Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

PCI Configuration Audits with Nessus

Tenable's Research group has produced two Nessus PCI configuration .audit files for both the Windows and Linux operating systems. These configuration checks are derived from specific recommendations and audit requirements based on the PCI 1.1 standard.

These checks go above and beyond the PCI requirements of performing vulnerability and patch auditing and makes it very easy to audit and analyze system configurations against specific PCI items. These new audits also makes it easy to perform a single scan of one or more PCI hosts and accomplish a vulnerability, patch and configuration audit.

For the Windows PCI policy, configuration audits are available to ensure that a host firewall is enabled, that unnecessary services are disabled, that the system is secured to prevent or log abuse and that user account security is sufficient. For the Linux PCI policy, similar audits are performed to limit abuse, to audit new accounts and to ensure that logging is enabled. Each audit file includes the ID of the corresponding PCI DSS Security Audit Procedures document.

Compared to the certified Center for Internet Security .audit policies for Windows and Red Hat available, these .audit files are not as in-depth or comprehensive. However, if you are a PCI auditor or want to see how your systems would do before an official audit, these checks can produce content required to show compliance with a wide variety of sections of the PCI 1.1 standard.

To obtain these .audit files, Direct Feed or Security Center users should log onto the Tenable Support Portal, click on the 'Download' button and then the 'Download Configuration Audit Policies' button. Both polices are available for download under the 'PCI' section.

To install these on the Security Center, copy them to the /opt/sc3/admin/nasl directory. They will then be available as a .audit policy that can be included within a Security Center vulnerability scan policy. A demonstration video of using the Security Center to audit a Windows 2003 server is available here.

Nessus 3 Direct Feed users should save these .audit files to their laptop or server which runs their Nessus client and then create a scan policy which includes the desired .audit file as a configuration audit. A demonstration video of performing a configuration audit of a Windows 2003 server is available here.

Subscribe to the Tenable Blog

Subscribe
Try for Free Buy Now

Try Tenable.io

FREE FOR 60 DAYS

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Sign up now.

Buy Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

$2,190.00

Buy Now

Try for Free Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save

Try for Free Buy Now

Try Tenable.io Web Application Scanning

FREE FOR 60 DAYS

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578.00

Buy Now

Try for Free Contact Sales

Try Tenable.io Container Security

FREE FOR 60 DAYS

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Learn More about Industrial Security

Get a Demo of Tenable.sc

Please fill out the form below with your contact information and a sales representative will contact you shortly to schedule a demo. You may also include a short comment (limited to 255 characters). Please note that fields with asterisks (*) are mandatory.