PCI external vulnerability scan¶
We use qualys PCI scanner for running automated scans.
https://pci.qualys.com/merchant/login.php
We get the reportattested from qualys every two months and upload them to google drive EVS folder
We run a scheduled scan where we scan following IPs
1) Main backend nginx IP
2) AKS cluster outgoing IP
3) Web public IP
Istio Ingress public IP
We do not scan Istio ingress IP since the Qualys scanner fails with an error "scan interference". This Ip does not carry any cde data. My understanding is that we have decided to remove istio ingress gateway in any case.
WARP Zero trust
I Managed to get some documentation from cloudflare support today.
from the above documentation seems like WARP reaches out to 162.159.193.0/24. So maybe we should scan one of its IP. I have started the scan on 162.159.193.0, will wait for results.