Self Tests for cPanel Server PCI Compliance

Question

(Edited & added more information at the bottom of this question)

I've been tasked with "testing" a client's Linux web servers, running cPanel (which they own and mostly manage, until they come to me from time to time for help) for PCI Compliance. The client isn't doing anything with e-commerce now, but would like to consider it in the future.

I don't hold any security certs, but did go back to my alma mater last fall for a semester-long course in IT Security, in which the focus of the course was the 10 domains included in the CISSP certification. I've also done research on PCI Compliance in the past (and in one case a couple years ago, had to reprimand a small payment processor for asking me to allow one of my clients to store credit card data in plain-text format on a server I managed).

I'm basing my recommendations to my current client from that course as well as from the research I've done on PCI Compliance.

I've downloaded the Self-Assessment Questionnaire C-VT from the PCI Security Standards website, and have also downloaded the Navigating PCI DSS v2.0 document.

That said, I'm more interested in tests (or checklists) against the actual server I can perform. I found that McAfee and cPanel have a (free) cPanel plugin that will allow up to 4 scans a year. I've also found a couple of external free PCI scans (here and here).

I'm wary of "free" scans out there, especially if you don't know the organization behind the scan. However, my client understandably doesn't want to pay for a scan (other than my time) because they're not actually pursuing compliance or doing anything ecommerce right now (they just want to be prepared). They're also a nonprofit organization so don't have much cash.

So I have 3 related questions:

1. Are there any "free" scans you'd recommend or not recommend for testing a server?
2. Do you have any thoughts on McAfee's plugin for cPanel?
3. Are there any checklists (other than the PDF Documents available at pcisecuritystandards.org) that I can use to do a "self test" on the server and manually test it for PCI compliance?

Edit for More Information

Based on the feedback below in the form of answers and questions, I'd like to clarify a few things. The client isn't going through any official security audit or PCI Compliance test. They'd just like to have a good idea of what they're doing right, what needs work, and what they would need to focus on in the future if they do decide to process transactions through their server.

I chose the C-VT, because I read this in its introduction:

Web-Based Virtual Terminal, No Electronic Cardholder Data Storage

If I'm hearing you guys correctly, I've made a wrong assumption, and the C-VT has nothing to do with websites, but instead, has to do with actual CC terminals. I'll take a look at SAQ-D. Thank you for that suggestion.

Thanks for the answers thus far. (End Edit)

Answer 1

In terms of scanning the system for compliance, it's a question of running vulnerability scans and see if they pass externally and if the risk is acceptable internally. In terms of whether the system is configured in a compliant manner takes more work as per the following list:

• Is networking limited to protocols required for business purposes with no insecure protocols in use for logons etc such as telnet?
• Is the system hardened according to an industry standard (SANS, NIST, CIS)?
• Is HTTPS in place (transmission of sensitive data over encrypted channel)?
• Is AV installed and up to date (not really necessary on *nix)?
• Is the system patched up to date?
• Does development adhere to a SDLC with trained developers?
• Is user authorisation checked and based on roles?
• Are password policies in place and enforced (length, complexity, aging etc)?
• Is logging in place for authentication, File Integrity Monitoring, NTP sync, IDS/IPS, penetration testing?
• Lots of policy documentation?

If you want to do a basic check, harden the system and run a vulnerability scan. If you need to be prepare for compliance, you'll need to go through each of the above and more depending on compliance requirements (i.e. SAQ/full assessment/which SAQ depending on payment channel etc)

In terms of your specific 3 questions...

Vulnerability scans are all pretty similar in that they scan and check for vulns and meaure against CVSS scoring. Nessus is good but there are plenty.

The McAfee plugin (I think) is based of their Foundstone stuff and is good.

In terms of checklists, it's a matter of going through the list above or the PCI standard or just considering best practice.

Answer 2

I'm not sure what a self-test is, however you don't need to pay anything for tools in order to test against the PCI standards. There are loads of free tools out there, there are even security and forensics specific OS distros out there that cost absolutely nothing. So get a copy of the Backtrack or Kali OS distro and run it off a USB or as a virtual machine and go to town with Nessus or another free vulnerability assessment tool.

Answer 3

Why would you be testing CPanel for PCI compliance? How did you come to arrive at C-VT as the applicable SAQ?

Which PCI requirement is this being done to meet?

One thing is for sure: CPanel should NEVER be exposed to the open Internet. So if you are scanning it from over the net you can forget PCI compliance.

I do PCI for a living.