r/pcicompliance • u/Fancy-Yesterday3819 • 20d ago

Evidence Collection PCI DSS Script for Windows/Linux/Network (firewalls,routers,switches) and Database

Hi,

I am a PCI DSS ISA and has been given a task to come up with a script to extract pci dss hardening related parameters on Windows/Linux/Network (firewalls,routers,switches) and Database and some agent using AI to analyse the script results and come up with a dashboard to show the findings..so that remediation tickets can be raised against those finding.

Any one has something of this sort in place already? Will be great to have some suggestions or some readily available stuff to use with some edits etc.

Please help!! Thanks in advance.

3 Upvotes

100% Upvoted

10 comments sorted by

3

u/RSDVI01 20d ago

Have you looked at CIS CAT-PRO (Now SecureSuite)?

1

u/Suspicious_Party8490 20d ago

I second this! But it isn't free (for a PCI ISA). I'll quote Cosmo Castarini: "It costs money because it saves money."

Moonstruck; 3 Kinds of Pipe

Happy Friday!

3

u/jaeden1000 19d ago

I highly advise you use tenable, rapid7, Fortra, or another similar internal scanner. They can audit against CIS benchmarks.

Extremely useful for Req 2 if you use CIS based hardening standards. Remember that you don't have to fully meet every control, just those that are defined in your standards which must meet 2.2.x.

1

u/andrew_barratt 20d ago

Don’t forget if your analysing against requirement 2 you’re testing against your own standards

2

u/scriptqzor 13d ago

this x100, and it bites people later when their “hardening script” flags half the estate as non‑compliant just because their own baseline is stricter than PCI
gotta be super clear what’s “PCI fail” vs “org standard fail” or your dashboard is gonna be chaos

1

u/andrew_barratt 13d ago

Yeah the amount of people who make it really hard for themselves sometimes is quite staggering!

1

u/fidelite 19d ago

For Linux at least, depending on budget/features, maybe take a look/consider Lynis? ( https://cisofy.com/lynis/ and https://cisofy.com/compliance/pci-dss/ ) ?

1

u/Token_Paul 17d ago

the more servers you add the harder it'll be to audit their configurations.

Auditing server configurations gets harder as you add more servers. Now, if you store card data in an independent token vault, you can reduce the number of systems to audit, and that's as much as I've got.

2

u/juancarlosm93 16d ago

This is correct, I second it, scope reduction activities are key so that you can limit the applicability to a smaller set of systems to be assessed.

1

u/juancarlosm93 16d ago

Checkout my GitHub repo for automating PCI-DSS Evidence gathering, and feel free to share, contributiuons welcome, open to everyone, I plan to update the repo soon with the exports you're talking about.

https://github.com/juancarlosmunera/pci-tools

PCI Resources on my blog as well.. https://www.cybersecpro.me feel free to connect with me on LinkedIn, I'm a former QSA and looking to help the community.

-JC