PCI-DSS v4.0.1
34 rules checking Payment Card Industry Data Security Standard v4.0.1 compliance, covering network segmentation, insecure protocols, service exposure, and documentation requirements.
| Rule ID | Severity | PCI Reference | Category | Summary |
|---|---|---|---|---|
| PCI-NET-001 | CRITICAL | 1.3.1, 1.3.2 | Default-Deny / Overly Permissive | Any source + all ports |
| PCI-NET-002 | HIGH | 1.3.2 | Default-Deny / Overly Permissive | Unrestricted outbound from internal network |
| PCI-NET-003 | CRITICAL | 1.2.1, 1.3.1 | Default-Deny / Overly Permissive | Overly broad source or destination address |
| PCI-NET-004 | HIGH | 1.2.1, 2.2.4 | Default-Deny / Overly Permissive | Wide port range exceeds 20 ports |
| PCI-NET-005 | HIGH | 1.2.1, 2.2.4 | Default-Deny / Overly Permissive | Protocol ANY permits all protocols |
| PCI-NET-010 | CRITICAL | 2.2.4, 4.2.1 | Insecure Protocols | FTP transmits credentials in plaintext |
| PCI-NET-011 | CRITICAL | 2.2.4, 4.2.1 | Insecure Protocols | Telnet transmits all data in plaintext |
| PCI-NET-012 | HIGH | 4.2.1 | Insecure Protocols | HTTP unencrypted traffic |
| PCI-NET-013 | HIGH | 2.2.4, 4.2.1 | Insecure Protocols | POP3/IMAP transmit credentials in plaintext |
| PCI-NET-014 | HIGH | 2.2.4 | Insecure Protocols | SNMP v1/v2c community strings in plaintext |
| PCI-NET-015 | HIGH | 2.2.4, 4.2.1 | Insecure Protocols | LDAP plaintext directory queries |
| PCI-NET-016 | MEDIUM | 2.2.4, 4.2.1 | Insecure Protocols | SMTP plaintext may transmit cardholder data |
| PCI-NET-017 | MEDIUM | 2.2.4, 2.2.5 | Insecure Protocols | Syslog over UDP unencrypted |
| PCI-NET-018 | HIGH | 2.2.4 | Insecure Protocols | TFTP no authentication or encryption |
| PCI-NET-019 | CRITICAL | 2.2.4 | Insecure Protocols | r-services plaintext trust-based authentication |
| PCI-NET-030 | MEDIUM | 1.3.1, 1.3.2, 11.5.1 | Tunneling & Exfiltration | SSH tunneling risk from broad/public source |
| PCI-NET-031 | HIGH | 1.3.1, 1.3.2, 11.5.1 | Tunneling & Exfiltration | VPN tunneling prevents IDS/IPS inspection |
| PCI-NET-032 | INFO | 11.5.1 | Tunneling & Exfiltration | Outbound HTTPS inspection blind spot |
| PCI-NET-033 | MEDIUM | 1.3.2, 11.5.1 | Tunneling & Exfiltration | DNS as covert channel for data exfiltration |
| PCI-NET-040 | CRITICAL | 1.3.1, 1.4.1 | Network Segmentation | Direct internet-to-internal bypasses DMZ |
| PCI-NET-042 | HIGH | 1.3.2 | Network Segmentation | Unrestricted outbound internet from internal |
| PCI-NET-050 | HIGH | 1.3.1, 1.3.2 | Database & Service Exposure | Database ports exposed to broad/public source |
| PCI-NET-051 | CRITICAL | 1.3.1, 8.4.2 | Remote Access Exposure | RDP exposed to internet |
| PCI-NET-052 | CRITICAL | 1.3.1, 1.3.2 | Ransomware & Lateral Movement | SMB ransomware propagation vector |
| PCI-NET-053 | HIGH | 2.2.4 | Legacy Service Exposure | NetBIOS service ports permitted |
| PCI-NET-054 | CRITICAL | 1.3.1, 2.2.4 | Container & Orchestration Exposure | Docker API accessible |
| PCI-NET-055 | CRITICAL | 1.3.1, 2.2.4 | Container & Orchestration Exposure | Kubernetes API/Kubelet accessible |
| PCI-NET-056 | CRITICAL | 1.3.1, 2.2.4 | ICS/SCADA Isolation | ICS/SCADA protocols lack authentication |
| PCI-NET-057 | CRITICAL | 1.3.1, 2.2.4 | Out-of-Band Management | IPMI/BMC hardware control exposed |
| PCI-NET-060 | HIGH | 8.4.2 | Remote Access Exposure | Remote management reachable from internet/any (MFA required) |
| PCI-NET-061 | HIGH | 1.3.1, 2.2.4, 4.2.1 | Remote Access Exposure | VNC unencrypted with weak authentication |
| PCI-NET-062 | HIGH | 2.2.4, 4.2.1 | Remote Access Exposure | WinRM HTTP unencrypted commands |
| PCI-NET-070 | MEDIUM | 1.2.5 | Rule Documentation | No application name or business justification |
| PCI-NET-091 | MEDIUM | 1.3.1 | Anti-Spoofing & ICMP Control | ICMP Redirect exploitable for MITM attacks |
The Severity column, like the Rules tab, shows the worst-case severity a rule can emit. Some rules emit a lower severity in less exposed cases:
- PCI-NET-003 is CRITICAL for
anyor a /16-or-wider source or destination, and HIGH for a /17 to /20. - PCI-NET-010 (FTP) is CRITICAL when either side is public or
any, and HIGH otherwise. - PCI-NET-031 (VPN ports) is HIGH when PPTP (TCP 1723) is included, and MEDIUM otherwise.
PCI-NET-060 says MFA is required for remote management reachable from the internet or any. netbobr cannot see whether MFA is in place, so treat the finding as a reminder to verify it.
ICMP flows
ICMP has no ports, so an ICMP flow never triggers the port-breadth rules PCI-NET-001, PCI-NET-002 or PCI-NET-004. The address rules (such as PCI-NET-003) still apply.
PCI-NET-091 fires when the ICMP type selection includes Redirect (Type 5). An all or blank ICMP type field selects every known ICMP type, so it fires PCI-NET-091 too.