[Autogenerated] requirement.
11 is all about assurance,
testing systems and environments to find flaws and vulnerabilities in the
cardholder data environment before a criminal does and making sure that
the controls error working as they should be.
So, although the theme is testing,
it's actually a strange mix soup of requirements starting off with the
need to test for the presence of wireless access points.
Then a requirement to conduct internal and external vulnerability
scans quarterly and ___________ tests annually,
which,
because it's such a complex area we're going to talk about in the next module.
Then we come to a protective and Detective Control,
which would actually sit much better requirements 12 and three,
which is to have intruder detection or intruder prevention systems,
and also something like file integrity monitoring to
check the changes to critical files.
And finally,
the usual requirement for all this to be supported by policies and procedures.
Because of the needs of vulnerability, scan and ___________ test,
all systems within and connected to the CD will be in scope of
some of the demands of this requirement.
So let's start off with Requirement 1.1,
which is designed to discover rogue wireless access points on the
network because at one stage over the past 10 years,
this really was a very common criminal attack in
retail and head office environments.
One of the most famous ever was a wireless attack.
The requirement is actually a little more complex.
It wants the organization to detect and identify both authorized and
unauthorized wireless access points every three months.
This is actually a really hard control to implement,
which Jacob and I discuss at the end of the module,
because you can't just walk around with wireless scanner like,
perhaps he once could.
There's so money wireless networks out there transmitting.
And so let's look at the helpful note, which is included in the requirement,
which says that you can achieve this by something like network access control
that would prevent a rogue access point being connected.
Or maybe by using some wireless I'd Sipes technology that would
notice a new wireless access point in rage and then attempts to
see the connection in Scope network.
And if so, it disables it.
The QoS is testing Procedure is quite varied because it allows
for the organization to the implemented.
Any one of the very many ways of meeting this requirement.
Essentially,
the QoS I would want to see the documented process for validating the
presence of wireless access points costly on also what tools and
techniques error in place on that they're working.
There are a couple of sub requirements to 11.1.
The first is that the organization should keep a register of
the authorized wireless access points,
along with a documented reason they exist and error allowed to be
connected to the 500 because it's essential to keep a documented
infantry of approved wireless access points has.
Then it sees snow that a connected wireless x excess point
that's not on the industry's rows or it hasn't gone through
the correct internal processes.
The testing procedure is for the QoS A.
To check the inventory and make sure there's a recorded business
justification for each wireless access point.
The other sub requirement here is that the organization does something
when an unauthorized wireless access point is detected,
which requires there to be an incident response procedures to be followed on.
You won't be surprised to discover that the testing procedures for the QoS A.
To check those incident response procedures and also speak with the
relevant people to make sure that they would be followed in the event of
a rogue wireless access point being detected.