Running External PCI Scans

Alert Logic® is an approved Payment Card Industry (PCI) Scanning vendor. Through the Alert Logic console, you can schedule quarterly external scans that are required for PCI compliance.

How PCI Scans Work

Alert Logic External PCI scanning is different from internal and external vulnerability scanning in that it includes a web application heuristic scan in addition to the standard FusionVM scan engine. In this mode, the crawler will try to make heuristic-based decisions on which parameters should be considered as action parameters. It will intelligently fetch the parameters in order to conduct an effective scan.

This results in a large number of different variations, and therefore the scanner will launch a high number of security checks against the website. This scanning mode is the most efficient and accurate, and is required to be compliant with PCI-DSS requirements.

Time Required for Scanning

The time required for External PCI scanning varies depending on the size and complexity of the target website, the response time of the web server, and the PCI Scan Intensity. The default intensity is Normal, but this can be increased or decreased at the customer’s request. Therefore, the web scanning may vary from a few minutes to several hours.

During External PCI scanning, Alert Logic Scanners will send thousands, sometimes even hundreds of thousands, of HTTP requests to the target website. The longer the server takes to send a response back to the scanner, the longer it would need to wait idle until it receives the said response. A typical good web server response time is about 200 milliseconds or less.

The number of requests would depend on the number of files, directories, forms, variations, and inputs that need to be tested. Therefore, the more complex and the larger the website is, the longer the scan will take. In addition, we are required to test for many different vulnerabilities with different variations for each vulnerability. Therefore, for example, the same page will be tested for XSS and for SQL Injection. Also, for each vulnerability type (i.e. XSS), there are several different tests that check the target website for that type of vulnerability.

Improving Scan Run-Time

There are several things you can check to potentially reduce the amount of time an External PCI scan takes.

Web Server Performance

Check factors such as CPU, memory, hard disk access, and other resources. Most often, a simple server upgrade may solve the problem.

Database Performance

Check CPU, memory, and hard disk access in relation to the resources being used by the database. Additionally, check if any queries are taking too long to execute and if these can be optimized. Also, review the error logs related to the database for any additional information around what the scan was testing at the time.

Web Application Firewall (WAF), Intrusion Detection System (IDS), or Network Firewall Interference

Check if any of these systems are being used and if they are contributing to the high increase of your average response time. This may be the case since every incoming request on your web server will be thoroughly analyzed, thus increasing the response time. A lot of times, the scan will seem like it is hung. During ports and services discovery, the Scanner occasionally runs into hosts that will report every single (or lots of random) ports as open. Obviously, this is because something in front or on the target host is replying with SYN, ACKs for every SYN sent. This behavior is sometimes referred to as “Tarpitting”. A Tarpit is a service generally found on IDS/IPS and Firewalls as well as servers that delay or shroud incoming connections. Basically, when port scanning, the scanner gets stuck for hours, days, or even months trying to get past it.  We suggest that customers whitelist our Scanning IPs for any of these security mechanisms so that requests and responses pass through unhindered.

Scan Speed

To help reduce the scan duration, you may consider running the scan with a difference in PCI Scan Intensity. The default number of parallel connections is 10, while the maximum can be set to 25. But you may find that this configuration might not suit your needs. There are some cases where the Scan Speed should be put on a lower setting. While this seems counter-intuitive for shortening scan times, there are times where the target server cannot handle the number of requests from a normal scan. This could congest the web server with requests, thus increasing the time to send back a response. A slower scan speed might mitigate this if your web server cannot keep up with the number of requests being sent by the Scanner. On the other hand, if your web server can easily handle multiple requests at the same time, using the Fast PCI Scan Intensity setting would improve the scan duration.

Please note that increasing the number of parallel HTTP requests can also result in flooding or overloading the web server with HTTP requests, which can exponentially increase the response time from the web server. Therefore, before making such changes, ensure that the target web server can handle the increase in load.

Cloud WAF / Content Delivery Network

We have seen customers using CloudFlare and Incapsula for Content Delivery Network (CDN) capabilities. CloudFlare and Incapsula are more than just a CDN. They also provide a WAF for their customers. As a result, if our scanning IPs are not on the CloudFlare/Incapsula whitelist, customers may experience a long-running scan or a scan that is not progressing at all. In some cases, we may ask that customers whitelist our Scanning IPs for any similar security mechanisms so that requests and responses pass through unhindered.

The following are CloudFlare ports:

• 2096      tcp
• 2083      tcp
• 2082      tcp
• 8880      tcp
• 2052      tcp
• 2087      tcp
• 2086      tcp
• 2095      tcp
• 8080      tcp
• 8443      tcp

If you need justification for a PCI Fail dispute, contact the CDN vendor for the mitigation control.