Internal Vulnerability Scans
The Internal Vulnerability Scans application, also referred to as the Internal Scans application, performs vulnerability scans of devices connected to an SC//Reliant™ platform edge device. It ensures adherence to Payment Card Industry Data Security Standard (PCI DSS) requirement 11.3.1 (v4.0.1), which mandates regular scanning internally for vulnerabilities in systems that process, store, or transmit payment card data.
To perform these scans, the application leverages Greenbone's OpenVAS scanner, a powerful and open-source vulnerability scanning engine, to detect known vulnerabilities and security misconfigurations. The OpenVAS scan engine aligns with PCI DSS, NIST, CIS benchmarks, and ISO 27001.
Vulnerability and patch management overview
The Internal Scans application is one component of the broader SC//Reliant platform vulnerability management strategy. Scale Computing operates a formally documented, management-approved Vulnerability Management Program owned by the Chief Information Security Officer (CISO) and operationally executed by the Compliance and Security Operations (CSO) function. The Internal Scans application is how that program reaches into the edge fleet.
Scan cadence
The SC//Reliant platform exercises layered scanning across the production environment and the edge fleet.
- Authenticated internal scanning is performed monthly with OpenVAS across the production environment and the edge fleet. The Internal Scans application provides this coverage at each site.
- External Approved Scanning Vendor (ASV) scanning is performed quarterly, in alignment with PCI DSS.
- Web-application scanning is performed at least quarterly, with biannual external penetration testing against the SC//Reliant Platform Manager web tier.
Severity triage and remediation SLAs
Scan findings from the Internal Scans application and other sources are imported into a central tracker, risk-rated based on the Common Vulnerability Scoring System (CVSS), asset criticality, data sensitivity, and threat intelligence, and assigned to the responsible system owner. Remediation targets are:
| Severity | Remediation SLA |
|---|---|
| Critical | 30 days |
| High | 30 days |
| Medium | 90 days |
| Low | 180 days |
Exceptions are formally documented in the Policy Exception Log and approved by the CISO. Open vulnerabilities and SLA aging are reviewed at minimum monthly with the CISO and at the quarterly executive risk review.
Patch deployment through the fleet-update pipeline
Patches that remediate findings are delivered to the edge through the SC//Reliant platform's fleet-update mechanisms. Major platform releases ship on a roughly quarterly cadence. Minor releases and security patches ship continuously through the update pipeline. Releases stage through customer-defined rings (pilot, ring 1, ring 2, fleet) with automated health gates between rings, and rollback is supported at every stage. The Internal Scans application supports post-remediation re-scans (PCI DSS 4.0.1 §11.3.1.3) so that operators can verify a patch has resolved the finding at each site.
Application security testing
In addition to the fleet-facing scans, the SC//Reliant platform pipeline includes Static Application Security Testing (SAST, for example Brakeman for Ruby), Software Composition Analysis (SCA via SonarQube), and Software Bill of Materials (SBOM) generation (CycloneDX via cyclonedx-js and cyclonedx-ruby on pipeline runs). Dynamic Application Security Testing (DAST) is performed against the SC//Reliant Platform Manager web tier through quarterly authenticated web-application scanning and biannual external penetration testing. Container images for newer platform components are signed with Sigstore Cosign, with image-signature verification validated on running edge clusters.
CVE disclosure practice
Scale Computing maintains a formal Security Incident Response Plan (SIRP) with a named escalation roster, 24/7 coverage, and defined severity tiers. Critical-severity CVEs affecting the SC//Reliant platform are communicated to affected customers' designated security contacts within 5 business days of confirmed verification, with preliminary indicators provided as soon as practical where active exploitation is observed. High-severity CVEs are communicated within 10 business days of verification and risk validation. Medium and Low CVEs are addressed in routine release notes. Notification content includes the affected component, CVE identifier and CVSS score, observed exploitation status, mitigating controls available, and the patch or workaround timeline.
Features
The following outlines the key features of the Internal Scans application.
Network discovery & asset identification
- Maps network topology to visualize vulnerable nodes.
- Identifies device types (servers, workstations, firewalls, and routers).
- Scans for vulnerable TCP and UDP services.
Vulnerability detection with OpenVAS
The application integrates Greenbone’s OpenVAS scanner to perform in-depth security analysis, including:
- Unauthenticated scanning: Identifies publicly exposed services and weaknesses without credentials.
- Authenticated scanning: Uses credentialed access via SSH, SMB, or SNMP to evaluate security configurations.
- Vulnerability database integration: OpenVAS continuously receives updates with CVEs, CVSS scores, and vendor security advisories.
- Exploit and misconfiguration detection: Scans for outdated software, weak encryption, default credentials, and misconfigured access controls.
PCI DSS 4.0.1 compliance
- Requirement 11.3.1: Conducts internal scans to identify security risks within the network.
- Requirement 11.3.1.3: Supports post-remediation re-scans to verify vulnerability resolution.
- Requirement 11.3.2: Performs quarterly external vulnerability scans on internet-facing systems.
- Requirement 11.4: Aids in penetration testing by detecting potential attack vectors.
OpenVAS scan engine and techniques
- Port and service detection: Identifies open TCP/UDP ports and running services.
- Banner grabbing: Extracts service versions for vulnerability matching.
- Patch compliance checks: Identifies missing security updates.
- Configuration audits: Evaluates system settings against industry best practices.
- Risk scoring: Calculates CVSS values based on the context of the services found running in a scanned network.
Reporting and remediation guidance
- Comprehensive reports: Includes risk categorization (low, medium, high, critical), CVSS scores, and affected hosts.
- Actionable fixes: Provides remediation steps based on OpenVAS findings (patch updates, configuration hardening).
- PCI compliance summary: Highlights non-compliant areas and required corrective actions.
Getting started
The following documentation can be used to get started in configuring the Internal Scans application in SC//AcuVigil™ and viewing your scan results.