GKE & PCI DSS ASV Scans

Question

For PCI DSS certification in GKE, the question is on ASV scans. Does Google already scan the load balancers or is the client responsible for scanning their own sites hosted in the GKE? Is there a list of domains that were in the GCP scope for their PCI compliance certification?

Looking for expanded guidance on ASV scans for compliance.

Answer 1

It is a shared responsibility model. Google does scan it's load balancing infra structure, but you are still responsible for scanning your actual endpoints.

For example, this is from requirement 11.4.2 in the shared responsibility matrix:

Customers are responsible for

... all
external penetration testing of
in-scope system components,
comprising their cardholder data
environment.
(Note: External vulnerability scans
should only include the
customer-managed endpoints, and
not GCP-managed endpoints as they
are tested as part of GCP PCI DSS
compliance)

Google is responsible for

... conducting
external penetration testing on
systems and infrastructure underlying
GCP. Google is also responsible for
scanning of Google managed API
endpoints and Cloud Load Balancer IP
addresses.