Re: RE: PCI Compliance (Vulnerability Scans)

Thanks for all the great information (all).  I am now wondering though, if you 
use an automated tool (VA Scanner that claims to be PCI compliant), does that 
mean whatever it finds and whatever it rates it (i.e. HIGH), is the final word, 
and the company fails? I guess what I am asking, I was under the impression 
that PCI scans could be much automated and very little to no user intervention 
was required (unlike a Vulnerability Assessment/Penetration test).  However, 
many automated tools have false positives.  Doesn't a company fail if they have 
any "HIGH" findings? With that said, are you required to go through each 
finding and validate?  If so, then you have just turned it into a Vulnerability 
Assessment.  

Also, The Automated Tool I have been evaluating claims to be PCI compliant.  
However, for its discovery phase, it only uses ports 22,23,25,80 and 445.  Upon 
finding any Host with these ports open, it will then run a common port scan.  
Is this way off?  What do most of you do for host discovery (i.e. nmap scans of 
what ports? or different tools?

Any thoughts?
Thanks,
Sparky

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------