.

Approved Scanning Vendor - PCI

<<

24772433

User avatar

Newbie
Newbie

Posts: 34

Joined: Thu Oct 20, 2011 3:22 pm

Location: UK

Post Sun Jan 13, 2013 1:16 pm

Approved Scanning Vendor - PCI

Is it possible for an individual to perform a PCI scan or does that person have to be a member of an approved company (ASV)? Can somebody qualified to conduct PCI scans do this on a freelance basis?

Thanks in advance!
<<

Triban

User avatar

Hero Member
Hero Member

Posts: 620

Joined: Fri Feb 19, 2010 4:17 pm

Post Sun Jan 13, 2013 9:42 pm

Re: Approved Scanning Vendor - PCI

Check their site out for answers: https://www.pcisecuritystandards.org/ap ... me_qsa.php

Based on the language there, I'd say you would need to be an employee of a vetted QSA firm.
Certs: GCWN
(@)Dewser
<<

ziggy_567

User avatar

Sr. Member
Sr. Member

Posts: 378

Joined: Tue Dec 30, 2008 1:53 pm

Post Mon Jan 14, 2013 11:20 am

Re: Approved Scanning Vendor - PCI

External scan reports must be generated through an ASV company. An important distinction is that the person running the scan does not have to be an employee of the ASV company. You can manage your own scans through the ASV's portal. The report will contain a page that has the ASV number associated with the company that performed the scan. If you're ever audited or have to submit your report to your acquiring bank, the auditor/bank will be looking for that number on the report. Basically, you cannot scan your own perimeter with your own copy of Nessus, generate a report, and say you're compliant. It must be done by an ASV company.

Internal scan reports can be done by anyone knowledgeable in Vulnerability Scanning/Management. It should not be managed by a person responsible for maintaining the systems being scanned, though (separation of duties).

Hope that helps.
Last edited by ziggy_567 on Mon Jan 14, 2013 11:52 am, edited 1 time in total.
--
Ziggy


eCPPT - GSEC - GCIH - GWAPT - GCUX - RHCE - SCSecA - Security+ - Network+
<<

24772433

User avatar

Newbie
Newbie

Posts: 34

Joined: Thu Oct 20, 2011 3:22 pm

Location: UK

Post Mon Jan 14, 2013 12:16 pm

Re: Approved Scanning Vendor - PCI

Thanks for the replies, guys. All very helpful.
<<

ziggy_567

User avatar

Sr. Member
Sr. Member

Posts: 378

Joined: Tue Dec 30, 2008 1:53 pm

Post Mon Jan 14, 2013 2:51 pm

Re: Approved Scanning Vendor - PCI

Also, after re-reading your original post, I see there might be some confusion on what an ASV is.

A company is certified as being an ASV. The "V" stands for vendor. There are not individual (person) ASVs. You can verify this by browsing the published list:

https://www.pcisecuritystandards.org/approved_companies_providers/approved_scanning_vendors.php#

Any person can use the ASV products of any of these companies to produce scan reports that will be accepted for a PCI QSA audit. It doesn't matter if you are an employee of an ASV, the company being scanned, or some other third-party.
--
Ziggy


eCPPT - GSEC - GCIH - GWAPT - GCUX - RHCE - SCSecA - Security+ - Network+
<<

tturner

User avatar

Sr. Member
Sr. Member

Posts: 435

Joined: Thu Jun 26, 2008 4:50 pm

Post Mon Jan 14, 2013 5:31 pm

Re: Approved Scanning Vendor - PCI

Internal scans can be done by any "qualified" internal security person. PCI does not define what qualified means but I suspect the day will come when they start requiring internal folks to become ISA or PCIP. Your QSA determines whether this is being properly managed, not the council. Yes, much room for interpretation. Welcome to PCI.

External (internet facing) scans must be done by the ASV. The ASV MUST do the scanning but you will have access to the reports. The ASV will also handle documentation for exceptions. The ASV is responsible for the validity of that scan, and their license depends on its accuracy. The customer cannot manage that process but they can certainly work with their ASV for remediation consulting and providing documentation to support requested exceptions. What confuses people is you might have access to manage a hosted scanner in your ASV environment. It's not the same as the ASV console.

ASV certification IS awarded to qualified individuals but only if they work for an ASV company. See https://www.pcisecuritystandards.org/tr ... aining.php for more info
Last edited by tturner on Mon Jan 14, 2013 5:35 pm, edited 1 time in total.
Certifications:
CISSP, CISA, GPEN, GWAPT, GAWN, GCIA, GCIH, GSEC, GSSP-JAVA, OPSE, CSWAE, CSTP, VCP

WIP: Vendor WAF stuff

http://sentinel24.com/blog @tonylturner http://bsidesorlando.org

Return to Compliance, Regulations &amp; Standards

Who is online

Users browsing this forum: No registered users and 2 guests

cron
.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software