Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm hoping to find a piece of software to assist me in catching PCI compliance failures in advance of the actual ASV scans. I would much prefer to run the scans against myself before I request another company to do so. Is there any software out there that is written to do this sort of thing?

share|improve this question
    
@Those who marked this as "not constructive", exactly where am I soliciting opinions? I'm trying to find specific pieces of software that fill a specific need. I am not looking for "what's your favorite". I am new to this exchange, can someone please explain? –  Mythril May 3 '12 at 3:11
add comment

closed as not constructive by Shane Madden, Bryan, Tim Brigham, Ladadadada, Wesley May 2 '12 at 22:52

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

4 Answers

up vote 2 down vote accepted

You could look at running Nessus or OpenVAS from outside your network. This is about what the ASV scans do. From the alerts raised on my monitoring systems there are few differences between my OpenVAS scans and the scans performed by our vendor.

share|improve this answer
add comment

Managed Engines Security Manager Plus can do this. However like most things in life, it's not free

share|improve this answer
add comment

You can perform PCI scans with quite a few tools. Even though these will not be "official", due to an official PCI scan having to be done by an ASV (approved scanning vendor). A few of the more popular tools that you have probably heard of and are very easy to work with are Saint and Nessus. They both have PCI specific scans and will show you if a vulnerability will pass or fail. Since not every vulnerability is significant enough to to fail you.

share|improve this answer
add comment

Unfortunately it's a little more than one single test. For PCI scans you have to combine a lot of different tools, tests and scenarios. Even if you can use for every test an open source tool I'm pretty sure after finishing your test run you won't give it away for free.

Anyway you can browse this list of different vendors providing tools or services regarding the PCI certification.

I'm deeply contented with Qualys. They also provide some free or trial checks.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.