Terug naar Beveiliging en compliance
  • Normenkader
  • Automatisch gemeten

PCI DSS

PCI DSS is de beveiligingsstandaard voor betaalgegevens, uitgevaardigd door de PCI Security Standards Council, de gezamenlijke organisatie van de grote kaartnetwerken. Versie 4.0.1 is sinds 31 maart 2025 volledig verplicht, nu de overgangsperiode is afgelopen. De standaard geldt voor elk systeem dat kaarthoudergegevens opslaat, verwerkt of doorgeeft, waardoor ook contactcenters waar betalingen telefonisch worden aangenomen binnen het toepassingsgebied vallen.

100%

374 / 374 controles conform bij de automatische beoordeling

Laatste synchronisatie: · Aikido Security

Het auditrapport aanvragen

Gemeten controles

De namen van beoordelingen, typen en controles zijn die van de oorspronkelijke normenkaders en staan daarom in het Engels. De teller is het aantal controles dat ons platform voor continue monitoring, Aikido Security, als voldaan rapporteert, van alle controles die het voor dit normenkader beoordeelt. Ze staan hieronder allemaal een voor een vermeld.

Applies the least privilege principle for cloud resource

ControleStatus
Access Approval is enabled for the projectconform
AKS local admin account is still enabledconform
Compute instances have OS Login enabledconform
Dangerous Impersonate permission given to ServiceAccount or nodeconform
GKE clusters have the Kubernetes Dashboard disabledconform
Kubernetes pods are isolatedconform
No instance uses the default service accountconform
No user has both the Service Account User and Service Account Admin roleconform
Project-wide SSH keys are blockedconform
Service accounts have strict access permissionsconform
ServiceAccount or node can read all secretsconform
VM instances have strict access permissionsconform

Prevents unauthorized access via ssh

ControleStatus
AWS EKS Node groups have implicit SSH access from any IPconform
Firewall rule prevents RDP access from anywhereconform
Firewall rule prevents SSH access from anywhereconform
Firewall rules allow RDP access from any public IPconform
Firewall rules allow SSH from any public IPconform
Firewall rules allow SSH from any public IPconform
Firewall rules allow unrestricted SSH accessconform

Prevents unauthorized public access to database

ControleStatus
BigQuery table is anonymously or publicly accessibleconform
SQL instance root user has strict access permissionsconform
SQL instances do not have a public IP assignedconform
SQL instances have strict access permissionconform

Prevents unauthorized public access to file storage

ControleStatus
Azure Storage Account allow public accessconform
Azure Storage blobs do not restrict public access for nested itemsconform
S3 bucket grants public access to all contentsconform
S3 Buckets should have block public access globallyconform
Storage Buckets have proper access rulesconform
Storage buckets have public access prevention enabledconform

Prevents unauthorized public access to networks and instances

ControleStatus
Access to BigQuery datasets are restrictedconform
AKS API server does not limit access by IP rangesconform
Amazon EKS Clusters public endpoints should not allow traffic from any IPconform
Azure Cognitive Services allows unrestricted public network accessconform
Compute instances do not have public IP addressesconform
Firewall rule prevents Docker API access from anywhereconform
Firewall rules allow unrestricted RDP accessconform
Firewall rules do not allow unrestricted ingress to all ports and protocolsconform
Firewall rules restrict public ingress to port 11214conform
Firewall rules restrict public ingress to port 11215conform
Firewall rules restrict public ingress to port 135conform
Firewall rules restrict public ingress to port 137conform
Firewall rules restrict public ingress to port 138conform
Firewall rules restrict public ingress to port 139conform
Firewall rules restrict public ingress to port 1433conform
Firewall rules restrict public ingress to port 1434conform
Firewall rules restrict public ingress to port 23conform
Firewall rules restrict public ingress to port 2379conform
Firewall rules restrict public ingress to port 2383conform
Firewall rules restrict public ingress to port 2484conform
Firewall rules restrict public ingress to port 27017conform
Firewall rules restrict public ingress to port 27018conform
Firewall rules restrict public ingress to port 27019conform
Firewall rules restrict public ingress to port 3000conform
Firewall rules restrict public ingress to port 3020conform
Firewall rules restrict public ingress to port 3306conform
Firewall rules restrict public ingress to port 389conform
Firewall rules restrict public ingress to port 4505conform
Firewall rules restrict public ingress to port 4506conform
Firewall rules restrict public ingress to port 5500conform
Firewall rules restrict public ingress to port 5800conform
Firewall rules restrict public ingress to port 61621conform
Firewall rules restrict public ingress to port 636conform
Firewall rules restrict public ingress to port 7001conform
Firewall rules restrict public ingress to port 8000conform
Firewall rules restrict public ingress to port 9200conform
Firewall rules restrict public ingress to port 9300conform
Kubernetes master endpoint is not publicly availableconform
No firewall rule allows access to Open Telemtry metrics endpoint from the internetconform
No firewall rule allows access to port 1720 from the internetconform
No firewall rule allows cPanel access from the internetconform
No firewall rule allows etcd access from the internetconform
No firewall rule allows MongoDB access from the internetconform
No firewall rule allows NFS access from the internetconform
No firewall rule allows Telnet access from the internetconform
No firewall rule allows Tomcat Cluster Receiver access from the internetconform
Vertex AI notebook instance has a public IP addressconform

Enforces connections to use the latest SSL version

ControleStatus
Cloud SQL db not enforcing SSLconform
Deprecated SSL Protocol Usage Detectedconform
Deprecated SSL Protocol Usage Detectedconform
NodeJS talks to database without encryptionconform
SSL certificate verification turned off during requestsconform
SSL certificate verification turned off during requestsconform

Enforces connections using secure TLS version

ControleStatus
API Gateway stages are not using TLS 1.2 or higherconform
Azure Storage Accounts does not enforce latest TLS versionconform
Elasticsearch domain might have outdated TLS versionconform
Load balancer allows unencrypted or encrypted traffic with outdated TLS policyconform
Storage account does not enforce HTTPS-only trafficconform

Enforces the use of secure connections

ControleStatus
Cloud functions require HTTPS invocationsconform
Load Balancers only accept HTTPS connectionsconform

Prevents abuse of cookies

ControleStatus
Cookie missing HttpOnly flagconform
Laravel cookies can be sent unencryptedconform

Has proper access controls for cloud resources

ControleStatus
No user has both the Service Account User and Service Account Admin roleconform
Service accounts have strict access permissionsconform

Requires MFA for access to cloud resources

ControleStatus
Users are logging in securelyconform

Encrypts data at rest

ControleStatus
Amazon EKS Clusters should have secrets encryption enabledconform
API Gateway REST API caching is unencryptedconform
AWS ElastiCache Redis cluster should have encryption at rest enabledconform
ECR repository does not use AWS KMS encryptionconform
Elasticsearch domain is not encrypted at restconform
Ensure all data stored in the RDS is securely encrypted at restconform
KMS keys have key rotation enabledconform
SNS topics are not encrypted at restconform
SQS queue data is not encryptedconform
Virtual Machines have confidential computing enabledconform

Enforces connections to use the latest SSL version

ControleStatus
Cloud SQL db not enforcing SSLconform
Deprecated SSL Protocol Usage Detectedconform
Deprecated SSL Protocol Usage Detectedconform
NodeJS talks to database without encryptionconform
SSL certificate verification turned off during requestsconform
SSL certificate verification turned off during requestsconform

Enforces connections using secure TLS version

ControleStatus
API Gateway stages are not using TLS 1.2 or higherconform
App does not validate SSL certificates properlyconform
App uses an outdated TLS protocolconform
App uses an outdated TLS protocolconform
AWS ElastiCache Replication Group should encrypt data in transit and enable Redis AUTHconform
Azure Network Security Rule allows plaintext HTTP connectionsconform
Azure Network Security Rule allows plaintext HTTP connectionsconform
Azure Storage Account allows plaintext HTTP connectionsconform
Azure Storage Account allows plaintext HTTP connectionsconform
Azure Storage Accounts does not enforce latest TLS versionconform
Cloud functions require HTTPS invocationsconform
Cloud SQL instance requires SSL connectionsconform
DNSSEC is disabledconform
DNSSEC is enabled for all managed zonesconform
Elasticsearch domain might have outdated TLS versionconform
Express is not emitting security headersconform
Firewall rules restrict public ingress to port 2484conform
Firewall rules restrict public ingress to port 636conform
HTTP Client misconfigured with SSL validation disabledconform
Insecure gRPC connection can lead to remote code executionconform
Insecure gRPC connection can lead to remote code executionconform
Insecure HTTP Request detectedconform
Insecure TLS configuration detectedconform
Insecure usage of `requests` sends data over cleartextconform
Insecure websocket connection sends data over cleartextconform
Load balancer allows invalid HTTP headersconform
Load balancer allows unencrypted or encrypted traffic with outdated TLS policyconform
Load Balancers only accept HTTPS connectionsconform
NodeJS talks to database without encryptionconform
Outbound Ansible connections are not encryptedconform
Outbound Ansible connections are not encryptedconform
Server certificates are not verified during SSL/TLS connectionsconform
Server hostnames not verified during SSL/TLS connectionsconform
Signature validation for dnf packages is offconform
SQS queue data is not encryptedconform
Storage account does not enforce HTTPS-only trafficconform
TLS Certificate Validation Disabledconform
TLS Certificate Validation Disabledconform
Turning off TLS verification enables man-in-the-middle attacksconform
Usage of deprecated or broken encryption detectedconform
Use of broken or outdated encryptionconform
Use of broken or outdated encryptionconform
Use of broken or outdated encryptionconform
Using potentially unsafe FTP connections to move dataconform
Using potentially unsafe FTP connections to move dataconform
Weak SSL/TLS protocols usedconform

Enforces encryption of data in transit

ControleStatus
Domain SSL Certificate Expirationconform
HSTS header has malformed contentconform
HSTS header has malformed Max-Age directiveconform
HSTS header is defined via meta tagconform
HSTS header is disabledconform
HSTS header is malformed directiveconform
HSTS header is missingconform
Multiple HSTS headers are being setconform
TLS not enforced with valid HSTS headerconform

Prevents abuse of cookies

ControleStatus
Cookie missing HttpOnly flagconform
Laravel cookies can be sent unencryptedconform

No malware issues

ControleStatus
No open malware issuesconform

Threat detection is enabled

ControleStatus
Alerting policies have a notification channel configuredconform

Configured monitoring for code repositories

ControleStatus
Configured monitoring for all code repositoriesconform

Connected public facing domain

ControleStatus
Configured monitoring for domainsconform

Configured SLAs to resolve issues

ControleStatus
Has configured SLA settings for critical issuesconform

App scanned for SQL injection attack

ControleStatus
NoSQL injection attack possibleconform
NoSQL injection attack possibleconform
NoSQL injection attack possibleconform
Potential NoSQL injection via string-based query concatenationconform
Potential NoSQL injection via string-based query concatenationconform
Potential NoSQL injection via string-based query concatenationconform
Potential NoSQL injection via string-based query concatenationconform
Potential SQL injection in Doctrine's QueryBuilderconform
Potential SQL injection in sqlite3 via string-based query concatenationconform
Potential SQL injection through JDBC via string-based query concatenationconform
Potential SQL injection using sqflite execute sinkconform
Potential SQL injection via Drupal database functionalityconform
Potential SQL injection via dynamic raw query constructionconform
Potential SQL injection via dynamic raw query constructionconform
Potential SQL injection via dynamic raw query constructionconform
Potential SQL injection via Laravel functionconform
Potential SQL injection via string-based query concatenationconform
Potential SQL injection via string-based query concatenationconform
Potential SQL injection via string-based query concatenationconform
Potential SQL injection via string-based query concatenationconform
Potential SQL injection via string-based query concatenationconform
Potential SQL injection via string-based query concatenationconform
Potential SQL injection via string-based query concatenationconform
Potential SQL injection via string-based query concatenationconform
Potential SQL injection via string-based query concatenationconform
Potential SQL injection via string-based query concatenationconform
Potential SQL injection via string-based query concatenationconform
Potential SQL injection via string-based query concatenationconform
Potential SQL injection via string-based query concatenationconform
Potential SQL injection via string-based query concatenationconform
Potential SQL injection via string-based query concatenationconform
Potential SQL injection via string-based query concatenationconform
Potential SQL injection via string-based query concatenationconform
Potential SQL injection via string-based query concatenation using AuraSQL framework functionsconform
Potential SQL injection via Yii functionconform
Potential SQL injection when bypassing Django ORM with extra()conform
Potential SQL injection when bypassing Django ORM with RawSQL()conform
Potential SQL injection when bypassing Doctrine ORM with raw queryconform

Prevents Cross Site Scripting (XSS)

ControleStatus
Apex Visualforce misconfigurations may lead to Cross-Site Scripting (XSS) Vulnerabilitiesconform
Directly writing unsanitized input to http.ResponseWriter can lead to XSSconform
Disabling JSON HTML Escaping in ActiveSupport may lead to XSSconform
DOM Cross-Site Scripting (XSS) via Insecure jQuery Execution Sinksconform
HttpServletResponse output can be used for XSS attacksconform
Improper sanitization in dynamic attribute bindings can lead to XSS attacksconform
Input validation disabled in controllerconform
Jinja2 template config can lead to XSS attacksconform
Potential Cross Site Scripting (XSS) via window.location.hrefconform
Potential XSS due to enabling bypassSecurityTrustUrlconform
Potential XSS via MarkupStr(...) in Razor template may lead to XSSconform
Rendering unescaped input can lead to XSS attacksconform
Rendering unescaped input can lead to XSS attacksconform
Rendering unescaped input can lead to XSS attacksconform
Rendering unescaped input can lead to XSS attacksconform
Rendering unescaped input can lead to XSS attacksconform
Rendering unescaped input can lead to XSS attacksconform
Rendering unescaped input in EJS template can lead to XSS attacksconform
Rendering unescaped input in handlebar/mustache template can lead to XSS attacksconform
Rendering unescaped input in HTML template can lead to XSS attacksconform
Unsanitized user input in jQuery DOM handling methods detectedconform
Unsanitized user input leads to cross-site scripting (XSS)conform
Using dangerouslySetInnerHTML in React can lead to XSS attacksconform
Using document write methods can lead to XSS attacksconform
Using document write methods can lead to XSS attacksconform
Using document write methods can lead to XSS attacksconform
Using document write methods in .ejs files can lead to XSS attacksconform
Using raw on potential user input can leads to XSSconform
Using v-html in Vue templates can lead to XSS attacksconform

Prevents CSRF attacks

ControleStatus
CSRF protection disabled on purposeconform

Prevents remote code execution

ControleStatus
A potential Swift command injection vulnerability has been identified due to the construction of an operating system command with user-controlled input.conform
Arbitrary Code Execution via Unsafe Clojure Deserializationconform
Enabling NodeJS in Electron can lead to remote code executionconform
Enabling NodeJS in Electron can lead to remote code executionconform
Flask app debug mode may allow remote code executionconform
Handling potential user-controlled inputs into java.lang.Runtime calls can lead to command injection.conform
Insecure Deserialization in torch.load() leading to remote code executionconform
Insecure gRPC connection can lead to remote code executionconform
Insecure gRPC connection can lead to remote code executionconform
LDAP query injection may lead to data exposureconform
LDAP query injection may lead to data exposureconform
LDAP query injection may lead to data exposureconform
Object deserialization can lead to remote code executionconform
Object deserialization can lead to remote code executionconform
Object deserialization can lead to remote code executionconform
Object deserialization can lead to remote code executionconform
POSIX function called with arguments that trigger Buffer Overflowconform
Possible command injection via exec()-type functionsconform
Possible command injection via Process.Startconform
Possible command injection via Process.Startconform
Possible command injection via shell scriptconform
Possible command injection via user-controlled input to clojure.java.shell/shconform
Potential command injection via Command APIconform
Potential command injection via Process.runconform
Potential file inclusion attack via reading fileconform
Remote Code Execution possible via eval()-type functionsconform
Remote Code Execution possible via eval()-type functionsconform
Remote Code Execution possible via eval()-type functionsconform
Ruby reflection via constantize may lead to remote code executionconform
Ruby reflection via send may lead to RCEconform
Unsafe eval usage can lead to remote code executionconform
Unsafe eval usage can lead to remote code executionconform
Unsafe eval usage can lead to remote code executionconform
Unsafe eval usage can lead to remote code executionconform
Unsafe exec usage can lead to remote code executionconform
Unsafe exec usage can lead to remote code executionconform
Unsafe exec usage can lead to remote code executionconform
Unsafe subprocess usage can lead to remote code executionconform
Unsafe yaml load can lead to remote code executionconform
Unsafe yaml load can lead to remote code executionconform
Unsafe yaml load can lead to remote code executionconform
Usage of HttpInvokerServiceExporter can lead to remote code executionconform
Use of vulnerable ingress-nginx controllerconform
Use of vulnerable ingress-nginx controllerconform
Using backticks in PHP can lead to remote code executionconform
Using Marshal can lead to remote code executionconform
Using Pickle can lead to remote code executionconform
Using unserialize can lead to remote code executionconform
XXE attack can lead to remote code executionconform

Applies the least privilege principle for cloud users

ControleStatus
Users are only allowed to use corporate emailsconform

Requires MFA for access to cloud resources

ControleStatus
Users are logging in securelyconform

Applies the least privilege principle for cloud resource

ControleStatus
No user has both the Service Account User and Service Account Admin roleconform
Service accounts have strict access permissionsconform
Users are logging in securelyconform

Prevents unauthorized access via ssh

ControleStatus
AWS EKS Node groups have implicit SSH access from any IPconform
Firewall rule prevents RDP access from anywhereconform
Firewall rule prevents SSH access from anywhereconform
Firewall rules allow RDP access from any public IPconform
Firewall rules allow SSH from any public IPconform
Firewall rules allow SSH from any public IPconform
Firewall rules allow unrestricted SSH accessconform

Prevents unauthorized public access to database

ControleStatus
BigQuery table is anonymously or publicly accessibleconform
SQL instance root user has strict access permissionsconform
SQL instances do not have a public IP assignedconform
SQL instances have strict access permissionconform

Prevents unauthorized public access to file storage

ControleStatus
Azure Storage Account allow public accessconform
Azure Storage blobs do not restrict public access for nested itemsconform
S3 bucket grants public access to all contentsconform
S3 Buckets should have block public access globallyconform
Storage Buckets have proper access rulesconform
Storage buckets have public access prevention enabledconform

Prevents unauthorized public access to networks and instances

ControleStatus
Access to BigQuery datasets are restrictedconform
AKS API server does not limit access by IP rangesconform
Amazon EKS Clusters public endpoints should not allow traffic from any IPconform
Azure Cognitive Services allows unrestricted public network accessconform
Compute instances do not have public IP addressesconform
Firewall rule prevents Docker API access from anywhereconform
Firewall rules allow unrestricted RDP accessconform
Firewall rules do not allow unrestricted ingress to all ports and protocolsconform
Firewall rules restrict public ingress to port 11214conform
Firewall rules restrict public ingress to port 11215conform
Firewall rules restrict public ingress to port 135conform
Firewall rules restrict public ingress to port 137conform
Firewall rules restrict public ingress to port 138conform
Firewall rules restrict public ingress to port 139conform
Firewall rules restrict public ingress to port 1433conform
Firewall rules restrict public ingress to port 1434conform
Firewall rules restrict public ingress to port 23conform
Firewall rules restrict public ingress to port 2379conform
Firewall rules restrict public ingress to port 2383conform
Firewall rules restrict public ingress to port 2484conform
Firewall rules restrict public ingress to port 27017conform
Firewall rules restrict public ingress to port 27018conform
Firewall rules restrict public ingress to port 27019conform
Firewall rules restrict public ingress to port 3000conform
Firewall rules restrict public ingress to port 3020conform
Firewall rules restrict public ingress to port 3306conform
Firewall rules restrict public ingress to port 389conform
Firewall rules restrict public ingress to port 4505conform
Firewall rules restrict public ingress to port 4506conform
Firewall rules restrict public ingress to port 5500conform
Firewall rules restrict public ingress to port 5800conform
Firewall rules restrict public ingress to port 61621conform
Firewall rules restrict public ingress to port 636conform
Firewall rules restrict public ingress to port 7001conform
Firewall rules restrict public ingress to port 8000conform
Firewall rules restrict public ingress to port 9200conform
Firewall rules restrict public ingress to port 9300conform
Kubernetes master endpoint is not publicly availableconform
No firewall rule allows access to Open Telemtry metrics endpoint from the internetconform
No firewall rule allows access to port 1720 from the internetconform
No firewall rule allows cPanel access from the internetconform
No firewall rule allows etcd access from the internetconform
No firewall rule allows MongoDB access from the internetconform
No firewall rule allows NFS access from the internetconform
No firewall rule allows Telnet access from the internetconform
No firewall rule allows Tomcat Cluster Receiver access from the internetconform
Vertex AI notebook instance has a public IP addressconform

Requires MFA for access to cloud resources

ControleStatus
Users are logging in securelyconform

Enabled security logging for cloud instances

ControleStatus
Amazon EKS Clusters should have control plane logging enabledconform
Audit Configuration logging is enabledconform
Logging and alerts are enabled for Project Ownership assignmentsconform
Storage Permissions logging is enabledconform
VPC Firewall has Rule logging enabledconform

Threat detection is enabled

ControleStatus
Alerting policies have a notification channel configuredconform

Has backups for stateful cloud resources

ControleStatus
Databases have automated backups enabledconform

Configured SLAs to resolve issues

ControleStatus
Configured SLAs to resolve issuesconform

Has connected a cloud environment

ControleStatus
Configured monitoring for cloud environmentconform

Receives security alerts in real time

ControleStatus
Security notifications are enabledconform

Threat detection is enabled

ControleStatus
Alerting policies have a notification channel configuredconform

Configured monitoring for code repositories

ControleStatus
Configured monitoring for all code repositoriesconform

Configured monitoring for container images

ControleStatus
Configured monitoring for all container imagesconform

Has connected a cloud environment

ControleStatus
A cloud environment is connectedconform

Connected public facing domain

ControleStatus
Configured monitoring for domainsconform

Upload een gesprek. Lees de analyse. Vijf minuten.

Registratie in enkele seconden, zonder creditcard en zonder cookies. Een welcome tour laat u de belangrijkste principes zien, daarna voegt u uw eerste gesprek toe.

Early access · Uw feedback bouwt mee aan het product