When you indicate you have a clean scan, do you have NO vulnerabilities identified (my definition of “clean”)? Or, do you have vulnerabilities with a CVSS of less than 4 in your scanning reports? If you have vulnerabilities present in your reports, then it all depends on what those vulnerabilities are. I have been in situations where there were a lot of “low” rated vulnerabilities that allowed me using Metasploit to still penetration the systems.

That said, I have seen instances where the remaining vulnerabilities could not result in a penetration and have agreed that penetration testing is not necessary. In those instances, we created a compensating control to comply with requirement 11.3.

I have a query with regards to vulnerability scanning and penetration testing. How important is it to conduct PT if my scan results are clean?

Where I’m coming from is, in my understanding, vulnerability scanning is one part of the PT activity, right? If so, I perform internal and external vulnerability scans for all my systems in scope of PCI and I maintain clean scan reports for these systems every 3 months, would I still have to conduct PT activity?

Authenticated scans are perfect as they typically reduce the amount of false positive results, but they are not required by the PCI DSS.

A key mistake that we see made is who does the vulnerability scanning in the organization. The PCI DSS requires that the person doing the vulnerability scanning is qualified (i.e., CISSP, CISM, CEH, etc.) and that they are segregated from the people/equipment they are testing (i.e., you cannot be testing your own work). Yet we still encounter network administrators scanning the equipment they maintain.

I am new to PCI and looking at what needs to be done to implement it. I have read the PCI 2 requirements and I see the need to do internal vulnerabilty scans per 11.2.1. My assumption is that this is a vulnerability scan from inside the organization thus internal. Is this correct? And when I do these vulnerability scans are they with authentication to the device or purely from an unauthenticated perspective of the internal network components involved with PCI?