I have completed the online training/exam to become an ASV (Approved Scanning Vendor) for my company.

We currently have Nessus as our platform, and I am not feeling too great about it's capabilities. What a co-worker told me is that Nessus will print out the final report for the user in the format approved by PCI. I have been hitting my lab and the report looks far from it, which is okay, just means lots of typing.

Are there any better tools for ASVs to use? If so, what tool do you use? Is there a template out there to use for creating reports for customers (Even a word doc will help)? I have the appendix from the ASV handbook but that is a PDF from the PCI website so it doesn't have editable fields.

I also would like to see an example of report that has multiple IP address as the example from the online training has only two systems (which fits perfectly on one page of example Appendix B but what if there is ton of IPs?).

  • Tool recommendations are off-topic on this site. What report will work for your auditor will depend on your auditor. If they are familiar with the Nessus format, it might be fine. – schroeder Apr 21 '16 at 15:42
  • Thank you for the re-write on my question. I thought that the ASV format was mandatory for the Attestation of Scan Compliance and the Executive Summary (with minor approved modifications). Is there a template out there that I can use to edit them? I have not been able to find any through the official PCI website minus the handbook. However, since it is a PDF, it limits on what I can do to modify the fields I need. Thanks for the help. – POSH Geek Apr 21 '16 at 15:55
  • This might be a great question for Nessus support. If they are claiming the report is sufficient for PCI, then they should provide the latest format for that standard. – schroeder Apr 21 '16 at 16:00

You're missing the concept of ASV. It is not about the tool, it is about the results. The goal for ASV's isn't to perform full blown extensive penetration tests, it is to look for common problems (known CVEs). The core of 11.2.2 (PCI) are: (copied from Qualys)

Your documented PCI scope (cardholder dataenvironment)
Your documented risk ranking process
Your scanning tools
Your scan reports

When it comes to scanning tools, they all more or less look for and accomplish the same goals: "Analyze a system, determine what it is (operating system), determine what services are running (version numbers) and then determine whether those versions fall into known vulnerabilities (via CVE numbers). The purpose of most of those tools is to get an immediate assessment. This gets combined/correlated with your documented risk procedures/policies. For example, HEARTBLEED/POODLE are still prevalent in many environments I pentest. Some cannot be fixed, so compensating controls are put in place. Those controls are documented, explained, tested and can pass any audit.

A tool is a tool is a tool. None are better than the other when it comes to meeting the requirements. So while you may feel edgy about the true results of one tool, it is not about your feelings/thoughts on one tool. It all boils down to the tool getting the approval of PCI to do the scanning. As for the security of the site (real world security), this is covered in an altogether different section of PCI (11.3)

  • Awesome. Thanks for the feedback. I am still trying to wrap my head around the AVS program. The PCI training (from PCI DSS) make it really confusing on what AVS's do. It first makes you look at all DSS requirements and how they apply to you. Which is great as it mentions things like firewall rules, policies, etc... But then the next module makes it seem like you just hit the scan button, wait for results, validate findings, and then hand in a report. If at all possible, would you mind maybe talking about this a little more in depth offline? I can either do it by phone or e-mail. – POSH Geek Apr 21 '16 at 19:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.