topic Re: PCI-DSS 12.3.3 in Industry News

PCI-DSS 12.3.3

Gerardojr83 — Mon, 04 Nov 2024 21:10:57 GMT

I'm having trouble finding a good solution that would be needed for one of the new PCI 4.0 controls:

12.3.3 Cryptographic cipher suites and protocols in use
are documented and reviewed.

What is a good tool to scan for cryptographic ciphers and protocols within an environment? I believe NMAP (Zenmap for Windows) could work but the test scans I've performed do not give accurate results as I can see vulnerability scanning tools pick up other ciphers and protocols that NMAP does not. '

Any help or advice is much appreciated.

Re: PCI-DSS 12.3.3

Caute_cautim — Tue, 05 Nov 2024 20:33:43 GMT

@Gerardojr83 Given there is a multitude of tools for Quantum Safe, here are some suggestions:

https://www.ibm.com/quantum/blog/crypto-agility

https://owasp.org/blog/2023/10/03/CycloneDX-Cryptography-CBOM

https://owasp.org/www-project-cyclonedx/

There are many others available.

These generally allow you to create a Cryptographic Bill of Materials or CBOM.

Other tools such as Kali, Nessus etc, but obvious get permission before you use such tools on organisations networks etc.

Regards

Caute_Cautim