PCI Configuration Audits with Nessus
Tenable's Research group has produced two Nessus PCI configuration .audit files for both the Windows and Linux operating systems. These configuration checks are derived from specific recommendations and audit requirements based on the PCI 1.1 standard.
These checks go above and beyond the PCI requirements of performing vulnerability and patch auditing and makes it very easy to audit and analyze system configurations against specific PCI items. These new audits also makes it easy to perform a single scan of one or more PCI hosts and accomplish a vulnerability, patch and configuration audit.
For the Windows PCI policy, configuration audits are available to ensure that a host firewall is enabled, that unnecessary services are disabled, that the system is secured to prevent or log abuse and that user account security is sufficient. For the Linux PCI policy, similar audits are performed to limit abuse, to audit new accounts and to ensure that logging is enabled. Each audit file includes the ID of the corresponding PCI DSS Security Audit Procedures document.
Compared to the certified Center for Internet Security .audit policies for Windows and Red Hat available, these .audit files are not as in-depth or comprehensive. However, if you are a PCI auditor or want to see how your systems would do before an official audit, these checks can produce content required to show compliance with a wide variety of sections of the PCI 1.1 standard.
To obtain these .audit files, Direct Feed or Security Center users should log onto the Tenable Support Portal, click on the 'Download' button and then the 'Download Configuration Audit Policies' button. Both polices are available for download under the 'PCI' section.
To install these on the Security Center, copy them to the /opt/sc3/admin/nasl directory. They will then be available as a .audit policy that can be included within a Security Center vulnerability scan policy. A demonstration video of using the Security Center to audit a Windows 2003 server is available here.
Nessus 3 Direct Feed users should save these .audit files to their laptop or server which runs their Nessus client and then create a scan policy which includes the desired .audit file as a configuration audit. A demonstration video of performing a configuration audit of a Windows 2003 server is available here.
Related Articles
CVE-2023-34362: MOVEIt Transfer Critical Zero-Day Vulnerability Exploited in the Wild
June 2, 2023Discovery of a new zero-day vulnerability in MOVEit Transfer becomes the second zero-day disclosed in a managed file transfer solution in 2023, with reports suggesting that threat actors have stolen data from a number of organizations.
The Role of Open Source in Cloud Security: A Case Study with Terrascan by Tenable
May 11, 2023Open source software and cloud-native infrastructure are inextricably linked and can play a key role in helping to manage security. Open source security tools like Terrascan by Tenable are easy to scale, cost-effective and benefit from an agile community of contributors. Let’s take a look at how you can implement it today.
Microsoft’s May 2023 Patch Tuesday Addresses 38 CVEs (CVE-2023-29336)
May 9, 2023Microsoft addresses 38 CVEs including three zero-day vulnerabilities, two of which were exploited in the wild.
Want to Learn More about Exposure Management? Check Out This Gartner® Report
June 6, 2023At Tenable, we believe that you need exposure management to protect your modern attack surface. But it’s not just us. We feel the Gartner “Predicts 2023: Enterprises Must Expand from Threat to Exposure Management” report is required reading for cybersecurity teams adopting an exposure management program and platform.
Tenable Cyber Watch: China’s ‘Volt Typhoon’ Targets U.S. Critical Infrastructure, BEC Attacks Skyrocket, and more
June 5, 2023This week’s edition of the Tenable Cyber Watch unpacks the White House’s updates to its National AI R&D Strategic Plan and addresses the recent surge in business email compromise scams. Also covered: CISA’s warning about Volt Typhoon, the hackers backed by the Chinese government that have been targeting U.S. critical infrastructure.
CVE-2023-34362: MOVEIt Transfer Critical Zero-Day Vulnerability Exploited in the Wild
June 2, 2023Discovery of a new zero-day vulnerability in MOVEit Transfer becomes the second zero-day disclosed in a managed file transfer solution in 2023, with reports suggesting that threat actors have stolen data from a number of organizations.
- Vulnerability Management