Solved

PCI Compliance Certification and FortiManager

Posted on 2014-11-20
1
177 Views
Last Modified: 2015-02-05
My company is in the final stages of acquiring a PCI Compliance certification.  We're one scanned tested away from obtaining this however the scans that are failing has traffic being directed to a FortiManager appliance.  The appliance is a VM, running on a Gen8 HP BL460 blade server with ESXi 5.0 as the Hypervisor.  Per Fortinet, the ports that are required to run are 22, 443, 6022, 6023, 53, 123, 514, 541, and 161.  Initially we had a full PAT from our external IP address to the internal IP address and so the vulnerability scan was picking up other vulnerabilities.  I setup firewall objects for each port and rewrote the policy to pass traffic on those ports only.  The scan comes back and and says that we're still failing on 22 and 443, which are secure, right?  Our FortiManager appliance is running at 5.0.6 currently.  There ARE newer versions of firmware which I'm not going to ignore as an option, but I want to be certain this is going to resolve my issue before spending the time to update the appliance.  Fortinet's technical support hasn't been much help, ironically, although I suspect the issue their is a matter of customer service, not intelligence.

Has anyone had to deal with PCI compliance and Fortinet Appliances?  Can someone tell me that fix for this is just to upgrade the appliance's firmware?  Any help would be appreciated.
0
Comment
Question by:Josef Al-Chacar
1 Comment
 
LVL 61

Accepted Solution

by:
btan earned 500 total points
ID: 40457181
You need to see the error in specific to 22 and 443. The port does not mean secure and compliant, my take on possible area
a) clear traffic still go through like any other port though it should be implementing proper key exchange and encryption or even the expected protocol services
b) use of weak crypto cipher in 22 and 443
c) unpatched or vulnerable services in 22 and 443
d) trigger signature of exploits existence or matched in scanner db
e) false positive
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

It’s 2016. Password authentication should be dead — or at least close to dying. But, unfortunately, it has not traversed Quagga stage yet. Using password authentication is like laundering hotel guest linens with a washboard — it’s Passé.
Phishing is at the top of most security top 10 efforts you should be pursuing in 2016 and beyond. If you don't have phishing incorporated into your Security Awareness Program yet, now is the time. Phishers, and the scams they use, are only going to …
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now