The Internal Vulnerability Scans application, also referred to as the Internal Scans application, performs vulnerability scans of devices connected to a Scale Computing™ edge security device (ESD) or an SC//Reliant Platform edge device. It supports adherence to Payment Card Industry Data Security Standard (PCI DSS) requirement 11.3.1 (v4.0.1), which mandates regular scanning internally for vulnerabilities in systems that process, store, or transmit payment card data.
To perform these scans, the application uses Greenbone's OpenVAS scanner, an open-source vulnerability scanning engine, to detect known vulnerabilities and security misconfigurations. The OpenVAS scan engine aligns with PCI DSS, NIST, CIS benchmarks, and ISO 27001.
Where to find it
To see this application's reports and company-wide settings for all your sites, select Internal Scans from the Apps menu. The page is titled Internal Scans.
Features
The Internal Scans application provides the following key features.
Network discovery & asset identification
- Maps network topology to visualize vulnerable nodes.
- Identifies device types (servers, workstations, firewalls, and routers).
- Scans for vulnerable TCP and UDP services.
Vulnerability detection with OpenVAS
The application integrates Greenbone’s OpenVAS scanner to perform in-depth security analysis, including:
- Unauthenticated scanning: Identifies publicly exposed services and weaknesses without credentials.
- Authenticated scanning: Uses credentialed access via SSH, SMB, or SNMP to evaluate security configurations.
- Vulnerability database integration: OpenVAS continuously receives updates with CVEs, CVSS scores, and vendor security advisories.
- Exploit and misconfiguration detection: Scans for outdated software, weak encryption, default credentials, and misconfigured access controls.
PCI DSS 4.0.1 compliance
- Requirement 11.3.1: Conducts internal scans to identify security risks within the network.
- Requirement 11.3.1.3: Supports post-remediation re-scans to verify vulnerability resolution.
- Requirement 11.4: Aids in penetration testing by detecting potential attack vectors.
Note: The Internal Scans application doesn't cover PCI DSS requirement 11.3.2, quarterly external vulnerability scans of internet-facing systems. For external scanning, use the External Scans application. |
OpenVAS scan engine and techniques
- Port and service detection: Identifies open TCP/UDP ports and running services.
- Banner grabbing: Extracts service versions for vulnerability matching.
- Patch compliance checks: Identifies missing security updates.
- Configuration audits: Evaluates system settings against industry best practices.
- Risk scoring: Calculates CVSS values based on the context of the services found running in a scanned network.
Reporting and remediation guidance
- Comprehensive reports: Includes risk categorization (low, medium, high, critical), CVSS scores, and affected hosts.
- Actionable fixes: Provides remediation steps based on OpenVAS findings (patch updates, configuration hardening).
- PCI compliance summary: Highlights non-compliant areas and required corrective actions.
Getting started
To get started with the Internal Scans application in SC//AcuVigil, see the following pages:
Getting the application
Scale Computing installs Internal Scans on your sites as part of the managed service. To change its settings, contact Scale Computing Support. To add it to a site, open a ticket in the SC//AcuVigil dashboard, email team@scalecomputing.com, or call (512) 687-7401.
System requirements
- Scale Computing ESD: MG3, SG1v1, SG2v1, XG1v1, or VG
Available reports
| Report | Description |
|---|---|
| PCI Internal Scans Devices Report | A summary count and list of devices being scanned. |
| PCI Internal Scans History Report | A spreadsheet version of the Scan History report. |
| PCI Internal Scans Vulnerability Report | A spreadsheet version of the Vulnerability report. |