[Autogenerated] requiring 11.2 demands that an organization of
proactively carries out vulnerability scans on at least a quarterly
basis and also after any significant change,
scans a required both inside the 100 on from
outside the organisation's perimeter.
Each of these is a separate sub requirement.
The rules around internal and external scans error suddenly different,
and it's important not to confuse the two.
There's no explicit testing procedure for 11.2.
It just points to the test requiring the sub requirements on.
The first of these is concerned with periodic internal vulnerability scans,
which must be carried out quarterly.
Typically, a vulnerability scan will detect previously unknown vulnerabilities.
After all, that's the purpose of carrying it out.
And so the requirement is not only to scan for vulnerabilities but to risk
assess any vulnerabilities found based on the methodology the organization
define for vulnerability management in requirements 6.1 and then the
organization needs to rectify any critical or high vulnerabilities before
re scanning the environment.
To validate that the discovered vulnerabilities have been fixed on,
this has to happen every quarter.
Lastly,
the requirement wants to make sure the vulnerability
scanning was done by someone qualified.
Which, of course, begs the question.
Well, who can that be?
Well,
it needs to be someone who could demonstrate that they're
qualified and trained in the use of the scanning tool.
It doesn't mean a formal P CSS see quantification
like an internal security assessor, qualified security assessor,
unproved scanning vendor or even API CLI professional.
And it's also not quantification like having assist or something like that.
The person doing the scanning can be an external resource or
someone that works for the organization.
However,
if they're in internal resource than this person must also be
independent of the people managing the infrastructure on
applications that are being scanned.
They can't be in the same team.
To validate this requirements in place,
the QoS A is going to look for at least four scan
reports covering the last four quarters,
including those re scans to show that the critical on
high vulnerabilities have been fixed.
They'll also interview the people responsibility for doing the
scans to find out if they are indeed qualified.
Now, if this is your first ever PC IDE CSS assessment,
the QoS a will just look for one scan because obviously you
haven't got a whole year's worth of quarterly scans.
Now we come to external vulnerability scans,
which error detailed and requiring 11.2 point two.
Again, These need to be conducted quarterly.
But these external scans must be undertaken by an
organization called an approved scanning Vendor,
or CSV.
So that's a company licensed and approved by the Payment
Card Industry Security Standards Council.
To perform these vulnerability scans,
you can find a list of all the approved scanning vendors on the P
CSS See website that there are lots of them.
And fact.
If you use any of the reputable external vulnerability scanning
companies now to check your external network perimeter,
it's a fair assumption.
They're also going to be in CSV.
But API CSV scan is not the same as a general external vulnerability.
Scan the type of scan you might be buying at the moment.
It's conducted in a specific way,
and there's an obligation on the company to issue a pass,
which means that the scanner found no vulnerabilities
with a CVS s score greater than four,
or vulnerabilities that the P CSS see would consider an automatic fail.
Quite often they're going to be false positives in CSV results,
so you'll need to clarify those with the company.
And sometimes you won't be able to re mediate a vulnerability on,
so you'll need to demonstrate the CSV that you've other controls in place to
mitigate the risk of that vulnerability being exploited.
The requirement is that you have a passing scan each quarter,
and that's what the NSA will want to see on again if this is your first
PC IDE CSS assessment for look for one passing scan.
The last vulnerability scanning requirement 11.2 point three,
is that in addition to quarterly scans,
the organization conducts internal and external
scans after any significant change, which,
of course, leads to the question of, Well,
what?
What is a significant change?
I'm afraid there isn't a clear answer because it depends on your environment.
The guidance is helpful here.
And so my take is that if you change anything in the system that stores or
process or transmits cardholder data or anything that's explicitly there to
provide a security function like a firewall,
then that's significant because the thing to remember is that
running a vulnerability scan generally is free.
It shouldn't cost you anything,
so there's really no excuse not to do it more frequently.
Whether it's a significant change or even a minor change,
you think, Well,
I'll just do a quick vulnerability scan to make sure
I'm not introduce the vulnerability.
The scanning after a significant change,
has to be conducted by someone qualified and independent.
But in this case, if it's an external scan,
it doesn't actually need to be done by CSV.
It's not looking for a passing scan after a significant change.
To meet the testing requirement,
the QoS A will want to review or change control system to see
evidence of changes on the justification than being in the
clusters significant or non significant.
Then where there's been a significant change,
the QoS A will want to review the scan reports to validate.
The scans were carried out on that they were carried out by qualified
independent resources and that for an external scan,
no vulnerabilities with the CBSS score,
more than four were not re mediated and for an internal scan,
no higher critical vulnerabilities were not fixed.
Now there have been a surprising number of F accuse published on
the P CSS See website about vulnerability scans.
These are some of the most useful ones for you.
Fake 108 7 helpfully say, is what a quarter is so like.
It says it's every three months or 90 days you can take your pick.
Fake.
1152 is really useful for complex, changing environment,
where the organization could never get a clean passing scan
because as soon as it fixes one vulnerability,
another one is introduced and found.
The states that as long as there's evidence showing that vulnerabilities
error identified via scans on fixed and then re scans conducted showing
the previous vulnerabilities were fixed on that we get services scans
demonstrating this over each quarter.
That's fine.
That will pass on F A Q 1317 goes into more detail about how to
determine in your organization what a significant changes