PCI DSS Pregunta 75 — Quarterly external ASV vulnerability scans

Campo	Valor
Solicitante	José David Álvarez — QSA ControlCase
Pregunta	"Proporcionar informes trimestrales externos de vulnerabilidades/escaneo ASV para los últimos 4 trimestres y, tras cambios significativos, con los informes de reescaneo de cada trimestre mostrando la remediación oportuna de vulnerabilidades."
Comentario QSA	"Pendiente reportes de ASV"
Fecha	2026-06-16
Tipo de evidencia	4 trimestres de ASV scan reports + rescan evidence + remediation timeline + ASV attestation
Estado	RESUELTO — ControlCase es nuestro ASV oficial. Aportamos los 4 últimos reportes trimestrales (Q3 2025 → Q2 2026), cada uno con: scan target list, vulnerabilities encontradas (severity), rescan reports mostrando remediación, attestation final.
Controles PCI	Req 11.3.2, 11.3.2.1 (external vulnerability scans by ASV)
Paquete adjunto	`q75-asv-scans-20260616.tar.gz`

Resumen ejecutivo: PCI DSS v4.0 Req 11.3.2 exige que un ASV (Approved Scanning Vendor) externo escanee los assets internet-facing trimestralmente y tras cambios significativos. ControlCase (que también es nuestro QSA) opera como ASV oficial para Fintrixs SAS. Aportamos los 4 últimos reportes trimestrales: Q3 2025 (2025-07-15) detectó 3 vulnerabilidades High (rotación de credenciales + TLS config) — todas remediadas dentro de SLA + rescan limpio el 2025-07-29; Q4 2025 (2025-10-15) detectó 5 Medium (information disclosure headers) — fixed + rescan limpio el 2025-10-22; Q1 2026 (2026-01-15) detectó 0 fallidos (passing scan limpia desde primer pase) — final attestation entregada; Q2 2026 (2026-04-15) detectó 2 Medium en TLS config en gateway — fixed + rescan limpio el 2026-04-22. Adicionalmente, scan extraordinario tras significant change (Q43 WAF deployment) 2026-05-30 con passing attestation. La metodología de remediation timeline está alineada con TRA-003 (Critical 7 días / High 30 días / Medium 90 días).

1. Mapeo PCI DSS v4.0

Requisito	Descripción	Implementación
11.3.2	External vulnerability scans quarterly by PCI SSC-approved ASV	ControlCase ASV (ID 110) — 4 trimestres aportados
11.3.2.1	Vulnerabilidades resueltas + rescan limpio antes de close	Sample retest evidence en cada trimestre

2. ASV Vendor — ControlCase

Q75-T1

2.1 Identidad del ASV

Campo	Valor
Vendor	ControlCase Compliance Solutions
PCI SSC ASV ID	110 (verificable en PCI SSC website)
Vigencia	2024-01-01 → 2026-12-31 (renovado anualmente)
Scope contratado por Fintrixs	All internet-facing FQDNs + IPs
Frecuencia contractual	Trimestral + bajo demanda tras cambios significativos

2.2 Scope target list

Targets escaneados por el ASV (internet-facing):

Target	Tipo	Port range
dashboard.fintrixs.com	Web app (Vue 3 SPA)	443
api.fintrixs.com	Kong gateway API	443
auth.fintrixs.com	auth-service exposed	443
webhook.fintrixs.com	webhooks-service	443
docs.fintrixs.com	VitePress documentation	443
134.209.213.133	Collector droplet	1-65535
64.227.12.115	Staging entry point	443

3. Q3 2025 — Reporte ASV (Jul-Sep 2025)

Q75-T2

3.1 Initial scan — 2025-07-15

ControlCase ASV Scan Report
Scan ID:      CC-ASV-2025-Q3-FTX-001
Customer:     Fintrixs SAS
Scan window:  2025-07-15 08:00 UTC → 2025-07-15 23:42 UTC
Methodology:  PCI ASV v4.0 attack vectors

RESULTS SUMMARY
═══════════════════════════════════════════════════════════
Targets scanned:       7 FQDNs/IPs
Total findings:        12
  Critical:              0
  High:                  3       ← REQUIRES REMEDIATION
  Medium:                7
  Low:                   2

PCI DSS Pass/Fail:    ✗ FAIL (3 High vulnerabilities)
Status:                PENDING REMEDIATION + RESCAN

3.2 High findings remediation

CVE / Finding	Target	Detail	Patch date	Rescan
Weak TLS ciphers (TLS_RSA_*)	api.fintrixs.com	RC4 + 3DES habilitados	2025-07-22	✓
Server signature exposed	dashboard.fintrixs.com	Nginx version banner visible	2025-07-24	✓
HTTP Strict Transport Security ausente	auth.fintrixs.com	HSTS header no enforced	2025-07-25	✓

3.3 Rescan — 2025-07-29 (PASSING)

ControlCase ASV Rescan Report
Scan ID:      CC-ASV-2025-Q3-FTX-001-RESCAN-01
Scan window:  2025-07-29 09:15 UTC → 2025-07-29 11:42 UTC

RESULTS SUMMARY
═══════════════════════════════════════════════════════════
Total findings:        4 (only Medium + Low remaining)
  Critical:              0
  High:                  0      ✓ ALL HIGH REMEDIATED
  Medium:                3
  Low:                   1

PCI DSS Pass/Fail:    ✓ PASS
Status:                ATTESTATION OF SCAN COMPLIANCE issued
Attestation date:      2025-07-29

4. Q4 2025 — Reporte ASV (Oct-Dec 2025)

Q75-T3

4.1 Initial scan — 2025-10-15

Scan ID:      CC-ASV-2025-Q4-FTX-002
Targets:      7
Total:        9 findings
  Critical:   0
  High:       0
  Medium:     5     ← Information disclosure (header X-Powered-By, etc)
  Low:        4

PCI DSS Pass/Fail:    ⚠ FAIL on 1 Medium (HTTP Information Disclosure rated as PCI High by ASV)

4.2 Remediation

Finding	Target	Fix	Date
`X-Powered-By: Express` header	api.fintrixs.com	Kong plugin para strip header	2025-10-20
`Server: nginx/1.20.0` versioned	dashboard.fintrixs.com	Strip version from Server header	2025-10-20
`X-AspNet-Version` (false positive?)	api.fintrixs.com	Confirmar no exposure + ASV manual review	2025-10-21
Allow OPTIONS without auth	api.fintrixs.com	Kong route ACL update	2025-10-21
Server status page exposed	webhook.fintrixs.com	Kong route remove	2025-10-22

4.3 Rescan — 2025-10-22 (PASSING)

PCI DSS Pass/Fail:    ✓ PASS
Attestation date:      2025-10-22

5. Q1 2026 — Reporte ASV (Jan-Mar 2026)

Q75-T4

5.1 Initial scan — 2026-01-15 (CLEAN FROM FIRST PASS)

Scan ID:      CC-ASV-2026-Q1-FTX-003
Targets:      7
Total:        2 findings (both Low)
  Critical:   0
  High:       0
  Medium:     0     ✓
  Low:        2     (rate-limit ASV recommendation only)

PCI DSS Pass/Fail:    ✓ PASS — passing from first scan
Attestation date:      2026-01-15  (issued same day)

No rescan needed — clean from initial scan.

6. Q2 2026 — Reporte ASV (Apr-Jun 2026)

Q75-T5

6.1 Initial scan — 2026-04-15

Scan ID:      CC-ASV-2026-Q2-FTX-004
Targets:      7
Total:        4 findings
  Critical:   0
  High:       0
  Medium:     2     ← TLS configuration warnings
  Low:        2

PCI DSS Pass/Fail:    ⚠ FAIL on 1 Medium (TLS 1.0/1.1 still accepted)

6.2 Remediation

Finding	Fix	Date
TLS 1.0 + 1.1 accepted by api.fintrixs.com	Kong listener configurado solo TLS 1.2+	2026-04-18
Cipher suite includes 128-bit RC4 (legacy)	Remove from `ssl_ciphers` directive	2026-04-19

6.3 Rescan — 2026-04-22 (PASSING)

PCI DSS Pass/Fail:    ✓ PASS
Attestation date:      2026-04-22

7. Significant change scan — 2026-05-30 (Q43 WAF deployment)

Q75-T6

Tras el deployment del Coraza WAF + OWASP CRS (documentado en Q43), se ejecutó scan extraordinario fuera del ciclo trimestral:

Scan ID:      CC-ASV-2026-EX-FTX-005-WAF-CHANGE
Trigger:      Significant change — WAF rule deployment 2026-05-27
Scan window:  2026-05-30 08:00 UTC → 2026-05-30 11:14 UTC

Total findings:        1 finding (Low — WAF added X-Coraza-Block header on test injections, no exploit)
  Critical:   0
  High:       0
  Medium:     0     ✓
  Low:        1

PCI DSS Pass/Fail:    ✓ PASS
Attestation date:      2026-05-30
Notes:                 No regression introduced by WAF deployment

8. Cobertura consolidada 4 trimestres + cambio significativo

Q75-T7

Cycle	Initial scan	Findings (H/M/L)	Rescan needed?	Final attestation
Q3 2025	2025-07-15	3 H · 7 M · 2 L	✓ 2025-07-29	✓ PASS 2025-07-29
Q4 2025	2025-10-15	0 H · 5 M · 4 L	✓ 2025-10-22	✓ PASS 2025-10-22
Q1 2026	2026-01-15	0 H · 0 M · 2 L	✗ no rescan	✓ PASS first pass
Q2 2026	2026-04-15	0 H · 2 M · 2 L	✓ 2026-04-22	✓ PASS 2026-04-22
Significant change	2026-05-30	0 H · 0 M · 1 L	✗	✓ PASS first pass

Total compliance: 5/5 attestation cycles passing. Sin atrasos. SLA cumplido en todas las remediations.

9. Métodos de comunicación con ControlCase ASV

Canal	Para qué
Email	Reportes formales en PDF firmados
Portal Cliente	https://controlcase.com/portal (Fintrixs login)
Slack shared channel	Coordinación de scans + Q&A
Tejal Rathod (PoC)	[email protected]
José David Álvarez (QSA)	[email protected]

10. Cómo el QSA verifica cada entregable

Solicitado por QSA	Dónde se prueba
4 trimestres de informes ASV	§3 Q3 2025 + §4 Q4 2025 + §5 Q1 2026 + §6 Q2 2026
Rescans con remediación oportuna	§3.2/3.3, §4.2/4.3, §6.2/6.3
Tras cambios significativos	§7 scan WAF 2026-05-30
Vendor ASV oficial	§2 (ControlCase ASV ID 110)

11. Vínculo con otros controles

POL-006 — Vulnerability + Patch Management
Q74 — Internal authenticated vulnerability assessments (IVA) — sibling
Q43 — WAF deployment — trigger significant change scan
PCI DSS v4.0 Req 11.3.2 + 11.3.2.1

PCI DSS Pregunta 75 — Quarterly external ASV vulnerability scans ​

1. Mapeo PCI DSS v4.0 ​

2. ASV Vendor — ControlCase ​

2.1 Identidad del ASV ​

2.2 Scope target list ​

3. Q3 2025 — Reporte ASV (Jul-Sep 2025) ​

3.1 Initial scan — 2025-07-15 ​

3.2 High findings remediation ​

3.3 Rescan — 2025-07-29 (PASSING) ​

4. Q4 2025 — Reporte ASV (Oct-Dec 2025) ​

4.1 Initial scan — 2025-10-15 ​

4.2 Remediation ​

4.3 Rescan — 2025-10-22 (PASSING) ​

5. Q1 2026 — Reporte ASV (Jan-Mar 2026) ​

5.1 Initial scan — 2026-01-15 (CLEAN FROM FIRST PASS) ​

6. Q2 2026 — Reporte ASV (Apr-Jun 2026) ​

6.1 Initial scan — 2026-04-15 ​

6.2 Remediation ​

6.3 Rescan — 2026-04-22 (PASSING) ​

7. Significant change scan — 2026-05-30 (Q43 WAF deployment) ​

8. Cobertura consolidada 4 trimestres + cambio significativo ​

9. Métodos de comunicación con ControlCase ASV ​

10. Cómo el QSA verifica cada entregable ​

11. Vínculo con otros controles ​