Q: My Trustwave scans are failing, what do I do?

• I received an email with the subject: "Action Required - TrustKeeper PCI Manager Scan Completed." In the body of the email it says "SCAN STATUS: FAILING"
• My Trustwave scans always came back fine before, what's wrong?

Context

• This only applies to MIT Merchants who are accepting credit card payments on Virtual Terminals
• Due to a change to the PCI standard Trustwave will fail a scan where the IP is unreachable.
• The Merchant must dispute the finding and provide evidence that the IP is blocked by design and not by any "active defense measures"
• Unfortunately, this must be done every 90 days

Answer

• Log in to the Trustwave SecureTrust portal
• Click on "Scanning"
• Select any vulnerabilities that say "Host(s) not detected"
• Click "Dispute finding"
  • In the subject, enter: "These IPs are hidden by design"
  • In the text box, enter: "These IPs are hidden by design. Trustwave's scanners are allow listed in our environment, and we have no active protection systems blocking them. MIT confirms that properly configured internal network firewalls/routers and/or strong Access Control Lists (ACLs) block traffic from all source addresses to the undetected target(s), as mandated by our organizational security policy."
• Usually the disputes are approved quickly. Sometimes Trustwave will ask for more information and repeating the statement above satisfies them.
• If you have any trouble, please contact security@mit.edu
• If you need help with your Trustwave Trustkeeper portal account, please contact VPF's Merchant Services at chargemit-help@mit.edu