I need help about SAQ #C - Are quarterly internal vulnerability scans performed?
What is target (scope) for those internal scans?
- Router with modem (WAN1/LAN1), DMZ, some office computers are connected there
- Wireless router, access point, which in fact is a bridge to LAN1, some office computers are connected via this router
- Dedicated router - installed only to meet PCI requirements (LAN2, connected to WLAN1/LAN1)
- Dedicated store www server - completely isolated network, in fully isolated VLAN (connected to dedicated router LAN2).
Basically only port 443 is opened, and forwarded to server. Network is fully isolated. We can manage our dedicated router only via serial cable or prepared eth2 interface only for managament (no device is connected there)
I can't even retrieve customer IP on www store server (where cardholder data is processed)
My question is: Which network should I scan? Do I need to scan everything? Do I need to scan office network as well? (which in my opinion would be ridiculous).
My concern is we have office computers which obviously won't pass internal scans on LAN1 - for example I have WAMP installation on my computer, but I don't really care about fact my WAMP installation has some vulnerabilities.
Our cardholder env. (which is our server) is behind three firewalls... (LAN1,LAN2,iptables)
Only way I can login to server's console is... direct, physical login (which is a little pain btw.) All ports except TCP 443 HTTPS are closed. SSH is disabled.
Knowing all root passwords there is no way to connect to card env. server. (our store)
Edit: Just performed internal scan (using asv tools), it found vulnerability issues in our printer!!! - this is ridiculous