1

Is each firewall interface IP is considered as external IP?.

Do we need to scan each interface IP??.

What is an internal scan? What are the elements for internal, how we do it?.

1
  • No, the "External IP" is given to your Modem (or server that translates the "street cable" to the rest of the network) by your ISP, a firwall has an Internal IP address
    – Lighty
    Commented Oct 29, 2014 at 9:14

1 Answer 1

3

An external vulnerability scan must scan all machines that are in scope for PCI-DSS that have public ips from outside the firewall (eg the internet). This must be done by a qualified party called an ASV. The PCI Council maintains a list of ASVs on their website.

The internal vulnerability scan must scan all machines that are in scope for PCI-DSS from inside the firewall (eg local network). You may perform this scan yourself.

2
  • Thanks for your input. Can you suggest me which tools can i use to perform internal scans like checking servers etc
    – PCIrs
    Commented Oct 29, 2014 at 7:34
  • PCIrs: Nessus is a good beginning however, there are plenty of others (Shavlik), Nexpose. Rather than fixate on a tool, fixate on the processes and interconnections on your network. Understand what PCI-DSS is asking for, and check it against what you have running/configured
    – munkeyoto
    Commented Oct 29, 2014 at 13:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .