PCI DSS · Domain 3
Vulnerability Management
About 15% of the exam
Requirement 5, malicious software
- Scope
- systems commonly affected by malware
- Solution
- detect, remove and block malware
- Currency
- definitions and engine kept current
- Scanning
- periodic scans plus active monitoring
- Disabling
- only with documented approval
- Low risk systems
- threat reevaluated periodically
- Removable media
- controls against malware from media
- Phishing
- detection and staff protection required
Version 4.0 added explicit anti phishing mechanisms and periodic reevaluation of any system claimed to be low risk
Requirement 6, secure systems and software
- Vulnerabilities identified from external sources
- A risk rank assigned to each
- Critical patches applied within one month
- Other patches on a defined schedule
- Bespoke software developed securely
- Developers trained in secure coding annually
- Code reviewed before release to production
- Change control separates test and production
Public facing web applications need either an automated technical solution or regular application layer testing
Scanning types
- Internal scan
- quarterly, run from inside
- External scan
- quarterly, by an approved vendor
- After change
- rescan following a significant change
- Authenticated scan
- credentials give deeper visibility
- Application scan
- finds web layer weaknesses
- Passing result
- no failing vulnerabilities remain
Approved Scanning Vendor
- Approved by the standards council
- Performs the quarterly external scans
- Reports pass or fail per host
- Disputes raised with supporting evidence
- False positives documented, never ignored
- Rescan until a passing result
Risk ranking vulnerabilities
- Rank using industry sources and context
- Critical and high fixed fastest
- Version 4.0 allows a targeted risk analysis
- Available exploits raise the priority
- Interim measures while patching is pending
- Track remediation through to closure
Secure development
- Security requirements defined before coding
- Threat modeling during design
- Input validated on the server side
- Parameterized queries prevent injection
- Secrets kept out of source control
- Dependencies inventoried and monitored
Change control
- Documented impact and approval
- Functionality tested before release
- Back out procedure prepared
- Production data not used for testing
- Test accounts removed before release
- Significant change triggers scans and tests
Payment page scripts
- Only authorized scripts allowed to run
- Integrity of each script assured
- Inventory with written justification kept
- Tamper detection on the payment page
- Alerts on unexpected page changes
Software inventory
- Bespoke and custom software listed
- Third party components tracked with versions
- End of life software identified early
- Bill of materials supports fast response
- Unsupported components need a written plan
From discovery to closure
- Monitor advisories
- Discover through scanning
- Assign a risk rank
- Prioritize remediation
- Patch or mitigate
- Rescan to confirm
- Report the trend
- Repeat findings signal a process problem
- Scanning without remediation proves nothing
- Verify the fix, never assume it
- Recurring causes feed secure development
Vulnerability mistakes
- Scan scope missing new addresses
- Patching only what the scanner reports
- Anti malware disabled for performance
- Container images scanned only at build
- Firmware and appliances left unpatched
Rapid recall: frequencies
- Internal scans
- at least quarterly
- External scans
- quarterly by an approved vendor
- Significant change
- rescan the affected systems
- Critical patches
- within one month of release
- Secure coding training
- at least once a year
- Malware definitions
- kept current continuously
Reference strip: malware, patching, scanning, code, evidence
Malware
- Deployed on systems at risk
- Kept current and running
- Low risk claims reevaluated
Patching
- Critical within one month
- Others on a defined schedule
- Ranked by risk, not convenience
Scanning
- Internal and external quarterly
- Rescan after significant change
- Passing result required externally
Code
- Secure coding training yearly
- Review before production release
- Payment page scripts controlled
Evidence
- Scan reports and dispute records
- Patch records with dates
- Change approvals and test results
Quick exam traps
- Trap: A quarterly scan satisfies the requirement even if findings stay open
- Trap: Only the approved vendor scan matters and internal scans are optional
- Trap: Anti malware is required on every system without exception
- Trap: A failed external scan can be left until the next quarter
- Trap: Patching within one month applies to every vulnerability equally
- Trap: Scanning a container image at build time covers it for its lifetime
cybercertprep.com · original revision sheet written from the public body of knowledge