|
Regularly test security systems and processes
|
Run internal and external network vulnerability scans at least quarterly and after any significant change in the network. Address vulnerabilities and perform rescans as needed, until passing scans are achieved. After passing a scan for initial PCI DSS compliance, an entity must, in subsequent years, complete four consecutive quarters of passing scans.
Quarterly external scans must be performed by an approved scanning vendor (ASV). Scans conducted after network changes and internal scans may be performed by internal staff.
|
Develop and implement a methodology for penetration testing that includes external and internal penetration testing at least annually and after any significant upgrade or modification. If segmentation is used to reduce PCI DSS scope, perform penetration tests at least annually to verify the segmentation methods are operational and effective. Service providers using segmentation must confirm PCI DSS scope by performing penetration testing on segmentation controls at least every six months and after making changes to these controls.
|
|
Purpose
|
Identify, rank, and report vulnerabilities that, if exploited, may result in an intentional or unintentional compromise of a system.
|
Establishes whether and how a malicious attacker could gain unauthorised access to your systems and determines whether the controls required by the PCI DSS are in place and effective.
|
|
Reports
|
Potential risks posed by known vulnerabilities, ranked in accordance with NVD/CVSS base scores associated with each vulnerability.
|
More specific risks that vulnerability may pose, including specific methods how and to what extent it may be exploited.
|
|
Our solution
|
Powered by Comodo, our HackerGuardian scanning service performs highly accurate scanning of your externally facing systems, as required by the PCI DSS.
|
Meet the penetration testing requirements of the PCI DSS with our comprehensive web application, infrastructure or wireless network penetration tests.
|