3

I'm using an external WAF (Cloudflare). My server firewall is setup to only allow connections from the WAF.

Currently, I'm using McAfee Secure for the PCI compliance external vulnerability scan. Due to my firewall, the scan did not detect any open ports. McAfee Secure insists that I whitelist their IP so that they can bypass both my firewall and WAF.

Is it normal for a PCI compliance external vulnerability scan ASV to ask you to whitelist their ip and allow them to bypass both your firewall and WAF for an external scan? This seems odd to me.

Improve this question

3 Answers 3

Reset to default
1

According to the PCI DSS ASV Guide:

5.6 ASV Scan Interference
If an ASV detects that an active protection system has actively blocked or filtered a scan, then the ASV is required to handle it in accordance with Section 7.6, “Resolving Inconclusive Scans.”

In section 7.6:

Scan customer makes proper temporary configuration changes to remove interference during an ASV scan

As Cloudflare is an "active defence" (WAF) according to the definition in PCI-DSS, it makes sense that the ASV by-passes it. I'm not sure that Cloudflare could be configured to allow the scans, and ultimately, it's just easier to temporarily allow the ASV's IP at the firewall.

Improve this answer
9
  • To clarify my question, I wasn't talking about bypassing Cloudflare but was talking about bypassing the iptables on my server. My iptables whitelisted Cloudflare and my ASV asked to be added to the whitelist as well.
    – nwarp
    May 18, 2018 at 8:49
  • I only mentioned Cloudflare to provide context on why my server appears to have no open ports. Upon re-reading of my question, I can see how it is confusing.
    – nwarp
    May 18, 2018 at 9:03
  • @nwarp then explain the situation: you have a WAF, and the ASV wants to scan. They cannot scan through the WAF because they would be blocked, right? So the ASV wants to scan your environment in the way that users access your environment. That means they need to bypass your WAF. You could try to configure your WAF to allow them, but you can't with Cloudflare. So, they just want to access your perimeter directly. The way you can do that is to whitelist their IP on your iptables.
    – schroeder ♦
    May 18, 2018 at 9:08
  • @nwarp look at it another way: if the ASV scans through the WAF, they will get blocked and return an "inconclusive scan". If they scan your firewall directly with your current firewall rules, they will also get an "inconclusive scan". The ASV needs to scan.
    – schroeder ♦
    May 18, 2018 at 9:13
  • 1
    I guess the crux of the question is, if the ASV were whitelisted, could the scanner discover vulnerabilities that could be exploited even through the external WAF. Looking at the section from "Required Components for PCI DSS Vulnerability Scanning", it appears that ASV scanners are supposed to have that ability. While not explicitly stated, I guess if the ASV cannot scan the WAF, letting them scan the ports exposed via the WAF seems to be an extremely reasonable alternative.
    – nwarp
    May 18, 2018 at 10:28
2

Yes, it is very normal for compliance scanning software to require the scanner's IP to be whitelisted in the local firewall.

The concept of compliance scanning is to scan the entire system to ensure a fully adhered to baseline at the very least. That's excellent that the firewall is doing its job, you now know that. But you also need the compliance scanner to scan the system to ensure patching, account, local security, general settings, etc, compliance as well. In order to allow that, you'll need to give the external scanner full network access to the target systems, which includes whitelisting the scanners IPs in the firewall.

Does this all makes sense?

Improve this answer
2
  • Keeping in mind that this is the external scan, wouldn't it be more helpful to know that your firewall is configured correctly than to duplicate the result of the internal scan?
    – nwarp
    Sep 18, 2017 at 15:06
  • It is important to know that the firewall is secure, but there are many ways to bypass secure firewalls. If you're just doing an external connection network security scan, then yes just knowing that the firewall is secure, and that unnecessary ports are closed could be fine. But if you're doing a full PCI compliance scan then you would also want to know that the internal network and server are secure as well.
    – cclater
    Sep 18, 2017 at 15:20
1

Firewalls do not need to be modified for PCI scanning, only IDS/IPS systems need to be modified.

Source: PCI DSS 3.2 and the PCI DSS ASV Guides

According to PCI DSS 3.2 only dynamic security systems need to be modified. Static security systems such as access control lists, which do not have dynamic behavior, including ports that are available, and source IP addresses which are allowed, do NOT need to be modified.

Improve this answer
2
  • Thank you for providing your sources and a little more context over your previous answer.
    – schroeder ♦
    May 17, 2018 at 17:16
  • Unfortunately, you are wrong. The ASV must be able to scan. The firewall in the scenario is preventing the scan. Therefore, section 7.6 "Resolving Inconclusive Scans" of the ASV guide applies, "Scan customer makes proper temporary configuration changes to remove interference during an ASV scan;" and whitelisting the ASV IP in order to complete the scan is reasonable (and normal)
    – schroeder ♦
    May 17, 2018 at 17:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .