Vulnerability Management & Testing Flashcards

What is a penetration test and how often does PCI DSS require it?

Answer: A simulated cyber attack to identify vulnerabilities, required at least annually and after significant changes

PCI DSS requires penetration testing at least annually and after any significant infrastructure or application change to identify exploitable vulnerabilities before real attackers find them.

What is vulnerability scanning in PCI compliance?

Answer: Automated scanning of systems to identify known security weaknesses, required quarterly by an Approved Scanning Vendor

Quarterly external vulnerability scans by an ASV and internal vulnerability scans (also quarterly at minimum) identify known weaknesses in systems, enabling remediation before exploitation.

What is the role of an Approved Scanning Vendor (ASV)?

Answer: A PCI Council-approved organization that conducts external vulnerability scans for merchants

ASVs are organizations validated by the PCI SSC to perform external vulnerability scanning services using PCI-approved scanning solutions and procedures.

What is patch management in PCI compliance?

Answer: The process of applying software updates to fix security vulnerabilities in a timely manner

PCI DSS requires installing critical security patches within one month of release and establishing a process for identifying and prioritizing all relevant patches for systems in the cardholder data environment.

What is a Qualified Security Assessor (QSA)?

Answer: A PCI Council-certified professional authorized to conduct on-site PCI DSS compliance assessments

QSAs are individuals certified by the PCI SSC who have demonstrated expertise in information security and PCI DSS requirements, authorized to perform official compliance assessments.

What is the purpose of file integrity monitoring (FIM) in PCI compliance?

Answer: To detect unauthorized changes to critical system files that could indicate a security breach

FIM tools detect changes to critical system files, configuration files, and content files, alerting security teams to unauthorized modifications that could indicate a compromise.