Failed IP scan

Smokey Deza · 4 Nov 2015 at 16:10

Hi,

I'm trying to help someone who runs a business. Basically another company called Security Metrics is trying to scan said business to make sure they are PCI compliant, I. E data protection when taking credit/debit cards. But when they attempt to scan, it fails.

Security Metrics then emailed the ISP of the business they are trying to scan with a screen dump asking them to disable TLS1.0 port 8729 or close it. Said ISP then forwards this information to aforementioned business asking if the router they're referring to is ours or theirs?

Any ideas or direction with this? Much appreciated thank you.

Felon · 4 Nov 2015 at 16:18

Normally it's not the responsibility of an ISP to filter any traffic at all, unless they're providing some sort of managed service (where they manage the customer's router or firewall) if it is a managed service then the ISP could block the ports - if it's an unmanaged service, then it'll be the responsibility of the business in question to make sure the correct security is in place.

tribz · 4 Nov 2015 at 16:44

What does it actually fail on? In our business, Security Metrics scans our website and also our file server which runs IIS/OWA/RDGW's etc but they are two seperate systems with the website being hosted externally by our webhosts and the fileserver onsite. Either one can fail a test.

Looking at the scan results and seeing which system is failing will point you in the right direction of what needs looking at.

Steveocee · 4 Nov 2015 at 17:04

The ISP don't know if they provide a managed service or not and they don't know who the router belongs to?

You need a new ISP.

Toughnoodle · 4 Nov 2015 at 17:19

You could do with logging into the Security Metrics website to get a copy of the full report. Then, you need to find out what's running on port 8729 (e.g. remote admin or something port forwarded?). Usually if it's a full OS (e.g. Windows or Linux) you can disable weak protocols without affecting functionality.

Are you having to deal with the questionnaire side too?

Smokey Deza · 4 Nov 2015 at 18:03

Thanks for the info so far.

The scan is being run on a virtual terminal instead of a PDQ machine (I'm not familiar with that term, PDQ).

There isn't much info on the screenshot other that CVS 5.00 FAIL Port 8729.