User's Guide

Reports
245
WPA2 should be used wherever possible. This report provides a list of wireless access points
using default SSID or security configurations.
3. Requirement 2.2: Develop configuration standards of all system components (including any
wireless access points and clients).It also requires the institution to assure that these standards
address all known security vulnerabilities and are consistent with industry-accepted system
hardening procedures. This report provides a list of wireless access points and clients whose
current configuration is vulnerable vis-a-vis newly discovered and known vulnerabilities.
4. Requirement 4.1.1: Verify that wireless networks transmitting cardholder data use appropriate
encryption methods. Reliance on WEP (Wired Equivalent Privacy) for cardholder data protection
should be avoided. This report provides a list of wireless access points and clients communicating
using open or insecure encryption methods.
5. Requirement 6.2: Establishing a process to identify newly discovered vulnerabilities and
updating configuration standards to address the new vulnerability issues. Generate and review
contents of this report periodically so that newly discovered vulnerabilities can be identified and
acted upon.
6. Requirement 10.5.4: Copy logs for wireless networks onto a centralized internal log server or
media that is difficult to alter. The report generation engine maintains logs of all wireless activity for
archival purposes.
7. Requirement 11.1: Use a wireless analyzer at least quarterly to identify all wireless devices in
use. This report provides a list of all wireless devices in use. In addition, scanners continuously
monitor all wireless devices in use and automatically update the list of wireless devices maintained
at the server.
8. Requirement 11.2: Run network vulnerability scans quarterly and after any significant change in
the network. This report provides a list of wireless vulnerabilities discovered during the report
generation interval. This report can be generated on demand or at scheduled intervals.
9. Requirement 11.4: Use of network intrusion detection and prevention system to monitor network
traffic and alert personnel of suspected compromises. Intrusions can also happen through
wireless. Wireless scanners continuously monitor, log and (optionally) alert and block wireless
intrusion attempts.
10. Requirement 12.9: Implement an incident response plan. Be prepared to respond immediately
to a system breach (including those happening through wireless back doors). Wireless scanners
monitor airwaves 24/7 and instantly detect for any unauthorized wireless activity. Incident response
can be done either manually or automatically using wireless scanners.
Since wireless environments change dynamically, it is recommended that you conduct a PCI
wireless vulnerability assessment at least once every 15 days. Archive the PCI Wireless
Compliance reports. Establish an ongoing wireless security program to fix top vulnerabilities and to
minimize your wireless security exposure.
The sections of this report list the wireless vulnerabilities detected in your network and the severity
of security risk caused by these vulnerabilities.
• PCI DSS 1.1 Wireless Compliance Report - Payment Card Industry Data Security Standard
(PCI DSS) Version 1.1, published in September 2006, defines recommended security controls for
protecting cardholder data. PCI DSS was defined by a consortium of credit card companies,
including VISA and Master Card. The requirements of the PCI standard apply to all members,
merchants and service providers that store, process and transmit cardholder data. The following
sections from PCI DSS, Version 1.1 are relevant from the perspective of protecting cardholder
data from unauthorized wireless access. This report is intended to be simply an aide to review
PCI DSS 1.1 compliance of WLAN deployments. It is not meant to automatically fulfill PCI DSS
1.1 requirements related to your WLAN network. Consult a PCI Qualified Security Auditor (QSA)
for obtaining compliance certification.
1. Requirement 1.2: Deny traffic from 'untrusted' networks and hosts, except for protocols
necessary in the cardholder's data environment. This report provides a list of rogue or
misconfigured wireless access points detected during the report interval. Unauthorized cardholder
data access is possible through these access points.
2. Requirement 2.1.1: Change vendor-supplied defaults for wireless equipment. For wireless
equipment, default password, SSID, WEP key and security settings should be changed. WPA and