The PCI DSS rules have evolved, and now the scripts on your checkout page are a significant compliance concern. The latest version of the Payment Card Industry Data Security Standard (PCI DSS) introduces two critical requirements: 6.4.3 and 11.6.1. These rules mandate that payment-page scripts must be inventoried, authorized, and their integrity proven. Additionally, 11.6.1 requires the detection of tampering with page content and HTTP headers as they are received by the browser. This is a challenging task, especially with the constant changes in payment-page scripts. Reflectiz, a PCI DSS solution, has been evaluated by Integrity360 Europe, a PCI Qualified Security Assessor, and found to effectively support compliance. The key strengths of Reflectiz include its behavior-based monitoring, agentless deployment, and the ability to produce QSA-ready evidence in a single click. This makes it a valuable tool for merchants to ensure their checkout pages remain secure and compliant. However, it's important to note that merchants must still adhere to these requirements, even if they have a full redirect to their processor or an iframe payment method. The PCI SSC FAQ #1588 emphasizes the need for these controls, and the full assessment and white paper are available for further insights. This article highlights the evolving landscape of payment security and the importance of staying vigilant against web skimming and supply-chain attacks, which have already affected over 100,000 websites, including the British Airways breach in 2018. As the industry adapts to new security standards, solutions like Reflectiz play a crucial role in safeguarding sensitive payment data.
