Details of the Inquiry
Our company obtained PCI-DSS certification this year and, under its requirements, undergoes a penetration test every year.
The penetration-test results reported an HTTPS TLS/SSL Cipher Suite vulnerability on the web server.
When we check the actual status of the target web listener, the vulnerability does not appear to be present. The target in the penetration-test report is correct.
From what you described, this appears to be the result of an external penetration test conducted from an external network.
The assessor is located on an external network and tests the target system from an outsider’s perspective, so this is judged to be an external penetration test, or External Penetration Test.
What technical elements (systems) exist between this assessor (located on the external network) and the target website?
It depends on the infrastructure of the company or organization, but in general the following technical elements are present.
[| Assessor |] - (Internet) ——– inside the organization from here- (router)-(switch)-(web firewall)- [|target website listener|]
If so, in the layout above, which listener’s vulnerability is the HTTPS TLS/SSL Cipher Suite vulnerability that the assessor actually reported through a scan or similar test?
A web application firewall (WAF) is usually placed in front of the web server in an in-line arrangement. If the layout has no web application firewall, the report above would be correct.
If the layout does include a web application firewall, it is more accurate to treat the report as a vulnerability in the web listener of the web application firewall.
What you should do, then, is check whether that vulnerability exists on the web listener of the web application firewall.
There are several ways to check an HTTPS TLS/SSL Cipher Suite vulnerability. Some study of the basics of TLS/SSL cipher suites will be needed.
– Scanning with nmap ssl* scripts
– Checking with the openssl command
– Checking with the Python program sslyze.py