ports? or different tools?

Any thoughts?
Thanks,
Sparky

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------